Bun v1.3.13 Released: Tarball Streaming Cuts Install Memory 17×, zlib-ng Triples Gzip Speed (April 2026)

Bun, the all-in-one JavaScript runtime, shipped v1.3.13 on April 20, 2026, fixing 82 issues and landing a tarball-streaming installer that uses 17× less memory, a switch to zlib-ng for 5.5× faster gzip, and a parallel test runner with --parallel, --isolate, --shard, and --changed flags.

What Happened

Bun core team published the v1.3.13 release notes on the official Bun blog at 07:33 UTC on April 20, 2026, with the GitHub release tag bun-v1.3.13 cut roughly 35 minutes later. The release closes 82 issues that, between them, accumulated 381 thumbs-up reactions on GitHub — making it one of the more user-driven point releases in the 1.3 series.

The headline change is to bun install: tarballs are now streamed and extracted as bytes arrive over the network, instead of being buffered into memory as a complete .tgz and decompressed .tar before extraction. Bun's blog post claims the new path uses 17× less peak memory on large monorepo installs — only the in-flight HTTP chunk plus libarchive's fixed per-archive buffers are resident at any moment.

The runtime also swapped its zlib dependency from the Cloudflare zlib fork (last updated October 2023) to zlib-ng 2.3.3, the same library used by Node.js 24 and Chromium. zlib-ng provides runtime-dispatched SIMD acceleration across AVX-512, AVX2, SSE2, NEON, SVE, and the RISC-V vector extension. Bun's benchmarks measure 5.5× faster gzip compression and decompression versus 1.3.12.

Key Details

• Test runner goes parallel — bun test --parallel runs test files across worker processes; --isolate gives each file a fresh runtime; --shard 1/4 partitions the suite for CI; --changed runs only files affected by the current git diff.
• Source maps use 8× less memory — Bun now uses an interned-string and varint-encoded representation for parsed source maps, dropping memory cost dramatically on large bundles.
• Range requests in Bun.serve() — HTTP Range headers are now honored automatically when serving Bun.file(), enabling resumable downloads and HTML5 video seeking out of the box.
• SHA3 in node:crypto and WebCrypto — SHA3-224, SHA3-256, SHA3-384, and SHA3-512 are now exposed through both APIs, closing a long-standing Node.js compatibility gap.
• WebSocket over Unix sockets — ws+unix:// URLs are now supported by the WebSocket client for IPC and sidecar use cases.
• JavaScriptCore upgrade — Bun's WebKit-derived engine merged 1,316 upstream commits, picking up performance work and bug fixes that landed in Safari Technology Preview throughout Q1 2026.
• Post-quantum building blocks — BoringSSL was updated to a build that includes ML-KEM and ML-DSA (NIST FIPS 203 and 204) primitives, laying the groundwork for future post-quantum TLS support.

What Developers Are Saying

Reaction in the JavaScript ecosystem has been broadly positive. The blog post landed at the top of Bun's blog and circulated quickly on X, where Bun creator Jarred Sumner highlighted the install-memory win and the test-runner sharding flags as the most-requested items in the 1.3 milestone. Comments under prior Bun threads on Hacker News had repeatedly cited memory blow-ups during bun install on monorepos as one of the few remaining production blockers; the streaming installer is a direct response to that feedback.

Some developers on Reddit's r/node noted that the zlib-ng switch finally brings Bun's gzip throughput in line with Node.js 24, removing a quiet performance gap that had favored Node in HTTP compression benchmarks. Critics, meanwhile, pointed out that Bun's Windows port still trails Linux and macOS on stability, and that the new --parallel test mode does not yet support --coverage in the same run — a limitation Bun's team acknowledges in the release notes.

What This Means for Developers

For most Bun users the upgrade is drop-in: bun upgrade pulls 1.3.13 and existing scripts keep working. Teams running large monorepo installs in CI should see the most immediate benefit — both in lower peak memory and shorter install times thanks to streamed extraction and faster gzip. Test suites that previously serialized through bun test can move to --parallel --isolate to cut wall-clock time, and CI pipelines can shard with --shard i/N across runners.

The Range-request support in Bun.serve() is the kind of small change that quietly makes Bun a more credible drop-in for static-asset and media servers; teams previously reaching for Express or a CDN edge function for resumable downloads can now serve from Bun directly.

What's Next

Bun's roadmap, last updated alongside the 1.3 launch in October 2025, lists a stable Windows release, full node:cluster support, and a long-promised compile-to-single-binary mode for Bun apps as the remaining 1.x milestones. The team has indicated v1.3.14 will continue closing Node.js compatibility gaps. Issue tracking and the canary build channel are on the project's GitHub repository.

Sources

• Bun v1.3.13 release notes — bun.com — primary source published by the Bun team.
• oven-sh/bun GitHub releases — release tag, SHAs, and downstream issue links.
• Bun Blog — historical 1.3 series context for the streaming installer and zlib-ng work.
• zlib-ng project — the upstream library Bun migrated to in this release.
• Bun 1.3 — Hacker News discussion — community context from the 1.3 release thread that fed user feedback into 1.3.13.
• The Register — coverage of recent Bun memory work — independent reporting cross-referencing Bun's memory-management posture in April 2026.