Bun upstream diff — candidate task list

On this page 4

Port baseline (Home): packages/runtime/UPSTREAM_SHA.txt = fd0b6f1a271fca0b8124b69f230b100f4d636af6. Upstream HEAD at capture: 1498d7b77a (origin/main), regenerated 2026-07-02. Range fd0b6f1a27..origin/main = 634 commits (was 425 on 2026-06-23).

Regenerate: cd ~/Code/bun && git fetch origin && git log --oneline $(cat <repo>/packages/runtime/UPSTREAM_SHA.txt)..origin/main.

Triage — Home maintains Bun's ENGINE (parser/JSC/runtime/node:*); install/css/ci/yaml are Rust-side app/tooling, skip.

Engine-relevant buckets (by conventional-commit prefix)

    38  node
    16  test
    15  sql
    14  shell
    14  parser
    11  http
    11  fetch
     9  resolver
     9  fs
     9  bundler
     8  jsc
     8  js_parser
     7  webcore
     6  crypto
     5  websocket
     4  mysql
     4  ffi
     3  sys
     3  sql_jsc
     3  postgres
     2  tls
     2  runtime
     1  zlib
     1  url
     1  napi

Big self-contained porting targets (Node vN sync / rewrites / +N tests)

5b55beb711 trace_events: implement Node's trace-events subsystem and port the v26.3.0 trace tests — JSON trace writer, --trace-event-* / --trace-env / --trace-exit flags, per-subsystem events, worker tids, NodeTracing inspector domain (+34 tests, 100% passing) (#31824)
6640fcff49 Rewrite the JSON parser around a SIMD structural index (#33032)
a5d122d345 resolver: take the per-entry lock when rewriting cached directory entries (#33056)
459c33fa9f node:fs: validate open() flag and mode strings like Node (#32966)
b101003181 node:dgram: throw ERR_SOCKET_ALREADY_BOUND synchronously from bind() (#33037)
86d32c8bb6 HTMLRewriter: use the lol_html Rust crate directly instead of its C API (#33048)
d1e8adf87d node:dgram: throw ERR_SOCKET_DGRAM_NOT_RUNNING from socket methods after close() (#33024)
3e8da8103f node:fs: apply the string encoding in write/writeSync and other Node compat fixes (#32813)
2540f6a74e HTMLRewriter: reject the transformed body when the upstream body fails (#32927)
9787734ccc node:fs: reject aborted operations with node's AbortError, not the raw signal.reason (#32943)
fc1b448b71 node:child_process: kill() returns false after the child has exited (#32877)
bbf1f93258 HTMLRewriter: distinguish empty from absent attributes, throw on invalid arguments (#32840)
80c749e981 node:fs: report node's operation name in error.syscall, not the raw syscall (#32964)
e3849988bb node:buffer: fix six Node compatibility divergences (#32784)
c21f08c404 node:cluster: don't unwrap a non-Subprocess handle in the primary IPC bindings (#32763)
c464f01d08 node:path: fix normalize of a first segment ending in ".." (#32783)
0621a0ab9c node:crypto: fix segfault when setAAD is called on a non-AEAD cipher (#32758)
aaba8f0ca3 node:zlib: don't abort when the native handle is driven outside the zlib.ts lifecycle (#32762)
05895486df node:net: handle socket.connect() on a socket that still has a live native handle (#32739)
44c0cc4a67 node:http: skip non-cell onWritable/onData/onAborted in drain/data/abort dispatch (#32735)
7d777f90bb node:net: return synchronous connect() errno from kConnectTcp instead of re-entering oncomplete (autoSelectFamily "null is not an object" crash) (#32660)
de400b1c7c crypto: report external memory usage to GC for node:crypto wrapper classes (#32653)
942c22237c node:http: fix panic when drain fires with cleared onWritable slot (#32661)
dd13155519 buffer: sync vendored tests to Node v26.3.0 and fix compat gaps (64/69 · 92.8%) (#32626)
0672e7d8c2 node:vm: pass the Node v26.3.0 vm test suite (+25 tests, ~65% → 97%) (#32018)
85559ebcce node:fs: stop draining tasks after termination in fs.watchFile initial-stat callbacks (#32587)
4261a465c1 node:v8: return false from startupSnapshot.isBuildingSnapshot() (#32502)
dae2e8722b fs: port Node.js v26.3.0 fs tests and fix the gaps they surface — cp error semantics, watcher event delivery, watch ignore+AbortSignal, FileHandle pull/writer, glob port, opendir/Dir, mkdtempDisposable, rmdir-recursive end-of-life, mock.fn (+119 tests) (#31830)
6ef59777b6 node:http2: rewritten inbound engine, batched write path, server push, +290 node v26.3.0 tests (79% passing) (#31584) [publish images]
899168aba9 node:stream: sync the stream suite to Node v26.3.0 and fix the gaps it surfaces — stream/iter + zlib/iter behind --experimental-stream-iter, read()-one-buffer semantics, compose/pipeline/web-adapter/http/fs/net parity (247/251 upstream tests, +63 vendored) (#31826) [publish images]
c4a937c53d node:http: rewrite the client on net/tls + llhttp (Node http suite: ~55% → 82.3%, +182 vendored tests, client proxy support) (#31587) [publish images]
bd8edc7c50 net,tls: port Node.js net/tls compatibility tests and fix the gaps they surface — half-open/reset/write semantics, server TLSSocket wrap, session/keylog, SNICallback/ALPNCallback, pfx, OpenSSL error shapes, addCACert, local binding (+305 tests) (#31155) [publish images]
0fcead62d8 Upgrade reported Node.js version to 26.3.0 (#31991) [publish images]
8cfee50df0 node:module: release StringImpl refs in _nodeModulePaths (#32337)
719be62fa5 docs: rewrite Discord.js bot guide around a working slash command (#32237)
541ea3acf6 node:fs: implement lchown on Windows (#32052)
5836485c97 node:vm: throw instead of crashing on a cyclic SourceTextModule linked inside the linker (#31624)
3a79bd746b node:crypto: uppercase X509 serialNumber and modulus hex to match Node (#31519)
843549b819 node:buffer: default lastIndexOf(value, encoding) to search from the end (#31507)
472a06a2fb Rewrite Bun.escapeHTML using Highway SIMD (#31483)

Full commit list (newest first)

1498d7b77a shell: separate multiple parse errors with newlines in ShellError.message (#33236)
65e12674ad bake: pin the react experimental build the test harness installs (#33204)
d4f3c54c62 http: fix use-after-free of the redirect URL on a retried request (#33242)
5b55beb711 trace_events: implement Node's trace-events subsystem and port the v26.3.0 trace tests — JSON trace writer, --trace-event-* / --trace-env / --trace-exit flags, per-subsystem events, worker tids, NodeTracing inspector domain (+34 tests, 100% passing) (#31824)
27009bf0f6 crypto: port upstream ncrypto correctness fixes (#33202)
b124ed3368 pm pkg set: fix use-after-free of bracketed key-path segments (#33186)
eba370b692 Remove unsound ErasedBox and the dead websocket_deflate RareData slot (#31977)
48a4b01f00 inspect: don't probe every hole when printing a sparse array (#33158)
ae6051ba65 Fix Bun.spawn on Windows never exiting after the child dies when stdin is an async iterable (#33167)
31289519a1 Surface ENOMEM instead of aborting when a whole-file read cannot allocate st_size (#33178)
2c62c0128f sql(mysql): fix caching_sha2_password fast authentication (#33179)
1773b96b9c Handle non-ASCII entry names in Bun.Archive (#33166)
6640fcff49 Rewrite the JSON parser around a SIMD structural index (#33032)
d816daf479 bun:ffi: fix f64 argument conversion of NaN, -0.0, and BigInts (#33122)
5124b0ce18 websocket: do not hold an exclusive client reference across user callbacks (#33055)
570f857291 docker: install ca-certificates in Debian image final stages (#33136)
eb6c0fef9b Address review nits from #31789 in computeErrorInfoWrapperToString (#33164)
56c514a531 install: link a transitive file: dependency of a local file: package (#33159)
5585f36889 install: fix package-lock.json and pnpm-lock.yaml migration of file: dependencies (#33155)
253e487969 install: fix resolution union type confusion in the auto-install name lookup (#33143)
