For those who care about their dependencies being "safe bets", Bun should already be out of the question after the recent "vibe code the entire thing into a different language in a week with zero human intervention" fiasco.

Exactly.

https://github.com/yt-dlp/yt-dlp/issues/16766