From 0180e3f547853c322b5cc8a4d938c1cf95148ed2 Mon Sep 17 00:00:00 2001
From: Chisa Kotegawa <155065216+DEOWL-kan@users.noreply.github.com>
Date: Sat, 5 Sep 2026 18:04:26 +0800
Subject: [PATCH] docs(skills): clarify Bun audit and CI timing guidance

---
 .agents/skills/bun-runtime/SKILL.md    | 6 +++---
 .cursor/skills/bun-runtime/SKILL.md    | 6 +++---
 docs/ja-JP/skills/bun-runtime/SKILL.md | 6 +++---
 docs/zh-CN/skills/bun-runtime/SKILL.md | 6 +++---
 skills/bun-runtime/SKILL.md            | 6 +++---
 5 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.agents/skills/bun-runtime/SKILL.md b/.agents/skills/bun-runtime/SKILL.md
index a0318ab2f..6e26805a4 100644
--- a/.agents/skills/bun-runtime/SKILL.md
+++ b/.agents/skills/bun-runtime/SKILL.md
@@ -24,11 +24,11 @@ Use when: adopting Bun, migrating from Node, writing or debugging Bun scripts/te
 
 **Migration from Node**: Replace `node script.js` with `bun run script.js` or `bun script.js`. Run `bun install` in place of `npm install`; most packages work. Use `bun run` for npm scripts; `bun x` for npx-style one-off runs. Node built-ins are supported; prefer Bun APIs where they exist for better performance.
 
-**Package and workspace commands**: `bun add <pkg>` / `bun remove <pkg>` / `bun update [pkg]` manage dependencies; `bun outdated` lists stale deps; `bun pm ls` shows the dependency tree derived from the lockfile (not a listing of what's actually on disk). Read-only inspection: `bun audit` reports known vulnerabilities. Modifying: `bun audit fix` applies fixes, `bun dedupe` collapses duplicate installs, and `bun prune` removes packages no longer referenced. Monorepos use a root `workspaces` array in `package.json` (same convention as npm/yarn); run a script in one workspace with `bun run --filter <pkg-name> <script>`.
+**Package and workspace commands**: `bun add <pkg>` / `bun remove <pkg>` / `bun update [pkg]` manage dependencies; `bun outdated` lists stale deps; `bun pm ls` shows the dependency tree derived from the lockfile (not a listing of what's actually on disk). Read-only inspection: `bun audit` reads `bun.lock` and sends the package list to the npm advisory endpoint (or each scoped registry's own advisory endpoint) to report known vulnerabilities — it doesn't touch local files, but it isn't offline, so on private projects only use an approved registry/advisory endpoint, since package names and versions (including private ones) leave the machine. Modifying: `bun audit fix` applies fixes, `bun dedupe` collapses duplicate installs, and `bun prune` removes packages no longer referenced. Monorepos use a root `workspaces` array in `package.json` (same convention as npm/yarn); run a script in one workspace with `bun run --filter <pkg-name> <script>`.
 
 **Built-in APIs**: reach for these before adding a dependency — `Bun.file` / `Bun.write` for file I/O, `bun:sqlite` for an embedded SQLite database, `Bun.serve` for an HTTP/WebSocket server, [`Bun.sql`](https://bun.com/docs/runtime/sql) for SQL databases, [`Bun.redis`](https://bun.com/docs/runtime/redis) for Redis, and [`Bun.S3Client`](https://bun.com/docs/runtime/s3) for S3-compatible object storage. See the [1.4 release notes](https://bun.com/blog/bun-v1.4) for the rest of what's new.
 
-**Vercel**: Set runtime to Bun in project settings. Build: `bun run build` or `bun build ./src/index.ts --outdir=dist`. Install: `bun install --frozen-lockfile` for reproducible deploys.
+**Vercel**: Set `bunVersion: "1.4.x"` in `vercel.json` to use Bun 1.4 (Rust runtime) — `"1.x"` currently still resolves to the older 1.3.14. See [Vercel's Bun runtime docs](https://vercel.com/docs/functions/runtimes/bun). Build: `bun run build` or `bun build ./src/index.ts --outdir=dist`. Install: `bun install --frozen-lockfile` for reproducible deploys.
 