8973584d4b Don't surface an unhandled EPIPE rejection when a subprocess with a ReadableStream stdin dies mid-write (#33021)
725f46e339 css: parse the :nth-child of-list and :has() non-forgivingly, reject empty selectors (#33151)
d6a82e77ee Fix crash when materializing error stack traces during GC finalization (#31789)
00a93bd93d Upgrade WebKit to d81bcc3d833c (#33133)
7f33321f8a Fix type confusion in BuildArtifact.prototype.stream (#33144)
52a1ddf07b markdown: harden the parser's remaining 32-bit limits (#33078)
a50f1f395b bundler: don't close a borrowed resolver-cache fd after parsing (#33102)
37181fd493 Response.redirect: parse and serialize the url into the Location header (#33126)
5cf5cba6c9 module loader: don't abort on .node specifiers with a query string (#33148)
f456ce9a1c css: serialize a NaN calc() result as zero instead of the literal NaN (#33147)
cf718fe4af glob: fix abort when joined absolute paths exceed the join buffer (#33145)
5f41bd3c81 webcore: make Request/Response clone() throw on a disturbed or locked body (#33129)
3e087190d7 Stop Response.clone() from retaining ~2x the body for an unread clone (#33130)
ffea69ae7c node: fix tty.WriteStream#getColorDepth reporting 256 colors for every TERM (#33124)
d16488b6d1 Fix use-after-free in the Windows buffered pipe writer (#33114)
db7545ff39 node: deliver the buffered stdin remainder at EOF in paused mode (#33123)
73dad76f30 Bun.serve: report non-Response returns from synchronous fetch handlers (#33120)
a5d122d345 resolver: take the per-entry lock when rewriting cached directory entries (#33056)
8561841407 fs.watch: report watcher queue overflow as ('change', null) (#33110)
e794f42b34 Bun.serve: invoke error() when the returned Response body is already used (#33118)
459c33fa9f node:fs: validate open() flag and mode strings like Node (#32966)
c944094fcd buffer: match Node's Buffer.prototype.fill offset and end argument handling (#33033)
619839ac1d react-compiler: do not hoist a forward reference unless it is inside a nested function (#33105)
b101003181 node:dgram: throw ERR_SOCKET_ALREADY_BOUND synchronously from bind() (#33037)
df60704715 buffer: normalize the UTF-16LE encoding aliases to utf16le (#33038)
6c1f36a168 child_process: honor uid and gid spawn options (#33060)
16a7269639 docs: editorial pass over docs/ and bun-types JSDoc (#33112)
b2aa0d5d94 Run formatter
86d32c8bb6 HTMLRewriter: use the lol_html Rust crate directly instead of its C API (#33048)
d843870e61 streams: reject instead of throwing when consuming an already-errored ReadableStream (#33043)
daa44735c7 Bun.color: make 24-bit number inputs opaque instead of alpha 0 (#33046)
a0f922a4f2 Match Node bounds handling in Buffer.from(arrayBuffer, byteOffset, length) (#33036)
064027312a Bun.stringWidth: make bidi controls and invisible format characters zero-width (#33049)
fb24aac703 docs: say Bun is written in Rust, not Zig (#33065)
033e0b199b docs: update base64 guide (#33040)
3b23f2d70c pm pack: drop the leading newline from --quiet and --silent output (#32751)
bb32d24f7a bun_core: make bun_core::strings a direct alias of string::immutable (#33035)
f789198279 FormData: normalize lone CR and lone LF to CRLF in serialized multipart names and string values (#32975)
20d649ff17 fs.watch(Linux): deliver both rename self-events and the basename when the watched path is deleted (#32962)
9f905ee8e2 bun-plugin-svelte: stop pinning the exact __commonJS callback syntax in the CJS wrapper test (#33027)
e323e73df3 Bun.serve websocket: deliver queued publish() messages when unsubscribing from last topic (#32852)
a401ba352e Bun.serve websocket: deliver ws.publish() from sockets with no subscriptions (#32879)
15a59265fe shell: stop enqueuing to an IOWriter after a fatal write error (#32946)
c6c4210487 console.table: invoke each cell getter once (#32924)
d1e8adf87d node:dgram: throw ERR_SOCKET_DGRAM_NOT_RUNNING from socket methods after close() (#33024)
b728334e7a strings: don't abort on UTF-8 to UTF-16 output buffer allocation failure (#33014)
f76226843e buffer: byte-truncate string fill patterns and encode lone high surrogates as U+FFFD (#33019)
3e8da8103f node:fs: apply the string encoding in write/writeSync and other Node compat fixes (#32813)
6ae3fe4910 TextDecoder: add the missing Encoding Standard encodings and fix decoder conformance (#32837)
7a0f2c0422 structuredClone: clone Object.prototype to an empty object (#32983)
2540f6a74e HTMLRewriter: reject the transformed body when the upstream body fails (#32927)
412204d949 sql(postgres): stop dispatching messages once the connection has failed (#33016)
0528baf26b usockets: fix use-after-free from double-parking a TLS socket in the low-priority queue (#33006)
9985ba5baf Fix WebSocket server inflate for clients using context takeover (#33003)
b7971bbbf7 webcore: pin the FileReader across re-entrant cancel in on_read_chunk and on_reader_error (#32921)
9787734ccc node:fs: reject aborted operations with node's AbortError, not the raw signal.reason (#32943)
3d98ac8e6c shell: don't re-enter the Yield trampoline on synchronous write errors (#33008)
4f29329800 Evict the DNS cache entry when all connections to a host fail (#32991)
2cf311cf74 shell: fix use-after-free when poll re-registration fails during a poll-driven read (#32986)
7dc9c6c298 Reject RSV1 on WebSocket control and continuation frames (#33001)
e2a69b796b Fix bun-types CI: resolve tsgo entrypoint from the package bin field (#33017)
a1c39ded9b Report DNS lookup failures from fetch() and Bun.connect as ENOTFOUND (#32990)
18e6d8deaa Validate transfer lists before serializing instead of silently dropping invalid entries (#32809)
fc1b448b71 node:child_process: kill() returns false after the child has exited (#32877)
1d05580b1d GitHub Actions annotations: preserve non-ASCII bytes in title and body (#32736)
a6a4352b0f webcrypto: fix deriveBits length 0 and non-byte-aligned truncation (#32819)
e18e49d827 spawn: leave stdio[i]='ignore' closed in the child for i >= 3 (#32892)
9f18300efe Bun.serve websocket: make publish() return 0/-1 on subscriber backpressure (#32889)
daa0d93403 glob: match explicitly-named dotfiles and resolve literal paths through symlinks (#32853)
12ce04f4dc bun:ffi: don't re-throw JSC's TerminationException from a JSCallback (#32792)
bbf1f93258 HTMLRewriter: distinguish empty from absent attributes, throw on invalid arguments (#32840)
80c749e981 node:fs: report node's operation name in error.syscall, not the raw syscall (#32964)
5034e261fc test: use strict equality in toContain to match Jest (#32950)
2fa625a1a5 child_process: forward detached option in spawnSync (#32874)
8f6a7c6866 Bun.serve: fix HEAD and 204 response framing (#32800)
2c53f80de7 Bun.serve: serve HEAD requests with the GET handler in per-method route objects (#32822)
4061d9ae09 Bun.serve HTML routes: inline import.meta.env and fix production ETag/Cache-Control (#32854)
64bbcfb96d expect: match Jest's typeof semantics for expect.any(Object) (#32922)
0f9331dce4 Fix segfault when a top-level-await module resumes inside AsyncLocalStorage (#32184)
8706328b5d websocket: validate close() arguments and reject unmasked client frames (#32820)
f3368854e4 shell: don't assert on a second terminal callback for a detached PipeReader (#32848)
d4b9d107c1 Fix off-by-one source map columns after a non-ASCII character (#32838)
80729349a7 Bun.serve: do not kill the process when a Response body stream errors (#32842)
a1a2c81344 bundler: handle nullish module.exports and top-level arguments in bundled CJS (#32846)
