Changelog

oven-sh/bun · · 24 commits

Bun fixes install, TLS, SQL and WebSocket edge cases

Several user-facing bug fixes landed across installs, networking, SQL, and compiled executables, plus a few internal cleanups and test work.

robobun Jarred-Sumner dylan-conway sosukesuzuki

Install fixes GitHub dependency loss after lockfile migration (robobun93eecdc)

A migrated GitHub dependency could be downloaded and extracted but never written into node_modules, causing installs to undercount packages and still exit 0. The fix keeps the GitHub bun-tag aligned with the cache/extraction path so the package is actually materialized.

MySQL TIMESTAMPs now store the correct instant in UTC (robobundc890eb)

Bun now sets time_zone = '+00:00' on every MySQL connection, so bound Date values round-trip through TIMESTAMP columns without shifting when the session timezone is non-UTC. This also makes server-side time functions like NOW() and CURRENT_TIMESTAMP consistently behave in UTC.

Fetch keep-alive pooling works again with checkServerIdentity (Jarred-Sumner4d62789)

Requests that use a custom TLS hostname-check callback can once again reuse pooled connections instead of paying a full handshake every time. Bun keeps sockets from native-verification and callback-verification paths in separate pools so security semantics stay intact.

WebSocket upgrades no longer die after async fetch handlers (robobun0823e50)

server.upgrade() now finishes the HTTP 101 handshake without triggering the HTTP connection-close gate, which was killing sockets upgraded after an await. That prevents dead-socket upgrades and leaked ServerWebSocket objects on close-when-idle or HTTP/1.0 flows.

Compiled executables keep chunk-<hash>.js names (Jarred-Sumner225e617)

Bun reverted the temporary numbered chunk naming inside compiled executables and restored hash-based chunk filenames. That makes executable output match normal bundle naming again and avoids surprising name changes in splitting builds.

truncate(undefined) now truncates to zero like Node (robobun4c815c1)

fs.truncateSync, fs.promises.truncate, and fs.ftruncateSync now treat an omitted len as 0 instead of throwing a type error. This closes a Node compatibility gap in a widely used filesystem API.

Startup bytecode is prefetched for compiled binaries (sosukesuzukiadc354d)

Cold-started bun build --compile --bytecode executables now precompute and load the bytecode needed for the entry point’s static import closure up front. The goal is fewer page faults and faster startup for large compiled binaries.

Other misc changes

  • RefPtr / intrusive refcounting cleanup and simplification (dylan-conway82123d3)
  • bun install peer-dependency wait-loop fix (robobune2204e3)
  • Bytecode depth option and smaller cache records (Jarred-Sumner7852665)
  • Chunk loading / standalone graph refactor to support startup metadata (sosukesuzukiadc354d)
  • Chunked Transfer-Encoding body parsing fix for empty header values (robobuna858129)
  • REPL test parallelization and stricter output assertions (robobun5e77f99)
  • Renewed expired localhost cert fixture (Jarred-Sumner15c936c)
  • WebKit upgrade and related compatibility updates (robobun11fb730)
  • Test shard flakiness allowlist updates (dylan-conway2c10950)
  • Dead-code removal across WebSocket, JSC bindings, ncrypto, and related glue (robobun023e84a)
  • Fake timers reject non-finite now values (robobun2f1dd37)
  • Semver small-string / tag-offset correctness fix (dylan-conwayd8477b1)
  • JSC exception-check lint plus fixes it uncovered (robobune3bd3e4)
  • Mimalloc startup crash fix via dependency bump (Jarred-Sumner4763307)
  • TLS half-close behavior fix for pending writes (robobunbdf4738)
  • Test-only updates for WebSocket/TLS/socket edge cases and install migration regressions (93eecdc, bdf4738, 0823e50, 4d62789, etc.)