 **Reference**: [Bun 1.4 release notes](https://bun.com/blog/bun-v1.4).
 
@@ -60,7 +60,7 @@ bun test
 bun test --watch
 ```
 
-For CI, Bun 1.4's test runner adds: `bun test --changed[=<ref>]` (run test files affected by changes vs. a git commit/branch — includes tests exercising changed source files, not just edited test files), `bun test --isolate` (fresh global object per test file, so leaked handles in one file can't affect another; implied by `--parallel`), `bun test --parallel[=<n>]` (run test files across N worker processes, defaults to CPU core count), `bun test --shard=<n>/<count>` (split one suite across CI runners), and `bun test --timings=<file>` with `--update-timings` (merge per-file duration data across shards so `--shard`/`--parallel` can front-load the slowest files). Example: `bun test --parallel --timings=./test-timings.json --update-timings`. Run `bun test --help` locally to confirm exact flag behavior for your installed version.
+For CI, Bun 1.4's test runner adds: `bun test --changed[=<ref>]` (run test files affected by changes vs. a git commit/branch — includes tests exercising changed source files, not just edited test files), `bun test --isolate` (fresh global object per test file, so leaked handles in one file can't affect another; implied by `--parallel`), `bun test --parallel[=<n>]` (run test files across N worker processes, defaults to CPU core count), `bun test --shard=<n>/<count>` (split one suite across CI runners), and `bun test --timings=<file>` (reads JSON per-file duration data to front-load the slowest files) with `--update-timings` (writes to the first `--timings` path given — without `--shard` it merges into existing entries; with `--shard` it writes only the current shard's files to that same first `--timings` path — Bun does not pick a different path per shard automatically, so choose a distinct output path for each shard to avoid overwriting other shards' timing records; pass `--timings` multiple times, once per shard file, to read them together as a single combined table). Example: `bun test --parallel --timings=./test-timings.json --update-timings`. Run `bun test --help` locally to confirm exact flag behavior for your installed version.
 
 ```typescript
 // test/example.test.ts
diff --git a/.cursor/skills/bun-runtime/SKILL.md b/.cursor/skills/bun-runtime/SKILL.md
index b3f3859ff..8e7e75f26 100644
--- a/.cursor/skills/bun-runtime/SKILL.md
+++ b/.cursor/skills/bun-runtime/SKILL.md
@@ -25,11 +25,11 @@ Use when: adopting Bun, migrating from Node, writing or debugging Bun scripts/te
 
 **Migration from Node**: Replace `node script.js` with `bun run script.js` or `bun script.js`. Run `bun install` in place of `npm install`; most packages work. Use `bun run` for npm scripts; `bun x` for npx-style one-off runs. Node built-ins are supported; prefer Bun APIs where they exist for better performance.
 
-**Package and workspace commands**: `bun add <pkg>` / `bun remove <pkg>` / `bun update [pkg]` manage dependencies; `bun outdated` lists stale deps; `bun pm ls` shows the dependency tree derived from the lockfile (not a listing of what's actually on disk). Read-only inspection: `bun audit` reports known vulnerabilities. Modifying: `bun audit fix` applies fixes, `bun dedupe` collapses duplicate installs, and `bun prune` removes packages no longer referenced. Monorepos use a root `workspaces` array in `package.json` (same convention as npm/yarn); run a script in one workspace with `bun run --filter <pkg-name> <script>`.
+**Package and workspace commands**: `bun add <pkg>` / `bun remove <pkg>` / `bun update [pkg]` manage dependencies; `bun outdated` lists stale deps; `bun pm ls` shows the dependency tree derived from the lockfile (not a listing of what's actually on disk). Read-only inspection: `bun audit` reads `bun.lock` and sends the package list to the npm advisory endpoint (or each scoped registry's own advisory endpoint) to report known vulnerabilities — it doesn't touch local files, but it isn't offline, so on private projects only use an approved registry/advisory endpoint, since package names and versions (including private ones) leave the machine. Modifying: `bun audit fix` applies fixes, `bun dedupe` collapses duplicate installs, and `bun prune` removes packages no longer referenced. Monorepos use a root `workspaces` array in `package.json` (same convention as npm/yarn); run a script in one workspace with `bun run --filter <pkg-name> <script>`.
 
 **Built-in APIs**: reach for these before adding a dependency — `Bun.file` / `Bun.write` for file I/O, `bun:sqlite` for an embedded SQLite database, `Bun.serve` for an HTTP/WebSocket server, [`Bun.sql`](https://bun.com/docs/runtime/sql) for SQL databases, [`Bun.redis`](https://bun.com/docs/runtime/redis) for Redis, and [`Bun.S3Client`](https://bun.com/docs/runtime/s3) for S3-compatible object storage. See the [1.4 release notes](https://bun.com/blog/bun-v1.4) for the rest of what's new.
 
