c-ares security update to 1.34.9 (
7d240c1)
Bun now pins c-ares 1.34.9 and drops the local patch that relaxed RDATA compression parsing. This tracks an upstream security release and preserves acceptance of compressed SRV/NAPTR-style answers in the updated dependency.
Upgrade WebKit to f59345e04a8d (
811afe7)
The embedded WebKit/JSC dependency moves to a newer upstream head, bringing a large batch of engine changes into Bun. The surrounding bindings and tests were updated to match the new engine behavior, so this is a meaningful runtime-level refresh.
Fix a Bun check false positive for widened nested literals (
a8b5e92)
bun check now keeps a widened object literal widened through a second instantiation in generic code, fixing a spurious TS2322 seen in real-world patterns like XState. This should reduce noise from incorrect type errors in generic helpers.
Fix zlib stream ownership to avoid invalid mutable borrowing (a8fcd31)
The zlib wrapper was reworked so Rust only touches the underlying z_stream through a raw pointer while zlib-ng retains its back-pointer. This is a correctness/safety change in compression internals, aimed at matching zlib-ng’s ownership model and avoiding borrow aliasing issues.
Move stream sink generation into bindgen and delete the old generator (5e18294)
Stream sink classes are now declared in bindgen schema instead of being generated by generate-jssink.ts, consolidating codegen around the binding system. The change also updates docs and runtime bindings, so it materially changes how these stream-related native classes are defined and built.
Other misc changes
- Darwin CI host/bootstrap fixes: install the pinned Bun when the existing binary is the wrong version; skip redundant Tailscale daemon setup when already connected; update Homebrew before guest bootstrap.
- WebKit/JSC binding cleanup from the engine bump, plus related test updates.
- Minor allocator/refactor cleanup in
c_thunks.