--- title: "Bun rewrites in Rust, unsafe call count tells the real story" url: https://daily.dev/posts/bun-rewrites-in-rust-unsafe-call-count-tells-the-real-story-1nd73s8lb source_url: https://daily.dev/posts/bun-rewrites-in-rust-unsafe-call-count-tells-the-real-story-1nd73s8lb type: freeform source: "Rust Digest" published: 2026-05-18T04:20:15.705Z updated: 2026-05-18T04:20:37.227Z tags: ["rust", "claude-code", "bun"] reading_time: 5 upvotes: 20 comments: 5 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Bun rewrites in Rust, unsafe call count tells the real story **[Rust Digest](https://daily.dev/sources/rust_digest)** · 5 min read · 20 upvotes · 5 comments ## Summary Bun's codebase was rewritten from Zig to Rust in under a week — 960,000 lines ported almost entirely by Claude Code — with Bun 1.3.14 marking the last Zig release. The rewrite passes tests and slightly improves performance, but raises concerns with 13,000+ unsafe calls versus uv's 73, making it closer to C++ with a Rust compiler than idiomatic Rust. Cloudflare's quiche team published a post-mortem on a QUIC CUBIC congestion bug caused by a misported Linux kernel idle-detection heuristic, fixed with a one-line change. Other highlights include oxlint cutting config discovery time in half via readdir-based traversal, a 5.9x speedup in image-rs's fast_blur using integer accumulators and reciprocal multiplication, and a roundup of Rust ecosystem news including rust-analyzer releases, Cloud Hypervisor 52, IBM s390 Rust kernel support, and more. ## Content **TLDR:** Bun's Zig-to-Rust rewrite landed this week — 6,755 commits, over a million lines of new code, done almost entirely by Claude Code. The rewrite passes Bun's test suite and shrinks the binary, but already has 13,000+ unsafe calls compared to uv's 73. rust-analyzer shipped two releases with bug fixes, and Cloudflare's quiche team traced a nasty QUIC congestion death spiral to a misported Linux kernel idle-detection heuristic. --- ## Bun drops Zig, ships a Rust rewrite written by Claude Jarred Sumner merged the Bun Rust rewrite this week — 960,000 lines ported in under a week, with Bun 1.3.14 as the last Zig release. Two things drove the switch: Zig's pre-1.0 instability and breaking changes, and a direct conflict with Zig's no-AI contribution policy after Anthropic acquired Bun in late 2025. The rewrite passes existing tests, fixes several memory leaks, and benchmarks neutral to slightly faster. The uncomfortable number: 13,000+ unsafe calls in 681k lines of Rust, versus 73 in uv's 350k. That's not idiomatic Rust — it's closer to C++ with a Rust compiler. Whether AI-generated, minimally-reviewed code holds up under years of production maintenance is the real open question, and Bun is now one of the larger real-world tests of that proposition. ## Cloudflare's quiche QUIC bug: idle detection gone wrong The quiche team published a detailed post-mortem on a CUBIC congestion control bug where cwnd got permanently pinned at its minimum floor after heavy packet loss. The culprit was a Linux kernel optimization for idle periods that was ported incorrectly to user-space QUIC: when cwnd collapsed to two packets, every ACK cycle drove bytes_in_flight to zero, which the code read as application idleness rather than congestion-limited waiting. That inflated the idle delta by a full RTT, pushing recovery start time into the future and blocking cwnd growth entirely. The fix was measuring idle duration from last ACK time instead of last send time. One-line fix, subtle root cause — the kind of bug that only surfaces when you're running real traffic under real loss conditions. ## oxlint cuts config discovery time in half with readdir The oxlint and oxfmt teams traced a significant slowdown on large codebases to config file discovery: 150k sequential `is_file()` calls across 50k directories, each triggering a full kernel context switch. The fix replaces individual stat calls with `readdir`-based traversal, which returns filenames and file types without extra syscalls, then fuses the two-phase config-discovery-then-linting approach into a single