Changelog

oven-sh/bun · · 21 commits

Bun tightens core runtime, TLS, and parser fixes

Notable fixes span PostgreSQL race handling, TLS shutdown safety, fetch keep-alive behavior, structured clone validation, and hardened build options.

dylan-conway robobun Jarred-Sumner

PostgreSQL bind results now wait for RowDescription (dylan-conway49b80f5)

Fixes a race in Bun.SQL on PostgreSQL when the same parameterless query is run again before the first RowDescription arrives. Bun now reads bind results as text in that case, preventing wrong rows or rejected queries.

HTTP fetch no longer lets Connection: keep-alive override keepalive: false (robobun6fbfdcd)

fetch() on HTTP/1.1 now consistently honors keepalive: false, even if a request sends Connection: keep-alive. That stops Bun from reusing and leaving behind idle connections when callers explicitly opted out.

TLS streams keep their native context alive through close-path callbacks (robobunebcd487)

This fixes a use-after-free class of bug when a TLS socket over a JS stream re-enters the event loop during close handling. The native duplex context now stays alive while its entry points run, avoiding crashes and borrow panics.

structuredClone rejects malformed CryptoKey records (dylan-conwaycb1c0a2)

Bun now refuses malformed serialized CryptoKey data instead of reconstructing bogus or null keys. That closes a correctness and safety gap for structured clone input, including advanced IPC serialization.

Class decorators now bind the decorated class inside the class body (robobun5738e23)

Standard class decorators that return a replacement class now expose that decorated class to static initializers, methods, and field initializers inside the class body. This brings Bun in line with other toolchains and the TC39 lowering semantics.

bun build --react-compiler and coverage source maps get finer locations (dylan-conway491aaad, dylan-conwaye350ec3)

React Compiler output now records more precise source-map positions for catch, and coverage mapping now includes case, default, object literal braces, and finally. This improves debuggability and makes coverage reports line up more accurately with source.

Build hardening option lands for Linux x64 glibc release builds (dylan-conway9634520)

Bun adds --hardened=on, enabling stack protection, _FORTIFY_SOURCE, stack clash protection, and zeroed locals for supported release builds. It is off by default, so it’s opt-in hardening rather than a behavior change.

TLS certificate validation now blocks revoked public keys (dylan-conway1f21b90)

Bun now rejects certificate chains containing blocked public keys, matching Node’s check. The bundled root store is also refreshed to NSS 3.131.1.

Other misc changes

  • Fix bun:sqlite Statement#run segfault before any Database is opened.
  • Fix TextEncoder.encodeInto panic on a detached destination.
  • Fix FileSink panic when moving from a TTY to a regular file.
  • Coverage/source-map and React Compiler bookkeeping fixes.
  • CI buildkite-agent bump and build script updates.
  • Bindgen/schema refactor for outliving Rust-backed JS classes.