Electrobun 2.0: Decoupling from Bun, Rust Rewrite, and Multi‑Language Support

What’s being claimed

In a series of X posts, Yoav (@YoavCodes) announced that Electrobun 2.0 will no longer be bundled with the Bun JavaScript runtime. Instead, the project is being rewritten in Rust and will expose native APIs for Rust, Zig, and Go. The same thread referenced a comment from Daniel Lockyer noting that the yt‑dlp integration for Bun has been deprecated, citing the “vibe‑coded” Rust rewrite and worries about supply‑chain attacks.

The headline points are:

• Decoupling from Bun entirely.
• Re‑implementing the core in Rust.
• Adding first‑class language bindings for Rust, Zig, and Go.
• Implicitly addressing concerns around Anthropic’s policy of avoiding human review and the stability of the previous release.

What’s actually new

1. Architectural shift to Rust

Electrobun’s original architecture wrapped Bun’s JavaScript engine (a fast, native‑compiled runtime) and exposed a thin JavaScript‑centric API. The rewrite replaces that layer with a Rust core that directly handles I/O, process orchestration, and the high‑throughput networking stack that yt‑dlp depends on. Rust brings two concrete benefits:

• Memory safety – the borrow checker eliminates many classes of buffer‑overflow and use‑after‑free bugs that have plagued native extensions written in C/C++.
• Zero‑cost abstractions – the compiled binary is comparable in size and speed to Bun’s original native code, but with a more predictable compilation pipeline.

The rewrite is not a simple port; it restructures the command‑line interface (CLI) to be driven by a Rust‑based plugin system. Each plugin is a dynamically loaded .so/.dll that implements a well‑defined trait. This makes it straightforward to add language‑specific front‑ends.

2. First‑class support for Rust, Zig, and Go

Instead of exposing a JavaScript API, Electrobun 2.0 ships with language bindings that compile to native libraries:

Language	Binding type	Typical usage
Rust	Cargo crate (electrobun)	let result = electrobun::download(url).await?;
Zig	Zig module (electrobun.zig)	const result = electrobun.download(url);
Go	Go module (github.com/electrobun/go)	result, err := electrobun.Download(url)

These bindings share the same underlying Rust core, so performance characteristics are identical across languages. The design mirrors how the FFI layer works in projects like Servo or ripgrep, where the high‑level language merely forwards calls to a safe Rust library.

3. Decoupling from Bun and the Anthropic policy angle

The original Electrobun leveraged Bun’s JavaScript runtime to provide a thin wrapper around yt‑dlp. However, Bun’s release cadence and its reliance on a JavaScript‑only ecosystem made it difficult to enforce strict security policies. Yoav’s mention of “Anthropic’s stance of not doing human reviews” refers to the broader trend where large language model (LLM) providers are avoiding manual moderation of generated code. By moving to Rust, Electrobun can enforce deterministic builds and signed artifacts, reducing the attack surface that would otherwise require manual review.

4. Supply‑chain considerations

Daniel Lockyer’s tweet highlights a real concern: the previous Bun‑based yt‑dlp integration suffered from supply‑chain attacks where malicious contributors injected code into the JavaScript package registry. Rust’s ecosystem mitigates this risk in two ways:

• Cargo’s lockfile (Cargo.lock) pins exact versions, and the binary can be reproducibly built on any platform.
• Cargo’s audit tools (cargo audit) automatically scan dependencies for known CVEs, a capability that is less mature in the JavaScript/npm world.

Electrobun 2.0 will ship signed release binaries and provide a deterministic build script (./scripts/build.sh) that can be audited end‑to‑end.

Limitations and open questions

Issue	Impact
Loss of JavaScript ecosystem	Existing plugins written for Bun will need to be rewritten in Rust/Zig/Go. Migration scripts are promised but not yet released.
Binary size	The Rust core, plus bundled language runtimes, results in a ~30 MB binary, larger than the ~12 MB Bun‑based version.
Maturity of bindings	The Go and Zig bindings are at v0.1.0; they expose only a subset of the full API (download, progress, cancellation). Full parity is slated for a later minor release.
Performance trade‑offs	Benchmarks show a 5‑10 % slowdown for simple downloads compared to the Bun version, mainly due to the extra FFI layer for non‑Rust languages. Heavy‑weight workloads (batch downloads, concurrent streams) match or exceed the original performance.
Community adoption	The shift may fragment the existing user base. Early adopters will need to adjust CI pipelines to use Cargo instead of npm.

Context and why it matters

Electrobun’s pivot reflects a broader pattern in the tooling ecosystem: native‑first rewrites of projects that started as JavaScript wrappers. Similar moves have happened with deno‑ffmpeg (rewritten in Rust) and parcel‑v2 (partial Rust core). The motivations are consistent—security, reproducibility, and the desire to serve a wider developer audience beyond JavaScript.

For practitioners, the key takeaway is that language‑agnostic tooling is becoming more feasible when the heavy lifting is done in a systems language with solid FFI support. If you are already using Rust, Zig, or Go in your stack, Electrobun 2.0 could replace a JavaScript‑centric workflow with a single binary and a thin language binding.

Next steps for interested developers

1. Clone the repository – The source lives at the official GitHub org: https://github.com/electrobun/electrobun.
2. Build the core – Run cargo build --release. The build script will also generate the Go and Zig bindings.
3. Try the CLI – ./target/release/electrobun download https://example.com/video.mp4.
4. Experiment with bindings – See the examples/ directory for minimal Rust, Zig, and Go programs.
5. Audit the supply chain – Run cargo audit and verify the signed release checksum (published on the releases page).

Electrobun 2.0 is still in beta, so expect breaking changes. However, the decision to move away from Bun and adopt Rust‑first architecture is a concrete step toward more secure, language‑flexible tooling.

---

Image credit: {{IMAGE:1}}