-**Vercel**: Set runtime to Bun in project settings. Build: `bun run build` or `bun build ./src/index.ts --outdir=dist`. Install: `bun install --frozen-lockfile` for reproducible deploys.
+**Vercel**: Set `bunVersion: "1.4.x"` in `vercel.json` to use Bun 1.4 (Rust runtime) — `"1.x"` currently still resolves to the older 1.3.14. See [Vercel's Bun runtime docs](https://vercel.com/docs/functions/runtimes/bun). Build: `bun run build` or `bun build ./src/index.ts --outdir=dist`. Install: `bun install --frozen-lockfile` for reproducible deploys.
 
 **Reference**: [Bun 1.4 release notes](https://bun.com/blog/bun-v1.4).
 
@@ -61,7 +61,7 @@ bun test
 bun test --watch
 ```
 
-For CI, Bun 1.4's test runner adds: `bun test --changed[=<ref>]` (run test files affected by changes vs. a git commit/branch — includes tests exercising changed source files, not just edited test files), `bun test --isolate` (fresh global object per test file, so leaked handles in one file can't affect another; implied by `--parallel`), `bun test --parallel[=<n>]` (run test files across N worker processes, defaults to CPU core count), `bun test --shard=<n>/<count>` (split one suite across CI runners), and `bun test --timings=<file>` with `--update-timings` (merge per-file duration data across shards so `--shard`/`--parallel` can front-load the slowest files). Example: `bun test --parallel --timings=./test-timings.json --update-timings`. Run `bun test --help` locally to confirm exact flag behavior for your installed version.
+For CI, Bun 1.4's test runner adds: `bun test --changed[=<ref>]` (run test files affected by changes vs. a git commit/branch — includes tests exercising changed source files, not just edited test files), `bun test --isolate` (fresh global object per test file, so leaked handles in one file can't affect another; implied by `--parallel`), `bun test --parallel[=<n>]` (run test files across N worker processes, defaults to CPU core count), `bun test --shard=<n>/<count>` (split one suite across CI runners), and `bun test --timings=<file>` (reads JSON per-file duration data to front-load the slowest files) with `--update-timings` (writes to the first `--timings` path given — without `--shard` it merges into existing entries; with `--shard` it writes only the current shard's files to that same first `--timings` path — Bun does not pick a different path per shard automatically, so choose a distinct output path for each shard to avoid overwriting other shards' timing records; pass `--timings` multiple times, once per shard file, to read them together as a single combined table). Example: `bun test --parallel --timings=./test-timings.json --update-timings`. Run `bun test --help` locally to confirm exact flag behavior for your installed version.
 
 ```typescript
 // test/example.test.ts
diff --git a/docs/ja-JP/skills/bun-runtime/SKILL.md b/docs/ja-JP/skills/bun-runtime/SKILL.md
index b02d35982..c462a4a6f 100644
--- a/docs/ja-JP/skills/bun-runtime/SKILL.md
+++ b/docs/ja-JP/skills/bun-runtime/SKILL.md
@@ -25,11 +25,11 @@ Bunは高速なオールインワンJavaScriptランタイムとツールキッ
 
 **Nodeからの移行**：`node script.js`を`bun run script.js`または`bun script.js`に置き換えます。`npm install`の代わりに`bun install`を実行します。ほとんどのパッケージは機能します。npm スクリプトには`bun run`を使用します。`bun x`をnpxスタイルの1回限りの実行に使用します。Nodeの組み込みはサポートされています。パフォーマンスの向上のため、Bun APIが存在する場合は優先してください。
 