7257f93839 http: sweep abort tracker by socket pointer in Handler::on_close fallthrough (#32862)
7c05b11fa4 fetch: fix HTTP/1.1 client wire bugs with streamed request bodies (#32847)
df92f8fd68 structuredClone: keep the serializer and deserializer reference pools in sync (#32796)
c2b5cef7e7 structuredClone: throw DataCloneError for a detached ArrayBuffer (#32799)
a2290aa2bb http: don't retry a fetch with a ReadableStream body on keep-alive disconnect (#32798)
f412daa49c Use forward slashes in source map sources on Windows (#32797)
96a7627438 http: bounds-check HTTPClient::header_str to stop slice panic in build_request (#32702)
e3849988bb node:buffer: fix six Node compatibility divergences (#32784)
983ec49c61 structuredClone: fix back-references after BigInt, CryptoKey, and X509Certificate (#32791)
8c8787161e glob: fix brace depth overflow when skipping a deeply nested branch (#32733)
a11e72a590 webcore: propagate exceptions from readableStreamTee instead of reporting them as uncaught (#32786)
be9916104a Fix cross-thread WeakPtr destruction in AbortSignal.any()'s GC reachability callback (#32785)
c21f08c404 node:cluster: don't unwrap a non-Subprocess handle in the primary IPC bindings (#32763)
c464f01d08 node:path: fix normalize of a first segment ending in ".." (#32783)
642b9f6199 Bun.serve: fix crash (#32771)
163e6bce89 fix(sys/windows): return error for unmapped Win32 codes in symlink_w (#32643)
179978a6f9 ffi, napi: purify NaNs before NaN-boxing doubles from native code (#32787)
0fe7567ace sql: reject a Postgres message length below 4 as a protocol error (#32769)
4ecbdf2f05 Keep an aborted AbortSignal's wrapper alive while its controller is still reachable (#32777)
3f464e8829 webcore: pin subprocess stdout FileReader while its pipe poll is live (#32743)
b99024a902 markdown: reject inputs of 2^32 bytes or more instead of panicking (#32752)
2d2644a1f4 Bun.serve: fix crash
d75b27382d shell: fix use-after-free when a pipe read fails inside the spawn call (#32754)
990be52f7f Don't panic generating a sourcemap for a source ending in a truncated UTF-8 sequence (#32774)
67ef31110b tls: don't truncate the stream when destroy() follows a large write (#32719)
034f693ab8 test: stop asserting an OCSP URI on the live bun.sh certificate (#32789)
ba72810002 fs.readdir: release pending_err mutex in recursive subtask error path (#32748)
944345fa71 Bun.{JSON5,JSONC,TOML,YAML}.parse: reject inputs of 2^31 bytes or more instead of panicking (#32764)
fad2b2de03 Add missing exception check in JSC__JSValue__putToPropertyKey (#32770)
b4e9605808 AbortSignal: emit write barrier when storing abort reason (#32747)
031f73c360 sql(postgres): stop sending a redundant Sync after a simple Query (#32772)
0621a0ab9c node:crypto: fix segfault when setAAD is called on a non-AEAD cipher (#32758)
aaba8f0ca3 node:zlib: don't abort when the native handle is driven outside the zlib.ts lifecycle (#32762)
05895486df node:net: handle socket.connect() on a socket that still has a live native handle (#32739)
76b4a14001 install: compare stored scope name and folder path, not just their hash (#32745)
e9c4fcc067 crash_handler: re-raise original signal instead of terminating with SIGILL (#32740)
863379d7ea http: never pool a proxy tunnel with a fatal TLS error or pending I/O (#32742)
82688896d7 yaml: combine \uD8xx\uDCxx surrogate-pair escapes in double-quoted scalars (#32731)
62e059dc68 net: validate setTypeOfService argument on the native TCPSocket prototype (#32738)
85298a3704 verify-baseline: allowlist llint_op_enter_wide32 data-in-.text false positive (#32744)
44c0cc4a67 node:http: skip non-cell onWritable/onData/onAborted in drain/data/abort dispatch (#32735)
ff2781d7a8 Bun.indexOfLine: fix O(n^2) scan on buffers containing a non-ASCII byte (#32732)
c4d6844e78 Fix SubtleCrypto.wrapKey with AES-KW and jwk format (#32616)
f58fd036db fetch: do not touch JSCells in the Response Weak finalizer during GC sweep (#32729)
7fa26a75c0 paths: keep PathName base in sync while stripping trailing separators (#32709)
d7bdc78057 Deflake streams-leak pull-buffer test by pacing writes on consumer progress (#32727)
9fed8df849 parser: avoid O(n^2) arena blowup in comma-expression simplification (#32717)
ba04159baa yaml: fix stringify emitting \L/\P for U+00A8/U+00A9 instead of U+2028/U+2029 (#32718)
2b1d61d14c usockets: propagate epoll_ctl(EPOLL_CTL_ADD) failure instead of going silently deaf (#32706)
c1e79b0390 Fix merge
e174a4e5a3 Fix merge issue
81dfd59967 http: couple fetch() receive backpressure to JS body consumption (h1/h2/h3) (#29831)
89f7b1977f test(napi): split napi_is_arraybuffer output on /\r?\n/ for Windows (#32722)
9bf393422c parser: drop bogus no-clobber assert on enum ref_to_ts_namespace_member insert (#32711)
4e159fbc9c js_parser: handle AllocatedName default_name refs in export default visit (#32714)
97cc7c5fab bundler: error instead of panic when splitting is used with non-ESM format (#32685)
78f62899e1 ini: treat stripped-empty quoted values as empty string, not shared object (#32712)
1c861db1a7 jsc: drain rejected-promise list in O(n) instead of O(n^2) (#32554)
3656e58ca1 js_printer: allow empty string as import/export clause alias (#32710)
3a9f554930 transpiler: fix garbage output for decorated fields with non-ASCII string keys (#32713)
5889bcae07 parser: skip scope-order debug assert once a parse error is logged (#32715)
d235bc5e4d patch: remove bogus debug_assert in parse_diff_hashes (#32708)
7d777f90bb node:net: return synchronous connect() errno from kConnectTcp instead of re-entering oncomplete (autoSelectFamily "null is not an object" crash) (#32660)
98f4919914 Socket syscall fault injection for net/tls/http/http2/fetch/WebSocket fuzzing + 7 bug fixes (#32681)
5621c5de90 FileSystemRouter: fix slice panic in URLPath::parse on leading '?' or empty-decoding path (#32669)
d4514457e8 Remove the .zig porting-reference sources (#32621)
ed700c207a Remove stale signal.is_dead() assertion in pipe_readable_stream_to_blob (#32657)
de400b1c7c crypto: report external memory usage to GC for node:crypto wrapper classes (#32653)
237de941fd napi: napi_is_arraybuffer returns false for SharedArrayBuffer (#32629)
e112ac7d94 patch: guard against crafted patches that panic the applier (#32668)
d6a20b6135 Fix use-after-free for reference-link href/title in Bun.markdown.react()/render() (#32671)
942c22237c node:http: fix panic when drain fires with cleared onWritable slot (#32661)
15bc359550 types(streams): make documented backpressure idiom typecheck (#32641)
a830e9dafa streams: extract long-lived closures from ReadableStreamInternals into bound exported helpers (#32656)
6a574c47e2 Remove incorrect downcast
f91c27bf8d CLAUDE.md: limit code comments to 3 lines (#32658)
dd13155519 buffer: sync vendored tests to Node v26.3.0 and fix compat gaps (64/69 · 92.8%) (#32626)
be6a664e8d s3: wake the HTTP thread on stream cancel so the wrapper actually frees (#32608)
d34ca02bce http: proxy stress test suite + fix streamed upload and on_writable UAF through tunnel (#32635)
5d2f66c927 Wait for end() when a direct stream's pull() returns synchronously in Bun.serve (#32140)
91f028382c fetch: release leaked WTFStringImpl refs on proxy href and file:/blob: response url (#32329)
1bd44dbe60 windows: heap-allocate bunx fast-path environment block (#32644)
03042ab8af Add process.on('memoryPressure') event (#32594)
ff63668d55 sourcemap: static_assert ParseMappingsState layout matches kSt* indices (#32639)