pass. Result: 6.1s down to 2.8s on large projects. Straightforward systems fix, but a good reminder that syscall overhead compounds fast at scale. ## fast_blur in image-rs gets a 5.9x speedup Arthur Pastel published a detailed optimization walkthrough for the `fast_blur` function in image-rs, bringing a 1920x1080 RGBA blur from ~52ms to ~8ms. Two techniques did most of the work: replacing float arithmetic with integer accumulators to eliminate `to_f32`, `roundf`, and `min`/`max` calls, and replacing per-pixel integer division with a precomputed reciprocal executed as a 64-bit multiply and right shift. The post walks through each step with benchmarks and introduces a generic `BlurAccumulator` trait to handle both u8 and float pixel types cleanly. Real-time blur is now plausible on commodity hardware. --- ## Also notable - **Bun unsafe call ratio:** uv has 73 unsafe calls in 350k lines of Rust; Bun's port has 13,000+ in 681k lines — the gap is a useful proxy for how much of the safety guarantee actually transferred. - **rust-lang/rust LLM moderation policy:** The project introduced a policy restricting PR comments from discussing LLM social/economic impacts, environmental impact, copyright status, and moral judgments about LLM users. - **Rubydex:** A new Rust-backed static analysis engine for Ruby that replaced per-tool indexing; Tapioca's gem RBI generation dropped from ~6 minutes to ~20 seconds after migration. - **Cloud Hypervisor 52:** Adds AMD SEV-SNP confidential VM support via KVM on EPYC, plus a use-after-free fix in the VirtIO-Block async I/O path and async QCOW2 back-end with IO_uring. - **IBM s390 Rust kernel support:** A small patch series adds Rust support to the s390 (IBM Z) architecture in the Linux kernel, currently under review for possible inclusion in v7.2. - **Lanzaboote:** A Rust UEFI stub that brings Secure Boot to NixOS without bundling kernel and initrd into a single signed binary, solving the ESP space problem for multi-generation NixOS setups. - **Numa v0.14 ODoH support:** Ships a client, relay, and public deployment in a single Rust binary implementing RFC 9230 Oblivious DNS over HTTPS; currently only the second known public ODoH relay alongside Cloudflare. - **Toasty 0.6.0:** The async Rust ORM adds deferred fields, `Vec` collection fields with database-native storage (PostgreSQL arrays, JSON for other SQL DBs), and collection filter expressions like `intersects()`. - **Voxel engine 25x speedup:** A Rust/Bevy voxel engine hit 500 million voxels/second (up from 20M) using extremity bound checking, noise upsampling, noise caching, and run-length encoding as runtime storage. - **Cow elimination in JSON formatter:** Replacing `Cow` with `&str` and splitting token variants in a Rust JSON formatter produced 40-55% faster uglify benchmarks and beat Prettier and Oxfmt on JSON files. - **GlyphBlaster:** A Raspberry Pi Pico 2 W device that replaces the font ROM on an IBM CGA card to stream 60fps video over Wi-Fi using RLE-compressed UDP; firmware written in Rust with Embassy. - **Bun UB in safe Rust:** A GitHub issue flagged that Bun's Rust codebase contains undefined behavior in safe Rust via lifetime erasure in `PathString::init`; a fix marking the function unsafe and auditing ~70 call sites was proposed in PR #30728. - **This Week in Rust 651:** Covers iroh 1.0.0-rc.0, Burn 0.21.0, diesel-async 0.9, a trait solver performance win, and an 8% improvement on the typenum crate across 502 merged PRs. ## Community discussion Top comments from developers on daily.dev. **@altbenammi** · 1 upvotes > What is the obsession with rewriting stuff that works into Rust. I literally don't get it. Especially when it's already in a memory-safe language like Zig. ## Similar posts on daily.dev - [Bun rewrite in rust](https://daily.dev/posts/bun-rewrite-in-rust-zff65rp1d) · Medium · 2 upvotes · 1 comments --- Tags: [#rust](https://daily.dev/tags/rust), [#claude-code](https://daily.dev/tags/claude-code), [#bun](https://daily.dev/tags/bun) [View this post on daily.dev](https://daily.dev/posts/bun-rewrites-in-rust-unsafe-call-count-tells-the-real-story-1nd73s8lb)