Changelog

oven-sh/bun · · 36 commits

TOML rewrite lands; cron and buffers hardened

Major parser/API additions plus fixes for cron overflow, fs mkdir on Windows, buffer limits, tty raw mode, and more.

robobun cirospaciari Jarred-Sumner dylan-conway

Bun.TOML is now a full v1.1.0 parser with stringify (dylan-conwayaca54d5)

Bun replaces its old TOML implementation with a spec-exact v1.1.0 parser and adds Bun.TOML.stringify(). The new API supports the official conformance suite, broader input types, and clearer errors, which is a meaningful upgrade for config-heavy apps.

Bun.cron.parse now rejects out-of-range from values safely (robobundc5748f)

Bun.cron.parse() now validates from against the ECMAScript Date range instead of only checking non-finite numbers, preventing a crash/abort path from extreme inputs. It also returns null when the next match would fall outside representable time instead of producing an invalid date.

node:fs writev/readv now chunk at IOV_MAX like libuv (robobune8404c1)

Vectored I/O no longer fails as soon as the buffer array exceeds the platform iovec limit. Bun now batches writes and truncates reads to match libuv behavior, fixing compatibility for code that relies on large readv/writev calls.

node:http2 fixes cross-session corked-frame bleed (robobuna85068c)

Corked HTTP/2 frames are now kept per session instead of leaking between connections. This addresses a Windows CI backpressure regression and fixes a subtle transport-layer correctness issue.

Buffer offsets/toString/write stop wrapping at 2^32 (robobun36364f7)

Buffer validation and string/write paths now carry size_t through instead of truncating to 32 bits. That fixes incorrect empty-string results and out-of-range behavior for extremely large buffers near 4 GiB.

Tty raw mode is tracked per handle, not per process (robobun3057da0)

setRawMode() now preserves state per tty.ReadStream, matching libuv’s per-handle behavior. This avoids one stream silently forcing another stream back to cooked mode and breaking interactive apps.

Error.captureStackTrace now matches V8’s property semantics (robobun8215078)

Captured .stack is installed as a non-enumerable property, including on plain objects. That brings Bun in line with Node/V8 and avoids surprising object serialization behavior.

Mach-O compile templates are validated before growth (robobun8c170f6)

The Mach-O packer now checks that the template’s __BUN segment is actually in-bounds before doing size arithmetic, and it rejects shrinking templates rather than panicking. That turns a crashy path in --compile into a proper error.

node:http/https/http2 compatibility jumps again (cirospaciari4bbe075)

Bun syncs the upstream Node v26.3.0 HTTP suites and lands a large set of transport fixes across HTTP, HTTPS, and HTTP/2. Compatibility moves materially closer to Node’s behavior across teardown, TLS, and socket-handling edge cases.

Other misc changes