85ef0c5612 shell(rm): don't leak ShellRmTask when readdir loop aborts after enqueuing children (#32617)
6b702aed3a Remove DuckDB tests and dependencies from test/package.json (#32633)
ea7e44f307 Add safe wrappers for brotli, zstd, zlib, and libdeflate (#32637)
4982b91e37 test(sql): centralize fault-injection wire frames; convert decode mocks to real servers (#32467)
0be8a2d075 types(streams): document ReadableStreamDirectController backpressure contract (#32640)
126e800e77 Fix structuredClone crash with large nested ArrayBuffer (#32590)
7ff11819c2 Fix use-after-free of stream error objects parked in ByteStream (#31963)
cbcec936a1 webcore: store ReadableStreamSource onClose in WriteBarrier slot instead of Strong (#32582)
c6be834c63 fetch: add automatic request body compression via compress option (#32416)
18ead54130 react_compiler: bind synthesized refs in bundle output + hoist sentinel + Babel-parity codegen (#32581)
98094dc4d1 Fix use-after-free in JSReadable*Controller end()/close() when onClose re-enters the event loop (#32597)
23315f417a crypto: update root certificates to NSS 3.124 (#32604)
28f2dbdaf8 parser: declare_common_js_symbol docstring + __require bundle-mode shadow test (#32615)
2d61142696 test: Bun.isStandaloneExecutable is false under BUN_BE_BUN=1 (#32606)
0672e7d8c2 node:vm: pass the Node v26.3.0 vm test suite (+25 tests, ~65% → 97%) (#32018)
8d32bd412c parser: don't alias automatic JSX runtime import to a user's local binding (#32593)
c1da139f09 sourcemap: SIMD mappings VLQ decode via Highway (#32556)
765cad084f fs: use clonefile for symlink-free recursive fs.cp on macOS (#32503)
452139e36b docs: clarify the example security scanner package name is a placeholder (#32589)
85559ebcce node:fs: stop draining tasks after termination in fs.watchFile initial-stat callbacks (#32587)
fca03d9b9e cli: make several unhelpful error messages actionable (#32470)
7dd427e7ad Add Bun.isStandaloneExecutable (#32583)
7a5293cef9 Bun.serve: propagate socket backpressure to Response(ReadableStream) bodies (#32553)
602d956885 Remove the js-call-outside-microtask-queue debug check (#32552)
9cb2faf202 ci(lint): install dependencies before running oxlint (#32555)
febcc24cbc parser: keep resolved Ref on e_identifier during substitution revisit (#32551)
8dd1b617e4 Fix crash when a client aborts a streaming response under backpressure (#32120)
1031c6667a epoll_pwait2: issue raw syscall, add Android gate and disable flag (#32490)
b0fb1f767e sys(windows): map unknown NTSTATUS through RtlNtStatusToDosError for fs.rm (#32538)
8f1b951ff5 react-compiler: follow-up fixes from #32504 review (#32545)
90e2bac16e lint(src/js): flag duplicate property reads between an if condition and its body (#32522)
de73fda94f build: enable Rust debug-assertions for asan/assertions builds; decouple IS_DEBUG (#32520)
315ed50aba React Compiler integration (#32504)
88417471cb chore: remove stale 'cfg-gated'/'un-gate'/'blocked_on' port-era comments (#32519)
46c54cd69f deps: upgrade BoringSSL to upstream 606d3a344 (#32521)
25e32c1b69 ast: shrink Expr/Stmt/Binding 24→16 bytes (#32507)
e11be56199 fs: accept integer-valued double for numeric open() flags (#32506)
4261a465c1 node:v8: return false from startupSnapshot.isBuildingSnapshot() (#32502)
dae2e8722b fs: port Node.js v26.3.0 fs tests and fix the gaps they surface — cp error semantics, watcher event delivery, watch ignore+AbortSignal, FileHandle pull/writer, glob port, opendir/Dir, mkdtempDisposable, rmdir-recursive end-of-life, mock.fn (+119 tests) (#31830)
454e3b2884 threading: wake all parked workers on pool shutdown (#32494)
eae803811b FileSink: remove Windows UAF diagnostic probes (#32474)
f9530ae67d Add --trusted flag to bun list (#32478)
6ef59777b6 node:http2: rewritten inbound engine, batched write path, server push, +290 node v26.3.0 tests (79% passing) (#31584) [publish images]
fe9721c1af ci: ignore image-bake commit tags on main (#32477)
797d565fa6 install: trust file: paths from root package.json overrides/resolutions (#32452)
92311e19f9 postgres: fix do_run error-path leaks (poll_ref hang + query/statement refs) (#32464)
65f12bd97d crash_handler: emit baseline platform char from Environment::BASELINE (#32468)
1ee0960156 install: explain unsupported bun.lock version and suggest 'bun upgrade' (#32465)
899168aba9 node:stream: sync the stream suite to Node v26.3.0 and fix the gaps it surfaces — stream/iter + zlib/iter behind --experimental-stream-iter, read()-one-buffer semantics, compose/pipeline/web-adapter/http/fs/net parity (247/251 upstream tests, +63 vendored) (#31826) [publish images]
e54dc71639 build: add --remap-path-prefix to cargo RUSTFLAGS for reproducible builds (#32466)
1ecbea9d6d http: fix use-after-free when proxy tunnel closes after response completes mid-read (#31959) [publish images]
dcc34a8245 node/fs: guard StatWatcherScheduler against double-pushing its intrusive WorkPool task (#32457)
7765caff44 http: fail with ConnectionClosed instead of asserting when outer proxy socket is dead at ProxyHeaders write (#32462)
c4a937c53d node:http: rewrite the client on net/tls + llhttp (Node http suite: ~55% → 82.3%, +182 vendored tests, client proxy support) (#31587) [publish images]
be38df3440 Make navigator properties getter-only accessors (#32440)
3b4f2866e6 fix(ws): pass ServerWebSocket to cork() callback (#32438)
0c537fef87 moduleLoaderImportModule: thread referrer asyncEvaluationOrder for TLA self-deadlock skip (#32437)
3b24ca9bca Fix queueMicrotask.length to be 1 (#32419)
cd9a79dbc6 ci(machine): note Azure delete-before-recreate cancel hazard (#32446)
76d5d28e79 crypto: accept shake-128/shake-256 aliases in createHash and crypto.hash (#32439)
bd8edc7c50 net,tls: port Node.js net/tls compatibility tests and fix the gaps they surface — half-open/reset/write semantics, server TLSSocket wrap, session/keylog, SNICallback/ALPNCallback, pfx, OpenSSL error shapes, addCACert, local binding (+305 tests) (#31155) [publish images]
9ff03fb66b ci: document the publish-images requirement in bootstrap.sh version comment (#32441)
91ce3b4d35 Upgrade WebKit to b5ba38a21e17 (#32414)
66cd2fdab1 test(sql): cover both adapters in the synchronous-tls-rejection test (#32415)
53bd013ef3 url: skip zero-fill of 2KB scratch buffers in join_normalize/join_write/join_alloc (#32393)
b0fef2f7b0 Use visitor.vm() in GlobalObject::visitChildren; make HTTPHeaderIdentifiers eager (#32407)
5d89ae2fc5 ci(runner): ignore local console logins in wait-for-user loop (#32396)
0fcead62d8 Upgrade reported Node.js version to 26.3.0 (#31991) [publish images]
62cc078d30 Upgrade WebKit to 51cc3feb7298 (#31796)
eaae6d1b8e console.timeEnd(""): remove doubled trailing newline (#32360)
06c90af678 fs.readdir: don't drop recursive entries whose relative path exceeds MAX_PATH_BYTES (#32368)
49269d3658 Fix Bun.Terminal termios flag NaN clamping (#32354)
d90054227f sql_jsc: add SQLDataCell tag constructors and replace hand-rolled struct literals (#32367)
bbbab38875 websocket: only cap header bytes, not pipelined frames, during upgrade (#32394)
78f0fff164 spawn: don't panic on Blob/ReadableStream stdio at index >= 3 (#32363)
f7648781ad jsc: use 'property' wording in get_optional_slice type error (#32355)
352ce1a61d Fix bun build --compile dropping asset [dir] from Bun.embeddedFiles[].name (#31576)
88d09d52c2 Fix BunString ref leaks in Bun.JSON5.stringify (#32331)
65f80dcf66 websocket: keep receive buffer capacity across fragmented message dispatch (#32356)
8cfee50df0 node:module: release StringImpl refs in _nodeModulePaths (#32337)
