Due to foreseeable compatibility and security issues, yt-dlp's support for Bun as an ejs-compatible JavaScript runtime is being both limited and deprecated.
As of the next yt-dlp and/or ejs release, only Bun versions 1.2.11 through 1.3.14 will be supported. The rationale for this change is twofold:
-
The minimum required version is being raised from 1.0.31 to 1.2.11 because building the ejs package with a version earlier than 1.2.0 results in the ejs lockfile being ignored, which is a significant security concern for users when considering all of the recent npm supply chain attacks. Additionally, the support floor is being bumped to 1.2.11 instead of 1.2.0 because the ejs test suite cannot be run with versions of Bun earlier than 1.2.11.
-
Bun was recently rewritten in Rust using Claude, and its development seems to have taken a turn towards being fully vibe-coded. This is alarming and disappointing for a number of reasons, and frankly it seems like a future headache that we'd prefer to avoid. We are adding a support ceiling of version 1.3.14, as that is the last release built from the original zig codebase.
Bun support will also be deprecated. This means that while yt-dlp will continue to support this narrower range of Bun versions for as long as they're able to meet the needs of yt-dlp and ejs, we reserve the right to completely drop support for Bun should it at any point become too burdensome to maintain.
See the EJS wiki article for more information about supported JavaScript runtimes.
Due to foreseeable compatibility and security issues, yt-dlp's support for Bun as an
ejs-compatible JavaScript runtime is being both limited and deprecated.As of the next yt-dlp and/or ejs release, only Bun versions
1.2.11through1.3.14will be supported. The rationale for this change is twofold:The minimum required version is being raised from
1.0.31to1.2.11because building theejspackage with a version earlier than1.2.0results in the ejs lockfile being ignored, which is a significant security concern for users when considering all of the recent npm supply chain attacks. Additionally, the support floor is being bumped to1.2.11instead of1.2.0because theejstest suite cannot be run with versions of Bun earlier than1.2.11.Bun was recently rewritten in Rust using Claude, and its development seems to have taken a turn towards being fully vibe-coded. This is alarming and disappointing for a number of reasons, and frankly it seems like a future headache that we'd prefer to avoid. We are adding a support ceiling of version
1.3.14, as that is the last release built from the original zig codebase.Bun support will also be deprecated. This means that while yt-dlp will continue to support this narrower range of Bun versions for as long as they're able to meet the needs of yt-dlp and ejs, we reserve the right to completely drop support for Bun should it at any point become too burdensome to maintain.
See the EJS wiki article for more information about supported JavaScript runtimes.
Support for
bun>1.3.14has now been dropped. yt-dlp will allow the user to bring a newer version of bun, but doing so will trigger a warning that informs the user their version is unsupported and directs them not to open a bug report. Any such bug reports will be ignored and closed. If you believe you've encountered an actual yt-dlp/ejs bug that should be brought to our attention, then reproduce the issue using a supported JS runtime/version.This announcement thread was created solely to communicate with users of yt-dlp's bun integration: to communicate the upcoming changes to them, and so they could communicate feedback to us. (Note that this issue was created inbetween the similar node …