Bun’s 11‑Day, 780k‑Line Migration from Zig to Rust Powered by AI

On July 8, 2026, the high‑performance front‑end full‑stack toolchain Bun announced a major upgrade: the entire codebase—1,448 Zig files and more than 780,000 lines—was migrated to Rust in 11 days, with the test suite achieving a 100% pass rate. The new v1.4.0 canary release marks Bun’s transition from Zig to Rust.

From Zig Rise to Stability Crisis

Bun originated in April 2021 when founder Jarred Sumner ported esbuild’s Go code to Zig, attracted by Zig’s minimal syntax, zero‑overhead abstractions, and low‑level control. This led to a one‑stop front‑end toolchain offering JS/TS/CSS transpilation, npm‑compatible package management, Jest‑style testing, full Node.js module resolution, HTTP/WebSocket clients, and dozens of Node.js API compatibilities. The CLI’s monthly downloads surpassed 22 million and major cloud platforms (Vercel, Railway, DigitalOcean) provided native support.

However, as the project grew beyond 530,000 lines of Zig code, hidden memory‑safety bugs exploded. Version v1.3.14 fixed dozens of critical issues such as node:zlib async write use‑after‑free, node:http2 re‑entrant callbacks causing double free, UDP socket buffer separation errors, Buffer out‑of‑bounds reads, crypto.scrypt memory leaks, and a double‑free in the CSS parser. The root cause was Zig’s lack of native constructors/destructors, forcing developers to manage lifetimes manually with defer/errdefer while also accommodating JavaScript’s garbage collection. Even with ASAN, fuzzing, and 24/7 leak monitoring, the team could only patch bugs reactively.

Why Rust?

After comparing Go, C++, and other languages, the team chose Rust because its borrow checker and Drop trait enforce compile‑time resource management, eliminating manual memory handling and preventing double frees. This safety is crucial for a runtime that mixes manual memory control with JavaScript GC.

Pure Mechanical Porting Strategy

The migration kept the original architecture, business logic, and performance characteristics unchanged. Over 100 Rust crates were created, and the team resolved more than 16,000 compilation errors and circular dependencies without altering user‑visible behavior.

AI‑Driven Large‑Scale Refactor

The rewrite was not a manual effort but an AI‑driven experiment. A single engineer used Anthropic’s pre‑release Claude Fable 5 to generate, review, and iteratively fix the code. The process consumed 5.9 billion input tokens, 0.69 billion output tokens, and 72 billion cache reads, costing roughly $165,000 in API fees. Multiple AI instances collaborated: one for code generation, one for adversarial review, and one for targeted fixes, forming a fully automated development loop.

Rigorous validation covered smoke tests, random shard tests, full CI on Linux/macOS/Windows, and cgroup‑based stress tests. All platforms passed 100%, and the migration produced comprehensive documentation (PORTING.md, LIFETIMES.tsv) for future contributors.

Quantitative Improvements

Memory usage dropped from a Zig build leak of ~3 MB per run (6,745 MB after 2,000 builds) to a steady 609 MB with Rust, fully traceable via LeakSanitizer.

Binary size shrank by 20%: Linux binaries fell from 88 MB to 70 MB, Windows from 94 MB to 76 MB, thanks to code folding, ICU data pruning, and delayed zstd decompression.

Performance gains of 2%–5% were observed on a Xeon Platinum platform: HTTP throughput rose from 169.6k req/s to 177.7k req/s (+4.8%), Next.js build time improved from 13.62 s to 13.03 s (+4.5%), and Vite/TS compilation tasks all saw speedups, with Claude Code startup up 10%.

Stability was overhauled: 128 stubborn bugs were fixed, high‑frequency crashes eliminated, and a million‑level test suite achieved full coverage, leaving only ~1.3 k (<4%) unsafe Rust lines for future cleanup.

Community Debate

The announcement sparked heated discussion on Hacker News. Proponents hailed it as a milestone for AI‑driven large‑scale open‑source refactoring, showcasing Rust’s strong type safety for long‑term maintenance. Critics warned of “vibe coding” risks in LLM‑generated code and suggested the move served Anthropic’s marketing agenda, arguing that equivalent Zig optimizations could have been achieved with comparable effort.

Consensus emerged that Zig excels in minimalism and low‑level control for small, high‑performance modules, while Rust’s compile‑time safety and AI‑friendly ecosystem make it better suited for complex, evolving infrastructure like Bun.

Industry Insight

The 11‑day migration demonstrates that AI can now handle the full “translate‑review‑fix‑test” pipeline, compressing months of work into days. It reinforces the view that strongly‑typed, safe languages will redefine engineering efficiency in the AI era.

Future Outlook

Version v1.4.0 is just the beginning. The Bun team plans to eliminate remaining unsafe code, adopt standard Rust idioms, enhance fuzz testing, shrink binaries further, and rely on tools like Miri and LeakSanitizer to cement stability. The shift from Zig’s raw performance to Rust’s safety illustrates a broader trend: short‑term speed yields to long‑term safety, maintainability, and sustainable iteration.

Getting Started

bun upgrade --canary