Skip to content
Back to skills

Bun

ASecurity

Build with Bun runtime avoiding Node.js compatibility traps, bundler pitfalls, and package manager gotchas.

  • 16 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added June 7, 2026
developmentjavascripttypescriptgojavanodetestingdebugginggitapisecurity

Works with

  • cli
  • api

Security analysis

A100/100

Pro scans all 4 files and shows the line behind each finding

Scanned June 7, 2026

npx -y skills add modbender/skill-library-mcp --skill bun --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Bun?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Bun
[![Security: A β€” Skills Directory](https://www.skillsdirectory.com/api/skills/modbender-bun/badge)](https://www.skillsdirectory.com/skills/modbender-bun)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: Bun
slug: bun
version: 1.0.0
description: "Build with Bun runtime avoiding Node.js compatibility traps, bundler pitfalls, and package manager gotchas."
metadata: {"clawdbot":{"emoji":"πŸ₯Ÿ","requires":{"bins":["bun"]},"os":["linux","darwin","win32"]}}
---

## When to Use

User needs Bun expertise β€” fast JavaScript/TypeScript runtime, bundler, and package manager. Agent handles migration from Node, bundling for web/server, and troubleshooting compatibility issues.

## Quick Reference

| Topic | File |
|-------|------|
| Node.js API differences | `node-compat.md` |
| Bundler configuration | `bundler.md` |
| Package management | `packages.md` |

## Runtime Compatibility Traps

- `process.nextTick` timing differs from Node β€” race conditions appear that didn't exist before, use `queueMicrotask` for cross-runtime code
- `__dirname` and `__filename` don't exist in ESM β€” use `import.meta.dir` and `import.meta.file`, forgetting causes ReferenceError
- `fs.watch` misses events that Node catches β€” file watcher scripts silently miss changes, add polling fallback
- `child_process.spawn` options subset β€” some stdio configurations silently ignored, test subprocess code explicitly
- `cluster` module not supported β€” app crashes immediately if code uses cluster, must refactor to workers
- `vm` module partial β€” sandboxed code may escape or behave differently, security implications

## Bundler Traps

- `--target=browser` strips Node APIs silently β€” build succeeds, then runtime crashes on `fs`, `path`, etc.
- `--splitting` requires `--format=esm` β€” error message doesn't mention this, just fails cryptically
- Everything bundled by default β€” server code bundles node_modules, use `--external:package` for server deps
- Tree-shaking assumes no side effects β€” code with side effects may be removed, add `"sideEffects": false` to package.json or lose code
- CSS imports work differently than webpack β€” `url()` paths resolve wrong, test in actual browser
- `--minify` mangles names aggressively β€” debugging production crashes is harder, use `--minify-syntax` for safer minification

## Package Manager Traps

- `bun.lockb` is binary format β€” can't diff, can't merge, Git conflicts require delete and regenerate
- Peer dependencies auto-installed unlike npm β€” version conflicts appear silently, different versions than npm would pick
- `bun install` resolves differently than npm β€” "works on my machine" when teammate uses npm
- Workspaces `link:` protocol behaves differently β€” imports from workspace packages may fail
- `bun add` modifies `package.json` formatting β€” unwanted diff noise in commits
- No `npm audit` equivalent β€” security vulnerabilities not surfaced automatically

## TypeScript Traps

- Bun runs TypeScript directly without `tsc` β€” type errors don't stop execution, bugs ship to production
- Type-only imports may be kept β€” bundle size larger than expected
- `tsconfig.json` paths work differently β€” imports that worked in Node+tsc may fail
- Decorators experimental β€” behavior may differ from tsc, especially with legacy decorators

## Testing Traps

- `bun test` has different assertion API β€” tests written for Jest need adaptation
- Mock timing differs β€” tests that pass in Jest may fail or flake
- No native coverage like c8/nyc β€” need different tooling
- Snapshot format incompatible with Jest β€” can't share snapshots between runners

## Hot Reload Traps

- `bun --hot` doesn't reload native modules β€” changes require restart
- State preserved across reloads β€” bugs from stale state hard to debug
- WebSocket connections not re-established β€” clients appear connected but dead

Files in this skill

  • SKILL.md3.6 KB
  • bundler.md2.4 KB
  • node-compat.md2.2 KB
  • packages.md2.3 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.