-**パッケージ・ワークスペースコマンド**：`bun add <pkg>` / `bun remove <pkg>` / `bun update [pkg]`で依存関係を管理し、`bun outdated`で古い依存関係を一覧表示します。`bun pm ls`はロックファイルから導出した依存関係ツリーを表示するもので、実際にディスクにインストールされている内容の証明ではありません。読み取り専用の`bun audit`は既知の脆弱性を報告し、変更を伴う`bun audit fix`はその修正を適用し、`bun dedupe`は重複インストールを解消し、`bun prune`は参照されなくなったパッケージを削除します。モノレポはルートの`package.json`の`workspaces`配列を使用します（npm/yarnと同じ規約）。特定のワークスペースでスクリプトを実行するには`bun run --filter <pkg-name> <script>`を使用します。
+**パッケージ・ワークスペースコマンド**：`bun add <pkg>` / `bun remove <pkg>` / `bun update [pkg]`で依存関係を管理し、`bun outdated`で古い依存関係を一覧表示します。`bun pm ls`はロックファイルから導出した依存関係ツリーを表示するもので、実際にディスクにインストールされている内容の証明ではありません。読み取り専用の`bun audit`は`bun.lock`を読み込み、パッケージ一覧をnpmのアドバイザリエンドポイント（またはスコープ付きレジストリ各自のエンドポイント）に送信して既知の脆弱性を報告します — ローカルファイルは変更しませんが、オフラインではないため、プライベートプロジェクトでは承認済みのレジストリ/アドバイザリエンドポイントのみを使用してください（プライベートなパッケージ名やバージョンも送信対象になります）。変更を伴う`bun audit fix`はその修正を適用し、`bun dedupe`は重複インストールを解消し、`bun prune`は参照されなくなったパッケージを削除します。モノレポはルートの`package.json`の`workspaces`配列を使用します（npm/yarnと同じ規約）。特定のワークスペースでスクリプトを実行するには`bun run --filter <pkg-name> <script>`を使用します。
 
 **組み込みAPI**：依存関係を追加する前にこれらを検討してください — ファイルI/Oには`Bun.file` / `Bun.write`、組み込みSQLiteデータベースには`bun:sqlite`、HTTP/WebSocketサーバーには`Bun.serve`、SQLデータベースには[`Bun.sql`](https://bun.com/docs/runtime/sql)、Redisには[`Bun.redis`](https://bun.com/docs/runtime/redis)、S3互換オブジェクトストレージには[`Bun.S3Client`](https://bun.com/docs/runtime/s3)。その他の新機能は[1.4リリースノート](https://bun.com/blog/bun-v1.4)を参照してください。
 
-**Vercel**：プロジェクト設定でBunに設定をランタイムに設定します。ビルド：`bun run build`または`bun build ./src/index.ts --outdir=dist`。インストール：再現可能なデプロイの場合は`bun install --frozen-lockfile`。
+**Vercel**：`vercel.json`で`bunVersion: "1.4.x"`を設定し、Bun 1.4（Rustランタイム）を使用してください — `"1.x"`は現在も旧バージョンの1.3.14を選択します。詳細は[VercelのBunランタイムドキュメント](https://vercel.com/docs/functions/runtimes/bun)を参照。ビルド：`bun run build`または`bun build ./src/index.ts --outdir=dist`。インストール：再現可能なデプロイの場合は`bun install --frozen-lockfile`。
 
 **参考**：[Bun 1.4 リリースノート](https://bun.com/blog/bun-v1.4)。
 
@@ -61,7 +61,7 @@ bun test
 bun test --watch
 ```
 
-CI向けに、Bun 1.4のテストランナーは以下を追加します：`bun test --changed[=<ref>]`（gitのコミット/ブランチと比較して変更の影響を受けるテストファイルを実行 — 編集されたテストファイルだけでなく、変更されたソースを利用するテストも含む）、`bun test --isolate`（テストファイルごとに新しいグローバルオブジェクトで実行し、あるファイルのリークが他に影響しないようにする。`--parallel`使用時は暗黙的に有効）、`bun test --parallel[=<n>]`（N個のワーカープロセスでテストファイルを実行、デフォルトはCPUコア数）、`bun test --shard=<n>/<count>`（1つのスイートをCIランナー間で分割）、`bun test --timings=<file>`と`--update-timings`（複数シャードの所要時間データをマージし、`--shard`/`--parallel`が最も遅いファイルから実行できるようにする）。例：`bun test --parallel --timings=./test-timings.json --update-timings`。インストールされているバージョンの正確なフラグの挙動は`bun test --help`で確認してください。
+CI向けに、Bun 1.4のテストランナーは以下を追加します：`bun test --changed[=<ref>]`（gitのコミット/ブランチと比較して変更の影響を受けるテストファイルを実行 — 編集されたテストファイルだけでなく、変更されたソースを利用するテストも含む）、`bun test --isolate`（テストファイルごとに新しいグローバルオブジェクトで実行し、あるファイルのリークが他に影響しないようにする。`--parallel`使用時は暗黙的に有効）、`bun test --parallel[=<n>]`（N個のワーカープロセスでテストファイルを実行、デフォルトはCPUコア数）、`bun test --shard=<n>/<count>`（1つのスイートをCIランナー間で分割）、`bun test --timings=<file>`（JSON形式の所要時間データを読み込み、最も遅いファイルを優先的に実行できるようにする）と`--update-timings`（指定した最初の`--timings`パスに書き込む — `--shard`なしの場合は既存のエントリにマージし、`--shard`ありの場合は同じ最初の`--timings`パスに現在のシャードのファイルのみを書き込む — Bunはシャードごとに異なる出力パスを自動的に選ばないため、他のシャードのタイミング記録を上書きしないよう、シャードごとに異なる出力パスを指定すること。`--timings`をシャードごとに複数回指定すると、それらをまとめて1つの表として読み込める）。例：`bun test --parallel --timings=./test-timings.json --update-timings`。インストールされているバージョンの正確なフラグの挙動は`bun test --help`で確認してください。
 
