Bun hardens watchers, sockets, SQL and ELF
Big refactors and several security-grade fixes land across fs.watch, sockets, compile output, and SQL.
Read the issue →Big refactors and several security-grade fixes land across fs.watch, sockets, compile output, and SQL.
Read the issue →A feature-heavy day with security hardening, leak/UAF fixes, and new execve/die-with-parent process controls.
Read the issue →A heavy day of memory-safety fixes, new HTTP/3 client/server plumbing, and several CI/build/test reliability improvements.
Read the issue →Major networking work adds experimental HTTP/3 serve support and HTTP/2 fetch, plus several crash and smuggling fixes.
Read the issue →WebSocket, spawn, hot reload, stdio, HTTP timeout, and SQLite all got meaningful fixes, plus FreeBSD cross-build support.
Read the issue →Bun updates to a newer WebKit with broad cast API churn and baseline allowlist changes, plus a flaky date assertion is made ICU-safe.
Read the issue →Mac/Windows CI throughput improved, a path URL crash was fixed, and several teardown/GC regressions were patched.
Read the issue →
April 23rd, 2026 · 25 commits
+1
Installer hangs, macOS hot reload, Windows errors, and build system changes dominate a substantial day for Bun.
Read the issue →Spawn no longer closes caller-owned fds, Windows PCH/unified builds land, and a real UAF in auto-install is fixed.
Read the issue →Bun added Windows Terminal support, sped up isolated installs, and fixed several correctness bugs in transpiling, SQL, TLS, and bunx.
Read the issue →Bun speeds up shard-heavy Zig builds, fixes a glob FD leak, and tightens a Linux memfd test and binary-size CI baseline check.
Read the issue →Linux binaries now target glibc 2.17, memfd calls can be disabled/cached, Zig builds gained an override, and ReadableStream got a GC fix.
Read the issue →Concurrency, memory-safety, and install-path bugs got fixed across sockets, workers, TLS, and the debugger; zlib also got replaced.
Read the issue →Fixes several correctness bugs in fetch, http2, watchers, and Windows stdio, plus major test runner and install improvements.
Read the issue →Major InternalSourceMap rewrite removes VLQ decode from stack-trace remapping and adds benchmarks/tests for the new storage path.
Read the issue →Bun adds SHA3 and changed-only tests, plus fixes several crash/UAF edge cases in HTTP, fetch, NAPI, Windows, and ELF compile output.
Read the issue →MySQL hangs, Mach-O signing, CPU profiles, timeout handling, and more got meaningful fixes; a WebKit bump landed too.
Read the issue →HTML import manifests now revalidate correctly across rebuilds, mimalloc moves to dev3, and several flaky tests were rooted out.
Read the issue →Major Bun.serve file-streaming overhaul, live process.ppid, and Unix-socket WebSocket support headline the day.
Read the issue →Bun adds X25519 deriveBits, preserves CSS @layer ordering, accepts MKADDRESSBOOK, and lands a few targeted runtime/perf fixes.
Read the issue →
April 10th, 2026 · 11 commits
+1
Bun fixes a TLS hostname-verification bypass, plus several crashes and double-free bugs in string decoding, websockets, and socket cleanup.
Read the issue →Bun gains a terminal markdown renderer, Linux os.freemem() now matches Node, and usockets DNS cancellation gets safer.
Read the issue →Bun fixed a lost-wakeup threadpool bug, corrected fs Stats behavior, and patched several crashes and data-corruption edge cases.
Read the issue →Security and correctness fixes land alongside a DNS API exposure and a bigger test/CI concurrency sweep.
Read the issue →A new binary-size gate lands, PR error comparison gets smarter, Windows zips are fixed, and flaky webview tests are isolated on macOS CI.
Read the issue →Replaced the old Buildkite scraping script with thin bk-backed CI commands for finding builds, checking status, logs, and errors.
Read the issue →Windows rebuilds, shared caches, WebKit CPU flags, and IR PGO landed alongside several security/stability fixes.
Read the issue →Bun adds in-process cron jobs, fixes Unix socket cleanup/semantics, and widens Linux statx fallbacks for seccomp and other edge cases.
Read the issue →Bun now honors runtime proxy env changes in fetch, fixes a consumed-body blob crash, and ships broad doc polish plus ANSI perf work.
Read the issue →Bun updated its pinned Zig autobuild, affecting the build toolchain rather than runtime code.
Read the issue →