Skip to content
Back to skills

Bun

ASecurity

Build with Bun runtime avoiding Node.js compatibility traps, bundler pitfalls, and package manager gotchas.

  • 17 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added September 6, 2026
developmentjavascripttypescriptgojavanodetestingdebugginggitapisecurity

Works with

  • cli
  • api

Security analysis

A100/100

Pro scans all 5 files and shows the line behind each finding

Scanned September 6, 2026

npx -y skills add clawic/skills --skill bun --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Bun?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Bun
[![Security: A β€” Skills Directory](https://www.skillsdirectory.com/api/skills/clawic-bun/badge)](https://www.skillsdirectory.com/skills/clawic-bun)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: Bun
slug: bun
version: 1.0.0
description: Build with Bun runtime avoiding Node.js compatibility traps, bundler pitfalls, and package manager gotchas.
homepage: https://clawic.com/skills/bun
metadata:
  clawdbot:
    emoji: πŸ₯Ÿ
    requires:
      bins:
      - bun
    os:
    - linux
    - darwin
    - win32
    displayName: Bun
---

## When to Use

User needs Bun expertise β€” fast JavaScript/TypeScript runtime, bundler, and package manager. Agent handles migration from Node, bundling for web/server, and troubleshooting compatibility issues.

## Quick Reference

| Topic | File |
|-------|------|
| Node.js API differences | `node-compat.md` |
| Bundler configuration | `bundler.md` |
| Package management | `packages.md` |

## Runtime Compatibility Traps

- `process.nextTick` timing differs from Node β€” race conditions appear that didn't exist before, use `queueMicrotask` for cross-runtime code
- `__dirname` and `__filename` don't exist in ESM β€” use `import.meta.dir` and `import.meta.file`, forgetting causes ReferenceError
- `fs.watch` misses events that Node catches β€” file watcher scripts silently miss changes, add polling fallback
- `child_process.spawn` options subset β€” some stdio configurations silently ignored, test subprocess code explicitly
- `cluster` module not supported β€” app crashes immediately if code uses cluster, must refactor to workers
- `vm` module partial β€” sandboxed code may escape or behave differently, security implications

## Bundler Traps

- `--target=browser` strips Node APIs silently β€” build succeeds, then runtime crashes on `fs`, `path`, etc.
- `--splitting` requires `--format=esm` β€” error message doesn't mention this, just fails cryptically
- Everything bundled by default β€” server code bundles node_modules, use `--external:package` for server deps
- Tree-shaking assumes no side effects β€” code with side effects may be removed, add `"sideEffects": false` to package.json or lose code
- CSS imports work differently than webpack β€” `url()` paths resolve wrong, test in actual browser
- `--minify` mangles names aggressively β€” debugging production crashes is harder, use `--minify-syntax` for safer minification

## Package Manager Traps

- `bun.lockb` is binary format β€” can't diff, can't merge, Git conflicts require delete and regenerate
- Peer dependencies auto-installed unlike npm β€” version conflicts appear silently, different versions than npm would pick
- `bun install` resolves differently than npm β€” "works on my machine" when teammate uses npm
- Workspaces `link:` protocol behaves differently β€” imports from workspace packages may fail
- `bun add` modifies `package.json` formatting β€” unwanted diff noise in commits
- No `npm audit` equivalent β€” security vulnerabilities not surfaced automatically

## TypeScript Traps

- Bun runs TypeScript directly without `tsc` β€” type errors don't stop execution, bugs ship to production
- Type-only imports may be kept β€” bundle size larger than expected
- `tsconfig.json` paths work differently β€” imports that worked in Node+tsc may fail
- Decorators experimental β€” behavior may differ from tsc, especially with legacy decorators

## Testing Traps

- `bun test` has different assertion API β€” tests written for Jest need adaptation
- Mock timing differs β€” tests that pass in Jest may fail or flake
- No native coverage like c8/nyc β€” need different tooling
- Snapshot format incompatible with Jest β€” can't share snapshots between runners

## Hot Reload Traps

- `bun --hot` doesn't reload native modules β€” changes require restart
- State preserved across reloads β€” bugs from stale state hard to debug
- WebSocket connections not re-established β€” clients appear connected but dead

Files in this skill

  • SKILL.md3.7 KB
  • _meta.json158 B
  • bundler.md2.3 KB
  • node-compat.md2.2 KB
  • packages.md2.2 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…