
Security News
New CNAPulse Dashboard Tracks CNA Activity and Disclosure Trends
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.


Sarah Gooding
July 22, 2025
Over the weekend, bun shipped a highly anticipated 1.2.19 release with significant improvements for developers working with monorepos.
This release introduces isolated installs with the new --linker=isolated option. This change is designed to improve dependency management in monorepos by preventing cross-package conflicts, an issue that has previously led developers to rely on other package managers.
The bun install --linker=isolated command restructures the node_modules layout to ensure each package remains self-contained. This approach addresses long-standing concerns about ghost dependencies and improves predictability for monorepo setups. This as a major step forward for Bun’s package manager.
This release positions Bun to compete more directly with pnpm, which has traditionally dominated monorepo workflows. Isolated installs make it easier for teams to migrate from other ecosystems without running into the dependency issues that previously made Bun harder to adopt for complex projects. For Bun, this is an important milestone in becoming a practical, full-featured replacement for Node.js and npm.
A new command, bun pm pkg, lets developers programmatically edit package.json by getting, setting, deleting, and even auto-fixing keys. This addition simplifies scripting around project configuration and mirrors the utility of npm pkg or pnpm pkg with Bun’s usual performance advantages.
Bun also improves workspace installs, fixing redundant evaluations that slowed down large monorepos. Dependency resolution logic is now consistent with other package managers, prioritizing devDependencies > optionalDependencies > dependencies > peerDependencies. The .npmrc settings link-workspace-packages and save-exact are now honored, bringing Bun closer to parity with npm and pnpm.
The new bun why command helps trace dependency chains, similar to yarn why, making it easier to understand why a package is installed.
Bun’s built-in PostgreSQL client, Bun.sql, now uses automatic query pipelining, yielding up to 5x performance gains for high-concurrency workloads compared to Node.js. A new --sql-preconnect flag reduces cold-start latency by pre-warming database connections at runtime, a welcome feature for serverless and low-latency applications.
Bun starts up 1ms faster and uses 3MB less memory thanks to low-level Zig optimizations. The bundler benefits from SIMD-accelerated comment parsing, removal of unused Symbol.for() calls, and smarter dead-code elimination in try...catch blocks, reducing bundle sizes.
The release also includes memory and startup optimizations, expanded Node.js API compatibility, and TypeScript type improvements. In total, the team resolved 163 issues, addressing more than 1,000 community-reported concerns.
This is a major update for Bun that has received positive overwhelmingly positive feedback, particularly from developers working with monorepos. The new linker resolves previous conflicts between dependencies and aligns Bun with workflows that have been difficult to support until now. Check out the full details in the 1.2.19 announcement post on the Bun website.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.

Research
/Security News
The Socket Threat Research Team uncovered a coordinated campaign that floods the Chrome Web Store with 131 rebranded clones of a WhatsApp Web automation extension to spam Brazilian users.

Security News
ENISA’s 2025 Threat Landscape report highlights how AI is reshaping cyber attacks, driving phishing, model poisoning, and software supply chain risks.