 ```typescript
 // test/example.test.ts
diff --git a/docs/zh-CN/skills/bun-runtime/SKILL.md b/docs/zh-CN/skills/bun-runtime/SKILL.md
index 4c086cf30..ccb77e4a3 100644
--- a/docs/zh-CN/skills/bun-runtime/SKILL.md
+++ b/docs/zh-CN/skills/bun-runtime/SKILL.md
@@ -25,11 +25,11 @@ Bun 是一个快速的全能 JavaScript 运行时和工具集：运行时、包
 
 **从 Node 迁移**：将 `node script.js` 替换为 `bun run script.js` 或 `bun script.js`。运行 `bun install` 代替 `npm install`；大多数包都能工作。使用 `bun run` 来执行 npm 脚本；使用 `bun x` 进行 npx 风格的临时运行。支持 Node 内置模块；在存在 Bun API 的地方优先使用它们以获得更好的性能。
 
-**包与工作区命令**：`bun add <pkg>` / `bun remove <pkg>` / `bun update [pkg]` 管理依赖；`bun outdated` 列出过时的依赖；`bun pm ls` 显示的是根据锁文件推导出的依赖树，并非磁盘上实际安装内容的证明。只读检查用 `bun audit` 报告已知漏洞；会修改内容的命令有 `bun audit fix`（应用修复）、`bun dedupe`（消除重复安装）和 `bun prune`（移除不再被引用的包）。多包仓库（monorepo）通过根 `package.json` 中的 `workspaces` 数组配置（与 npm/yarn 相同的约定）；使用 `bun run --filter <pkg-name> <script>` 在指定工作区运行脚本。
+**包与工作区命令**：`bun add <pkg>` / `bun remove <pkg>` / `bun update [pkg]` 管理依赖；`bun outdated` 列出过时的依赖；`bun pm ls` 显示的是根据锁文件推导出的依赖树，并非磁盘上实际安装内容的证明。只读检查用 `bun audit` 读取 `bun.lock` 并将包列表发送至 npm 的漏洞公告端点（或各自的限定作用域注册表端点）以报告已知漏洞——该命令不会修改本地文件，但并非离线操作，因此在私有项目中应仅使用已获批准的注册表/公告端点，因为包名和版本（包括私有包）会被发送出去；会修改内容的命令有 `bun audit fix`（应用修复）、`bun dedupe`（消除重复安装）和 `bun prune`（移除不再被引用的包）。多包仓库（monorepo）通过根 `package.json` 中的 `workspaces` 数组配置（与 npm/yarn 相同的约定）；使用 `bun run --filter <pkg-name> <script>` 在指定工作区运行脚本。
 
 **内置 API**：在添加依赖之前，优先考虑这些内置能力——文件 I/O 使用 `Bun.file` / `Bun.write`；内置 SQLite 数据库使用 `bun:sqlite`；HTTP/WebSocket 服务器使用 `Bun.serve`；SQL 数据库使用 [`Bun.sql`](https://bun.com/docs/runtime/sql)；Redis 使用 [`Bun.redis`](https://bun.com/docs/runtime/redis)；S3 兼容对象存储使用 [`Bun.S3Client`](https://bun.com/docs/runtime/s3)。其余新特性参见 [1.4 发布说明](https://bun.com/blog/bun-v1.4)。
 
