Bun itself is MIT-licensed.
JavaScriptCore
Bun statically links JavaScriptCore (and WebKit) which is LGPL-2 licensed. WebCore files from WebKit are also licensed under LGPL2. Per LGPL2:
(1) If you statically link against an LGPL’d library, you must also provide your application in an object (not necessarily source) format, so that a user has the opportunity to modify the library and relink the application.
You can find the patched version of WebKit used by Bun here: https://github.com/oven-sh/webkit. If you would like to relink Bun with changes:
git submodule update --init --recursivemake jsczig build
This compiles JavaScriptCore, compiles Bun’s .cpp bindings for JavaScriptCore (which are the object files using JavaScriptCore) and outputs a new bun binary with your changes.
Linked libraries
Bun statically links these libraries:
| Library | License |
|---|---|
boringssl | several licenses |
brotli | MIT |
libarchive | several licenses |
lol-html | BSD 3-Clause |
mimalloc | MIT |
picohttp | dual-licensed under the Perl License or the MIT License |
zstd | dual-licensed under the BSD License or GPLv2 license |
simdutf | Apache 2.0 |
tinycc | LGPL v2.1 |
uSockets | Apache 2.0 |
zlib-cloudflare | zlib |
c-ares | MIT licensed |
libicu 72 | license here |
libbase64 | BSD 2-Clause |
libuv (on Windows) | MIT |
libdeflate | MIT |
A fork of uWebsockets | Apache 2.0 licensed |
| Parts of Tigerbeetle's IO code | Apache 2.0 licensed |
Polyfills
For compatibility reasons, the following packages are embedded into Bun's binary and injected if imported.
| Package | License |
|---|---|
assert | MIT |
browserify-zlib | MIT |
buffer | MIT |
constants-browserify | MIT |
crypto-browserify | MIT |
domain-browser | MIT |
events | MIT |
https-browserify | MIT |
os-browserify | MIT |
path-browserify | MIT |
process | MIT |
punycode | MIT |
querystring-es3 | MIT |
stream-browserify | MIT |
stream-http | MIT |
string_decoder | MIT |
timers-browserify | MIT |
tty-browserify | MIT |
url | MIT |
util | MIT |
vm-browserify | MIT |