332aa78131 http: remove 1 GiB decompressed-body cap from fetch Decompressor (#32366)
df55ab7b77 postgres: throw ERR_INVALID_ARG_TYPE for null bytes in connection params (#32352)
e0acad3182 crypto: throw ERR_INVALID_THIS in Hmac native update() on bad receiver (#32256)
2d8d5da90e Shrink CLAUDE.md
7daa6ef4d6 tls: apply the server's default rejectUnauthorized to incoming connections (#31322)
4d79cf879a sql: throw validation errors for degenerate helper inputs instead of raw TypeErrors and engine errors (#32156)
4d07529ce2 test: give container-awaiting beforeAll hooks a 120s timeout (#32211)
eb98fd874f sql: guard pool connection scans against unassigned slots during pool start (#32201)
14bcc6c534 docs: fix dead discordjs.guide links in Discord.js bot guide (#32238)
719be62fa5 docs: rewrite Discord.js bot guide around a working slash command (#32237)
6f67e0902b docs: add production deployment note to Discord.js bot guide (#32236)
a0e221e07e sql_jsc: drop dead to_js helpers, Signature::hash, and unused MySQLValue Decimal/timestamp (#32209)
80d92d42c9 test(sql): bound spawned fixture lifetime so a test timeout cannot leave orphans (#32207)
ac312f0952 ci: bump darwin test timeout 40→45 min (#32194)
f2821a2d8f test/docker: BUN_TEST_SERVICE_ env override for ensure() (#32139)
5d8b29294b sql: consolidate JS pool/connection plumbing into BasePooledConnection in shared.ts (#32145)
885c44fea1 Fix panic on lazy-export modules in bun build --format=internal_bake_dev (#31948)
541ea3acf6 node:fs: implement lchown on Windows (#32052)
fc79577b77 dev server: fix require binding when a module flips from ESM to CJS (#31947)
6b001fea8d Surface posix_spawn file action errors on macOS instead of spawning with closed stdio (#32068)
6128f8e85b Emit sourcemaps for standalone HTML builds (--compile --target=browser) (#32116)
bcad9b220e fetch: settle buffered body promises when an aborted request still has a streaming request body (#32130)
fd99f8b32e Fix missing exception check when coercing Bun.plugin target to a string (#32106)
ddd1ff0a3d sql: consolidate per-driver StackReader into shared/ (#32141)
5c02cc1040 sql: make forced close() resolve while a pool connection is mid-handshake (#32097)
170fcd76cc sql_jsc: extract shared query/connection ctor-arg parsing across postgres and mysql (#32135)
6e91d24dc6 Type-erase source-provider dispatch and move bake's providers out of bun_sourcemap (#32077)
70134979c2 sql: collapse repeated const tables into macros and drop dead protocol traits (#32128)
f8723b190d Fix duplicate clientNavigated inspector events on successful SetUrl (#32081)
8354af5421 sql: don't let a throwing onconnect/onclose callback corrupt the connection pool (#32041)
1c90e5a2cf Move the bake dev-server inspector agent out of jsc (#32076)
8df5916805 sql: retry connect failures while queries are waiting (#32028)
6ed88a5e27 ci: automatically retry jobs killed by timeout or agent loss (once) (#32072)
2ad4199574 ci: serialize docker service startup through a per-shard coordinator (#32033)
09703da1ae Skip bunx.test.ts in CI until the Node.js version bump (#32042)
88d48c2236 sql: report connect failures distinctly from closed connections (#32027)
0c6eefd1d2 ci: raise darwin test-step timeout to 40 minutes (#32032)
717542f899 jsc: mark ArrayBuffer no-copy constructors unsafe (#31981)
0e95920c36 test(sql): fix malformed force_tls.cnf in mysql-tls image (#32030)
a988615098 repl: keep multi-byte UTF-8 input in the interactive line editor (#31876)
1293ef4ee4 css: minify merged duplicate rules in linear time (#31920)
0342abb38f Don't panic when auto-install can't read the top-level directory (#31938)
90589f93cc bundler: fix dev server crash when a CSS rebuild fails import resolution (#31905)
300b148feb test runner: store Scanner.fs as a raw pointer instead of casting away shared refs (#31850)
27d5181ad6 markdown: fix quadratic rendering of nested link/image labels without a depth cap (#31909)
73ab3ddc76 css: fix exponential backtracking on nested color function values in token lists (#31919)
a7034f2248 Evaluate private method call receivers once in decorator lowering (#31426)
a7839df914 ci: platform smoke check before running tests (#31904)
08226e20fd fs.watch: type FSWatcher's wrapper self-reference as JsRef instead of a bare JSValue (#31848)
d155a2ceb5 webcore: fix ReadableStream::isLocked never matching any stream (#31884)
a2eaf90b26 ci: bake Intel SDE into the Windows image for verify-baseline (#31893)
82808d41e9 test(sql): use container.host instead of hardcoded localhost in 'Connect using uri' (#31901)
a1dd647d5b resolver: root dir-cache slot pointers at the singleton and drop browser-map borrow erasures (#31836)
f50099364a Make the bundler's output-dir handle an owning bun_sys::Dir (#31849)
7ab24e447d Fix GC use-after-free of BuildMessage wrappers when building AggregateErrors (#31874)
bf79fe702c Replace phf maps with a length-dispatched comptime string map macro (#31875)
55f6c899f5 yaml: remove raw parser back-pointers from plain-scalar string builder (#31847)
74c709db01 zlib: stop reading JsCell stream state from the GC marking thread in estimatedSize (#31867)
3360a9eaf6 css: thread the arena lifetime through ToCssResultInternal (#31839)
3d125dca77 ffi: remove write-only js_function field from Compiled and document GC rooting (#31846)
b56491b139 Reuse parser-owned stack in unused binary-comma simplification (#31851)
6038601f30 css: fix grid-template-areas . null-cell token parsing (#31840)
85534281c6 Resolve the audited TODO(port)/TODO(b2)/PORT NOTE backlog (#31783)
91270aa8ab fix(base64): don't overflow on VLQ::encode(i32::MIN) in the crash handler path (#31861)
ef8952736b bun test --isolate: release leaked-handle global pins; attach module_info on the sync module path (#31793)
898ef56ed7 Update CLAUDE.md
29f2c7e6c2 Treat unregistering an already-removed poll registration as success (#31821)
8c3dfdb79d Update CLAUDE.md
977f054f60 Reset SIGTRAP before the crash handler's final trap so crashes terminate on aarch64 (#31794)
a3464c666b fetch: use standard base64 for proxy Basic auth credentials (#31782)
59ec6264ed bundler: tree-shake unused objects with inlined-enum computed keys (#31756)
bf70cc79c4 Remove stale TODO(port) comments and delete dead code (#31746)
43fff14420 Fix panic converting over-long Windows paths to UTF-16 (#31694)
40d8c4efa0 fuzzilli: stub process.execve in the REPRL wrapper (#31759)
d2a6506dfa fix(dns): handle UTF-16 strings in lookupService address and resolve record type (#31742)
79b5471031 fetch: resolve empty compressed responses as empty bodies (#31736)
800c0e5a1c Collapse single-return arrow bodies to expression bodies when minifying (#31723)
5d9b84a529 Fix type confusion in generated class custom setters (#31725)
a5879491c9 resolver: fix filename-store overflow panic under --bun (#31504)
3f153b9c9a Validate VLQ accumulation and size math in standalone sourcemap embedding (#31698)
3edc7af074 test: build docker test services instead of bind-mounting their config (#31732)
31cae2ed00 websocket: report the received close code to JS, not the echoed one (#31518)
4b42439858 Fix OOB panic in redacting JS highlighter when ${} ends the input (#31700)
b7fa3cbed1 Fix panic when FilePoll unregister fails on macOS (#31701)
8fe7a60aa1 test: let the docker test helper target a remote Docker host (#31731)
f7b9902780 install: use a bitset for Lockfile.exact_pinned instead of Vec (#31707)
1b7a40768f Upgrade WebKit to 6d586e29 (#31724)
684f2afe80 Hardening: input validation and compatibility fixes across 9 subsystems (round 9) (#31606)