-**Vercel**：在项目设置中将运行时设置为 Bun。构建命令：`bun run build` 或 `bun build ./src/index.ts --outdir=dist`。安装命令：`bun install --frozen-lockfile` 用于可重复的部署。
+**Vercel**：在 `vercel.json` 中设置 `bunVersion: "1.4.x"` 以使用 Bun 1.4（Rust 运行时）——目前 `"1.x"` 仍会解析到较旧的 1.3.14。详见 [Vercel 的 Bun 运行时文档](https://vercel.com/docs/functions/runtimes/bun)。构建命令：`bun run build` 或 `bun build ./src/index.ts --outdir=dist`。安装命令：`bun install --frozen-lockfile` 用于可重复的部署。
 
 **参考**：[Bun 1.4 发布说明](https://bun.com/blog/bun-v1.4)。
 
@@ -61,7 +61,7 @@ bun test
 bun test --watch
 ```
 
-面向 CI，Bun 1.4 的测试运行器新增了：`bun test --changed[=<ref>]`（运行相对某个 git 提交/分支受影响的测试文件——不仅是被修改的测试文件本身，还包括依赖了被修改源文件的测试）、`bun test --isolate`（每个测试文件使用全新的全局对象运行，避免一个文件的句柄泄漏影响另一个文件；使用 `--parallel` 时默认启用）、`bun test --parallel[=<n>]`（用 N 个工作进程并行运行测试文件，默认等于 CPU 核心数）、`bun test --shard=<n>/<count>`（将一个测试套件拆分到多个 CI 运行器上）、以及 `bun test --timings=<file>` 配合 `--update-timings`（合并多个分片的单文件耗时数据，使 `--shard`/`--parallel` 能优先调度最慢的文件）。示例：`bun test --parallel --timings=./test-timings.json --update-timings`。具体参数行为请以本地 `bun test --help` 输出为准。
+面向 CI，Bun 1.4 的测试运行器新增了：`bun test --changed[=<ref>]`（运行相对某个 git 提交/分支受影响的测试文件——不仅是被修改的测试文件本身，还包括依赖了被修改源文件的测试）、`bun test --isolate`（每个测试文件使用全新的全局对象运行，避免一个文件的句柄泄漏影响另一个文件；使用 `--parallel` 时默认启用）、`bun test --parallel[=<n>]`（用 N 个工作进程并行运行测试文件，默认等于 CPU 核心数）、`bun test --shard=<n>/<count>`（将一个测试套件拆分到多个 CI 运行器上）、以及 `bun test --timings=<file>`（读取 JSON 格式的单文件耗时数据，用于优先调度最慢的文件）配合 `--update-timings`（写入第一个指定的 `--timings` 路径——不带 `--shard` 时会合并进已有条目，带 `--shard` 时只会把当前分片的文件写入同一个首个 `--timings` 路径——Bun 不会自动为每个分片选择不同的输出路径，因此需要为每个分片指定不同的输出路径，避免覆盖其他分片的耗时记录；多次指定 `--timings=<file>`，例如每个分片一个，可将它们合并为一张表一起读取）。示例：`bun test --parallel --timings=./test-timings.json --update-timings`。具体参数行为请以本地 `bun test --help` 输出为准。
 
 ```typescript
 // test/example.test.ts
diff --git a/skills/bun-runtime/SKILL.md b/skills/bun-runtime/SKILL.md
index 794558e85..ef6c8cabc 100644
--- a/skills/bun-runtime/SKILL.md
+++ b/skills/bun-runtime/SKILL.md
@@ -26,11 +26,11 @@ Use when: adopting Bun, migrating from Node, writing or debugging Bun scripts/te
 
 **Migration from Node**: Replace `node script.js` with `bun run script.js` or `bun script.js`. Run `bun install` in place of `npm install`; most packages work. Use `bun run` for npm scripts; `bun x` for npx-style one-off runs. Node built-ins are supported; prefer Bun APIs where they exist for better performance.
 
