Bun v1.4.3 tunes --compile bytecode executables and locks embedded exec flags

What happened on 2026-10-10

At 05:24 UTC on 2026-10-10, Bun published v1.4.3 on GitHub, with a detailed same-day post on the official blog. For single-file executables (bun build --compile), the release added --bytecode-order, which lays out bytecode using a profile from a real run to improve cold start. It also added --compile-jit-policy and --no-optimize-bytecode, and --bytecode output is 3 to 6 percent smaller. A --disallow-code-generation-from-strings=strict flag embedded via --compile-exec-argv now always applies, and BUN_OPTIONS can raise its level but not lower it. Fixes include reproducible output for --compile --bytecode --format=esm --splitting, and a crash when a debugger connected to a bytecode executable that called inspector.open(). Security fixes include verifying the server during the TLS handshake and a certificate name-matching issue (CVE-2026-48618).

What it means for a defender's threat model

The blog frames bytecode in terms of startup speed and memory, not protection, and that framing should be taken at face value. Compiling JavaScript into a single file or into bytecode changes how code is distributed and loaded; it should not be marketed as encryption or anti-reverse-engineering. Unless you have checked what your executable actually contains, assume its contents can be retrieved. Two changes in this release are genuinely useful for defenders. First, the embedded flag that disallows code generation from strings can no longer be lowered through an environment variable, which narrows one route for injecting dynamically executed code. That is runtime hardening, not code hiding. Second, reproducible builds let a team rebuild independently and check that a released artifact was not tampered with. Also, if your own code calls inspector.open(), it deliberately opens a debugging entry point; confirm that is intended.

Checks on your own builds

Run a few checks on your own Bun executables. Inventory the modules and resources bundled into the executable and confirm there are no keys, internal configuration or source maps you did not mean to ship; move confidential logic and credentials to the server. Where it fits, embed --disallow-code-generation-from-strings=strict through --compile-exec-argv and test every feature of the app under that restriction. Search your codebase for debugging entry points such as inspector.open() and make sure production builds cannot trigger them. Use reproducible builds: produce two independent builds in CI and compare their hashes as a release-integrity check. Sign and notarize Windows and macOS artifacts afterward. Read the release notes before upgrading, especially to see whether the TLS fixes affect your networking code.

Your checklist

• Inventory modules and resources in the executable and confirm no keys or stray source maps
• Embed the no-code-generation-from-strings flag and test every feature
• Compare hashes of two independent builds, then sign and notarize