9fd88506e2 valkey: adopt RESP payload allocation as Buffer backing store (#31673)
f58d14649c Update .gitignore
f8f7490fa4 install: don't panic when downloading a package whose patch was removed (#31685)
a0d1472836 Delete PathString (#31579)
64ae83c2fc parser: fix "Scope mismatch while visiting" panic from macro tagged templates (#31693)
7ef293bd96 crash handler: evaluate stack-trim anchors in the capturing frame (#31687)
17b4071b44 Allow napi_delete_reference to be called from finalizers during GC (#31684)
8cf3737812 fetch(proxy): clear response buffer after CONNECT envelope handoff (#30385)
561eb8ff17 Fix memory leak in repeated Worker create/terminate (#31646)
9333748bbb install: don't bump an existing bun.lock to lockfileVersion 2 on re-save (#31602)
fdf1246df0 bundler: stop re-interning module paths into FilenameStore on every Bun.build() (#31647)
90f334a46b Fix mojibake in bun update output; move pretty-format strings to compile time (#31668)
5836485c97 node:vm: throw instead of crashing on a cyclic SourceTextModule linked inside the linker (#31624)
593dbaa423 install: don't fail on an unresolved optional dependency with an empty name (#31655)
8a5115791b Update upgrade-webkit instructions for the current build system (#31649)
b687fb3fb6 base64: encode URL-safe via simdutf directly instead of the WTF C++ shim (#31666)
1f76618bb0 css: bound vendor-prefix fan-out when serializing nested rules (#31642)
e75a55dab6 sql: share the wall-clock datetime text parser between MySQL and Postgres (#31663)
0a205776e9 blob: stop resolve_size() widening a sliced Blob to the end of its store (#31210)
ba71f3f290 http: match Content-Encoding/Transfer-Encoding case-insensitively and accept x-gzip (#31521)
ffe20f48c4 formdata: match multipart media type and boundary attribute name case-insensitively (#31531)
5ac120ca37 Fix use-after-free in bun run --parallel workspace script spawning (#31637)
2629789a22 Add microbenchmarks for latest JSC changes (#31562)
61bd9976e1 mysql: decode DATETIME/TIMESTAMP as UTC to match the UTC-based encode (#31212)
7069b30929 yaml: clear remaining 3 non-cyclic test.todo entries (BOM strip, 2-anchor e-node key, flow cmi gap) (#31569)
3a79bd746b node:crypto: uppercase X509 serialNumber and modulus hex to match Node (#31519)
6162fb29e2 css: fix exponential backtracking in atan2() color parsing (#31558)
e3481db80c mysql: decode computed DECIMAL columns as strings, not raw buffers (#31513)
bb94ed4f29 Hardening: input validation and bounds checking across 12 subsystems (round 8) (#31559)
16f34ba649 collections: fix LinearFifo::ordered_remove_item wrapped-buffer bounds (#31565)
9d953cc350 Fix test failure
496ce7e47d standalone_graph: zero-copy source string for compiled JS modules when contents are ASCII (#31557)
efc26a1be0 crypto: X509Certificate#checkIssued() should return a boolean (#31571)
cb4a5c69db sql: keep all-digit column names with '_' separators as named keys (#31572)
051f78227a install: make lockfileVersion 2 stamp independent of the writer's registry config (#31556)
9d000561c9 yaml: fix 5 flow-context over-accepts/under-accepts (#31561)
57d8e38a1c yaml: ---/... only recognized at column 0 (closes #25660) (#31547)
f3ccf766df ast: delete unused Boundering, RefDump, Names, and dead Loader/allocator helpers (#31546)
677fe1cfad Fix crash when starting a compiled executable in a deleted cwd (#31496)
5ba2f652d2 encoding: don't corrupt encodeInto output when a valid astral char doesn't fit (#31532)
973d1de8b5 install: bump default lockfileVersion to 2, gate stricter parse checks behind it (#31539)
3e033eac2a semver: delete unused Sorter/SortDirection and any_range_satisfies (#31545)
e85606d484 upload-release: publish android and freebsd artifacts (#31553)
937b075080 bun_core: delete unused MapLike trait, FieldType marker, EmbedDir (#31543)
314bae56aa http_types: delete unused can_open_in_editor and URLPath::is_root/path_without_asset_prefix (#31552)
831cd0002f sys: delete unused CopyFileRangeError, copy_file_error_convert, SCS_*_BINARY/GetBinaryTypeW (#31550)
a3e0d1f7d3 bun_alloc: delete unused MimallocHeapRef, TypedArena, BumpWithFallback (#31542)
f46fe89134 paths: delete unused Path::move_ no-op (#31551)
eeca40690c resolver: delete unused ModKeyError, FileSystemError, ReverseResolution, and dead helper fns (#31548)
043a2bf5ac threading: delete unused init_with_mutex/into_unprotected/wait_and_deinit (#31544)
4d4cb71633 collections: delete unused SortedHashMap, AutoStaticHashMap, ComptimeStringMap16 (#31541)
ecfdaa66f3 js_parser: guard stack depth when parsing nested JSX elements (#31537)
4845d4fdaa bundler: inline ungate_support into bundle_v2 and lib.rs, delete the file (#31529)
d4b3a3ed47 yaml: reject tab in s-indent position before structural tokens (DK95/06, Y79Y/005, Y79Y/008 — 402/402) (#31527)
7688c09dc9 bun_core/util: delete unused ArrayLike trait (#31536)
002dd41eb3 Hardening: input validation and protocol tightening across 24 subsystems (round 7) (#31495)
843549b819 node:buffer: default lastIndexOf(value, encoding) to search from the end (#31507)
a740d91572 js_parser: discard the fake if-block scope for a forward-declared function (#31533)
d632fc5b29 css: bound selector expansion through nesting-holding at-rules (#31482)
63d5cd4065 Add runtime-dispatched SIMD xxHash3 via Highway (#31491)
29e38e9486 bun:sqlite: decode short non-UTF-8 TEXT leniently instead of dropping the field (#31514)
67d6021fde Lowercase Headers names on iteration with Highway SIMD (#31489)
f472981ecb ci: build the Windows artifacts by cross-compiling from Linux (#31431)
79a4029d20 yaml: extract parse_block_indented helper; fix anchor/tag on empty node (6KGN/FH7J/H7J7/PW8X) (#31308)
510b517817 sourcemap: fail on a truncated base64 VLQ instead of decoding it as 0 (#31506)
b69085e598 Route large ANSI escape scans through the dispatched Highway kernel (#31490)
3ec6669844 node-fallbacks: embed browser polyfills zstd-compressed (#31456)
f20c8dc33a strings: bind StringJoiner borrowed segments to a lifetime (#31493)
472a06a2fb Rewrite Bun.escapeHTML using Highway SIMD (#31483)
4ee835b753 postgres: emit full leading-zero groups when binary-decoding sub-1e-8 NUMERIC (#31211)
b668561c31 node:fs: move fs.watch's FSWatcher into a lazily loaded internal module (#31428)
db928c2474 node:fs: move watchFile/unwatchFile into a lazily loaded internal module (#31424)
c89f30d3aa mysql: decode binary YEAR as a 2-byte number instead of column_length bytes (#31437)
bb14c4e021 TextDecoder: keep the codec alive across streaming chunks for legacy multi-byte encodings (#31438)
13bbb38597 Hardening: input validation and bounds tightening across 27 subsystems (round 6) (#31417)
2148214d40 Decode Buffer base64/base64url with simdutf's lenient accept-garbage mode (#31423)
18b7c95184 Decode Buffer.from(str, 'hex') with Highway SIMD (#31425)
99f4679dbb Fix out-of-bounds read in JS highlighter on trailing backslash in ${} (#31435)
f958cbd552 js_parser: restore SIMD block comment skipping via Highway (#31433)
c78d08ff2e build: enable cross-language LTO on linux aarch64-musl (#31432)
a6a5614199 docs: clarify trustedDependencies replaces the default allow list (#31027)
4c954ab998 build: support cross-compiling Windows (x64 and arm64) from Linux (#31300)
19dd34df33 Bun.serve: restore per-request GC memory accounting to fix elevated RSS under HTTP load (#31422)
cab4feba8e Optimize Buffer.toString('hex'/'base64') for large buffers (#31421)
4324120d5d Hold cellLock() when removing or clearing JSC module registry entries (#31407)