-**Package and workspace commands**: `bun add <pkg>` / `bun remove <pkg>` / `bun update [pkg]` manage dependencies; `bun outdated` lists stale deps; `bun pm ls` shows the dependency tree derived from the lockfile (not a listing of what's actually on disk). Read-only inspection: `bun audit` reports known vulnerabilities. Modifying: `bun audit fix` applies fixes, `bun dedupe` collapses duplicate installs, and `bun prune` removes packages no longer referenced. Monorepos use a root `workspaces` array in `package.json` (same convention as npm/yarn); run a script in one workspace with `bun run --filter <pkg-name> <script>`.
+**Package and workspace commands**: `bun add <pkg>` / `bun remove <pkg>` / `bun update [pkg]` manage dependencies; `bun outdated` lists stale deps; `bun pm ls` shows the dependency tree derived from the lockfile (not a listing of what's actually on disk). Read-only inspection: `bun audit` reads `bun.lock` and sends the package list to the npm advisory endpoint (or each scoped registry's own advisory endpoint) to report known vulnerabilities — it doesn't touch local files, but it isn't offline, so on private projects only use an approved registry/advisory endpoint, since package names and versions (including private ones) leave the machine. Modifying: `bun audit fix` applies fixes, `bun dedupe` collapses duplicate installs, and `bun prune` removes packages no longer referenced. Monorepos use a root `workspaces` array in `package.json` (same convention as npm/yarn); run a script in one workspace with `bun run --filter <pkg-name> <script>`.
 
 **Built-in APIs**: reach for these before adding a dependency — `Bun.file` / `Bun.write` for file I/O, `bun:sqlite` for an embedded SQLite database, `Bun.serve` for an HTTP/WebSocket server, [`Bun.sql`](https://bun.com/docs/runtime/sql) for SQL databases, [`Bun.redis`](https://bun.com/docs/runtime/redis) for Redis, and [`Bun.S3Client`](https://bun.com/docs/runtime/s3) for S3-compatible object storage. See the [1.4 release notes](https://bun.com/blog/bun-v1.4) for the rest of what's new.
 
-**Vercel**: Set runtime to Bun in project settings. Build: `bun run build` or `bun build ./src/index.ts --outdir=dist`. Install: `bun install --frozen-lockfile` for reproducible deploys.
+**Vercel**: Set `bunVersion: "1.4.x"` in `vercel.json` to use Bun 1.4 (Rust runtime) — `"1.x"` currently still resolves to the older 1.3.14. See [Vercel's Bun runtime docs](https://vercel.com/docs/functions/runtimes/bun). Build: `bun run build` or `bun build ./src/index.ts --outdir=dist`. Install: `bun install --frozen-lockfile` for reproducible deploys.
 
 **Reference**: [Bun 1.4 release notes](https://bun.com/blog/bun-v1.4).
 
@@ -62,7 +62,7 @@ bun test
 bun test --watch
 ```
 
-For CI, Bun 1.4's test runner adds: `bun test --changed[=<ref>]` (run test files affected by changes vs. a git commit/branch — includes tests exercising changed source files, not just edited test files), `bun test --isolate` (fresh global object per test file, so leaked handles in one file can't affect another; implied by `--parallel`), `bun test --parallel[=<n>]` (run test files across N worker processes, defaults to CPU core count), `bun test --shard=<n>/<count>` (split one suite across CI runners), and `bun test --timings=<file>` with `--update-timings` (merge per-file duration data across shards so `--shard`/`--parallel` can front-load the slowest files). Example: `bun test --parallel --timings=./test-timings.json --update-timings`. Run `bun test --help` locally to confirm exact flag behavior for your installed version.
+For CI, Bun 1.4's test runner adds: `bun test --changed[=<ref>]` (run test files affected by changes vs. a git commit/branch — includes tests exercising changed source files, not just edited test files), `bun test --isolate` (fresh global object per test file, so leaked handles in one file can't affect another; implied by `--parallel`), `bun test --parallel[=<n>]` (run test files across N worker processes, defaults to CPU core count), `bun test --shard=<n>/<count>` (split one suite across CI runners), and `bun test --timings=<file>` (reads JSON per-file duration data to front-load the slowest files) with `--update-timings` (writes to the first `--timings` path given — without `--shard` it merges into existing entries; with `--shard` it writes only the current shard's files to that same first `--timings` path — Bun does not pick a different path per shard automatically, so choose a distinct output path for each shard to avoid overwriting other shards' timing records; pass `--timings` multiple times, once per shard file, to read them together as a single combined table). Example: `bun test --parallel --timings=./test-timings.json --update-timings`. Run `bun test --help` locally to confirm exact flag behavior for your installed version.
 
 ```typescript
 // test/example.test.ts