Bun runtime for Vercel Functions now accepts Bun.serve as an entrypoint

The runtime update allows a Bun function to be launched with Bun.serve, meaning the same code you run locally can be deployed without wrapping it in a Vercel-specific framework. This includes support for static, dynamic, and wildcard routes defined in a routes map. The change is limited to projects that explicitly opt-in via the bunVersion setting.

From an operations standpoint, developers now configure the runtime by adding a bunVersion field to vercel.json and placing a server.ts file at the project root. The server definition mirrors the local Bun.serve API, so existing Bun scripts can be moved to Vercel with minimal alteration. However, any reliance on framework-provided middleware or security defaults must be re-implemented manually.

Security-wise, WebSocket handling is now part of the function instance, with each connection staying attached to that instance for its entire lifetime. This pinning reduces the surface for cross-instance data leakage but also means that a compromised instance could affect all its active connections. Engineers should therefore enforce strict validation and authentication within the fetch and websocket handlers, and consider using a hardened external store for any shared state.

The billing model switches to active CPU pricing for WebSocket traffic, charging only for the time spent processing messages. Because connections keep an instance alive, long-lived sockets can increase runtime duration and cost, even though idle time is not billed. Teams need to monitor connection durations and possibly implement timeouts to control expenses.

The new entrypoint does not apply to other Vercel runtimes, so mixed-language projects must continue using their existing adapters. Code that previously depended on Vercel's automatic request parsing or security middleware will need to incorporate those capabilities directly. Failure to replicate those safeguards could expose the function to injection or denial-of-service attacks.