ec68d39014 build: fat Rust bitcode for cross-language LTO on Linux (#31412)
0b1e7e507b Optimize TextEncoder.encode: restore SIMD ASCII fast paths lost in the Rust port (#31385)
146afa332a js_parser: sanitize auto-generated default export name for digit-named modules (#31403)
0974d031ca fetch: run checkServerIdentity before writing the request (#31325)
9e6a19ba2e ffi: avoid copying the threadsafe callback wrapper on the calling thread (#31332)
29f1f7c5d5 install: gate the exit-callback cache teardown to the main thread (#31376)
e262c99168 fix(node:module): don't register native helpers as their own constructors (#31393)
984bc1e180 css: escape custom pseudo-class/element names when printing (#31404)
2cd36bd84a Deepen the lots-of-for-loop fixture so the transpiler stack-overflow tests throw on Windows (#31382)
cd1ad59994 Hardening: input validation and bounds tightening across 36 subsystems (round 4) (#31339)
fc268251f5 Speed up FormData multipart serialization (#31379)
a49b308f29 webcore: free Blob's owned content type on drop (#31358)
8e6eefd66a Support cross-compiling macOS binaries from Linux (#31303)
705c482b69 test: forward keep-alive requests in proxy.test.ts's mock proxy (#31352)
1c6597b8c4 Port Bun.stringWidth to C++ with explicit SIMD (#31351)
1950a3a7c5 Fix quadratic hang reporting duplicate-binding parse errors in the transpiler (#31341)
7bd0861fc6 shell: don't abort when a glob's directory prefix doesn't exist (#31367)
159a4b74d2 Error instead of crashing on deeply nested statements in the transpiler (#31333)
dedf657ae0 Fix JSX transform panic when a bare key prop precedes key with a value (#31350)
0deaf0b0ea Cap ANSI markdown indentation so deeply nested lists render in linear time (#31366)
2fbfcb9833 css: bound selector-list expansion when compiling nesting for older targets (#31277)
3fa9635265 node:http2: reassemble HEADERS+CONTINUATION before HPACK decoding (#31323)
9d5356a686 Fix await using expression printing using as await (#31324)
80df5b17de Parenthesize async when it starts a for-of loop initializer (#31326)
08652f2a76 Print Infinity and negative numeric property keys as computed properties (#31328)
dd0883d963 css: keep required grouping parens in @container conditions when minifying (#31330)
24e94adb96 Fix panic on anonymous export default class with an auto-accessor field (#31331)
af054d47db node:http2: send GOAWAY frames on stream 0 (#31353)
81a811b2ae parser: fix "Scope mismatch while visiting" panic from decorators on dropped class members (#31340)
39a8e56467 webcrypto: reject oversized BufferSource inputs instead of aborting (#31356)
06b141d659 Error instead of crashing on deeply nested TypeScript types in the transpiler (#31361)
49c97de6b3 Restrict crate-internal items to pub(crate) and remove dead code it exposes (#31254)
f271ddc5d7 deps: update elysia to 1.4.28 (#26654)
295026b7b9 Fix exponential backtracking on nested TypeScript infer constraints (#31307)
02380d3e14 css: cap & parent-selector expansion when compiling nesting for older targets (#31276)
d2f274d22d patch: don't panic applying a rename whose destination dir overflows the path buffer (#31306)
8dcbb44fe6 Fix CSS color fallback panic for system colors and currentColor in compound values (#31305)
5bf4941b9f css: reject * local names in attribute selectors instead of panicking (#31304)
a8aec3067d Hardening: input validation and bounds tightening across 31 subsystems (round 3) (#31221)
5da1ff86de Reject export clauses inside a non-declare TypeScript namespace instead of panicking (#31266)
41aa6724d8 Error instead of crashing on deeply nested expressions in the transpiler (#31242)
3d5fe5ed0c Compute diagnostic positions incrementally to fix quadratic hang in Bun.JSONC.parse (#31273)
a207a77d0e css: don't duplicate vendor-prefixed nested rules per ancestor prefix pass (#31270)
543f2f9963 css: don't panic on out-of-range @font-palette-values palette indices (#31275)
aff1bb1a06 Fix quadratic blowup in Bun.markdown on unterminated inline HTML openers (#31271)
14b398c802 Fix CSS angle serialization hang on huge radian values (#31280)
0179127721 fix(CryptoHasher): don't crash on non-latin1 algorithm names (#31283)
f161e0311d shell: wrap only component-leading ! when neutralizing glob metachars (#31272)
d110499293 Fix out-of-bounds read in eql_case_insensitive_ascii when the input is longer than the comparand (#31264)
52898c8457 Report duplicate declarations for import bindings kept in TypeScript output (#31240)
3c92be850a Fix CSS color fallback panic for oklab() in unparsed values (#31269)
ffd67d847d Don't panic when export default interface starts an expression or labeled statement (#31263)
8d7c08040c parser: lower using in switch cases by wrapping the whole switch (#31262)
c80b71085b Don't emit reserved words as class names when lowering decorated anonymous class expressions (#31265)
3aa8a0e6ab css: fix @page selector parsing and printing so minified rules roundtrip (#31259)
b733df44bc Keep the TS namespace closure argument from colliding with namespace members (#31261)
aad556182a patch: propagate thrown errors from patchInternals.apply argument parsing (#31268)
541620ad84 repl: stop rewriting top-level this to exports (#31226)
5d1d351e9f csrf: add sessionId option to bind tokens to a principal (#31215)
a90c6575f0 Don't panic on export default abstract followed by a class statement (#31257)
00e084c09a install: compare trusted dependency names, not just truncated hashes (#31218)
816dd1f3c1 toml: surface logged errors on Bun.TOML.parse (#31255)
fd7c6fe9f8 Fix minified output dropping the space before in/instanceof after a leading single-byte operand (#31260)
f8dcf1a8a0 ICU: per-item zstd decompression hook for compressed libicudata (#31200)
30c0071208 Fix quadratic blowup in Bun.markdown on unclosed link brackets (#31241)
d1ed86d119 Fix YAML.stringify emitting invalid anchor names for keys with special characters (#31235)
4df6154f09 parser: fix scope underflow panic when a TS contextual keyword starts a larger expression (#31239)
10db442886 Fix panic on unterminated template literal after TypeScript type arguments (#31238)
ef5d92edda yaml: flow-mapping ?/: and JSON-adjacent value (#31203)
a4de1eb47c css: fix exponential backtracking on deeply nested function values (#31243)
a06a00aea5 crash handler: walk frame pointers seeded from the fault context (#31163)
0d84cdd80d spawn: default SpawnOptions stdio to inherit (#31196)
586fe49644 Fix unreachable-code panic in semver range parser on dangling '-' chunks (#31234)
5b088f766f Reject export of a block-scoped function declaration instead of emitting unparseable output (#31237)
7b34ff6ce5 node:vm: give DONT_CONTEXTIFY sandboxes their own Object.prototype (#31207)
3219132505 parser: fix "Scope mismatch while visiting" panic from dropped TypeScript declare statements (#31231)
d5ceba6a76 parser: reject for-in/for-of head declarations with invalid initializers (#31236)
e5db584624 shell: only template-literal glob tokens act as pattern syntax (#31220)
f7a2e06942 Reject TypeScript using declarations in ambient contexts instead of panicking (#31230)
b8c19a7b81 patch: don't panic on truncated ---/+++ header lines (#31227)
82cf7dcd00 bun:test: fix SIGSEGV when constructing an expect.extend() matcher (#31219)
e0b291a176 Upgrade WebKit to 39d4ce1f12ea (#31169)
346ce0805f yaml: fix explicit mapping key (?) parsing (#31112)
74e191b3cb Hardening: input validation and bounds tightening across 28 subsystems (round 2) (#31175)
e73dbfaa13 Reduce node-http-backpressure test peak memory (#31199)
dcc0434803 package.json: drop empty-valued script/config entries (Zig parity) (#31012)
dbdf818124 shell_parser: drop stale capacity==1 debug_assert in parse_atom (#31191)
12d77d1ac5 Fix rare concurrent-transpile segfault: mimalloc TLS slot resurrection; restructure the AST allocators (#31177)
832edbc700 Don't forward SIGPWR in spawnSync signal handling (#31183)
0b20408b65 Hardening: input validation and bounds tightening across 26 subsystems (#31129)
753f1c4620 fs: use statfs64 on macOS x86_64 to avoid legacy-layout fallback (#31139)
3eb0fda021 FileSink: mark sink done when end() fails during flush (#31135)
71b4baa738 lexer: point caret at the backslash for out-of-range \u{...} (#31138)
21db682694 clippy: 45 deny lints + fix 2735 violations across workspace (#31116)
a43a01b3a5 NativeReadableStreamSource: reuse pull-buffer tail across reads instead of rotating every pull (#30593)
b3d086e26f shell: glob brace-expanded patterns instead of dropping the glob (#30999)
f5358e2f5d fmt: decode multi-byte code points in the identifier formatter (#30993)
b91618772f subprocess: list valid signal names in kill() error (#30982)
02f9249e43 buffer: preserve high-bit bytes in buf.write(str, 'ascii') (#31084)
2f9e77b247 test runner: preserve top-level await across --isolate / --parallel preload (#30888)
a55a62d597 bake/DevServer: fix dangling watch path in live DirectoryWatchStore::insert (#31106)
be6a3c55c2 deps: bump mimalloc to 24f9c6b4 (theap-init sentinel fix + dev3 sync) (#31117)
32a161f5af bundler: close the main-thread perf gap vs Zig 1.3.14 (#31115)
46b2404518 sys: make File and Dir owning RAII handles (#30878)
1736dd02a8 yaml: JEF9/02 — trailing indentation at EOF counts as one empty line for Keep (#31109)
303e97acd2 yaml: honor block-scalar indent indicator and fix chomping/folding (#31097)
b96cc3fa1a chore: remove my stale TODO assignments (#30685)
6aa692385c build: enable rustc parallel frontend (-Zthreads=8) for local builds (#31096)
1d227bfd6b lsan: fix leaks behind BunString::toWTFString / ZigString__toErrorInstance / WTF::fastMalloc suppressions (#31029)
5835c6a08b css: move ParserState into error closure instead of cloning (#31053)
d45fd78ed5 runtime: derive Copy on DiffSegment/NPMClient (cleanup, no alloc change) (#31056)
dddf19d2b4 jsc: derive Copy on RuntimeTranspilerCache::Metadata (cleanup, no alloc change) (#31061)
654d2d9dd7 install/npm: drop redundant Range.clone() in manifest parse (#31063)
174a2c9946 fetch: drop redundant Host header re-allocation in fetch_impl (#31066)
86f6b727b0 shell: move Arc into stderr instead of cloning on last use (#31067)
d6cd104e1b shell: move Arc into stderr redirect slot instead of cloning (#31068)
1154d7e0df macros: free per-thread SOURCE_CODE_PRINTER on bundler worker teardown (#31069)
a195f61864 install: borrow trustedDependencies array instead of to_vec in PackageJSONEditor::edit (#31070)
f17f404762 install: borrow trustedDependencies arena slice instead of to_vec (#31071)
4bcd926f4e install: drop redundant Box re-allocation of INIT_CWD key (#31072)
d1046b790d install: borrow node_path instead of double-boxing in configure_env_for_scripts_run (#31073)
c23a7eec2e install: drop dead Patch.path field, make Patch Copy (#31075)
ee48fd4738 test_runner: move RefDataValue instead of cloning at callTestCallback pending-promise path (#31051)
f24843dc18 install/npm: move single-use Range instead of cloning in PackageManifest::parse (#31065)
433c2dcdd9 server: borrow URL via Cow instead of to_vec() in server.fetch(string) (#31062)
c9c9eab55e jsc: borrow remaining_buf in ArgumentsSlice::init_async instead of cloning (#31042)
ff4aebf850 resolver: drop no-op .into()/.clone() on Copy (clippy cleanup, no alloc change) (#31043)
60c6ceb9d4 jsc: drop no-op .into()/.clone() on Copy (clippy cleanup, no alloc change) (#31044)
77f296e492 install: drop no-op .into()/.clone() on Copy (clippy cleanup, no alloc change) (#31045)
f9992d53df runtime: drop no-op .into()/.clone() on Copy (clippy cleanup, no alloc change) (#31046)
7bb71a11aa css: derive Copy on 10 all-Copy-field value types (cleanup, no alloc change) (#31047)
776b094a0f install: move catalog_dep.version instead of cloning in enqueue_dependency (#31049)
c6eaefe03c install: move catalog_dep.version instead of cloning in enqueue override path (#31048)
0ee283d301 bake: derive Copy on EncodedPattern/ServerComponents/ReactFastRefresh (cleanup, no alloc change) (#31050)
85ac640a82 server: drop host snapshot Vec in H3 request URL assembly (#31057)
c486ef09c0 js_parser: drop no-op .into()/.clone() on Copy (clippy cleanup, no alloc change) (#31041)
6787345800 core/misc: derive Copy on 5 small all-Copy-field types (cleanup, no alloc change) (#31060)
c37f3c8683 moduleloader: avoid redundant String::clone_latin1 of transpiled output (#31064)
2c16e8aa69 shell_parser: derive Copy on SrcAscii/Script/CompoundAtom (cleanup, no alloc change) (#31052)
184d0371aa Implement static import defer (TC39 Stage 3) (#30975)
3dfca30340 jsc/RuntimeTranspilerCache: drop redundant output_code Box copy in put() (#31054)
fccb4a9167 bundler: drop no-op .into()/.clone() on Copy (clippy cleanup, no alloc change) (#31040)
f4e0c388e1 css: drop no-op .into()/.clone() on Copy (clippy cleanup, no alloc change) (#31039)
e12d4e50f7 fetch: avoid WTFStringImpl clone for canonical statusText (#31038)
80a649602d node/types: avoid intermediate Vec in digest('base64') encode (#31037)
5deb4cabcd resolver: avoid unconditional deep clone of exports Entry in visit() (#31036)
671b74185d paths: derive Copy for fs::Path (cleanup, no alloc change) (#31035)
f816284bcb perf: React SSR / Bun.serve hot-path optimizations (#30909)
303cd282b5 perf: cache thread_id::current() in a #[thread_local] slot (#30971)
7e40844762 events: once() rejects instead of throwing for bad signal/options (#30984)
4a8a093d73 blob: release the adopted WTF string ref in string-body consumers (#30991)
2017304972 resolver: restore package_manager.log after resolve to avoid dangling stack pointer (#31020)
2f15816405 node:fs: reset read buffer len before growing on a wrong stat size (#31005)
fba43af684 Fix effectively every native-code memory leak in Bun (#30875)
08f4ab4a11 install: treat an out-of-range package id in bun.lockb as corruption (#31008)
2ff6df8a7e semver: widen comparator counter to u32 to avoid debug overflow panic (#31010)
73f1f93bc0 shell: echo keeps both newlines for a pure-newline last arg (#30996)
a3408a2205 parser: drop dead-branch var with zero identifiers instead of emitting var; (#31003)
05a7a5c1b4 mysql: consume 4 bytes for INT24/MEDIUMINT binary field (#31007)
4c8a21b149 lexer: step past unknown byte on TSyntaxError in next_inside_jsx_element (#30969)
31ec206600 dev-server: hoist insert_stale out of debug_assert! so it runs in release (#30977)
b36759fdb9 js_parser/lexer: saturate escape-sequence error offsets to avoid usize underflow (#30895)
25ad47bda0 js_parser/lexer: reject JSX numeric entities outside Unicode range (#30961)
a7dca12852 parser: gate class-static-block branch on is_class (#30967)
ba15626037 Fix over-deref of Blob.name in borrowed_view() (#30955)
c47ec9c4cd Validate Bun.password.hash memoryCost against argon2 minimum (#30964)
390e0dc123 Upgrade WebKit to 2b257999 (#30705)
9ecb985ad0 Fix FileSink.start() crash when called without path/fd on an open writer (#30953)
ad68af805f Discourage comments
b18bf6d1d0 Bump (#30952)
80a06a8c02 Add cargo-miri support and fix HiveArray aliasing UB (#30876)
035add3ae0 install: reuse existing folder/tarball entry in package.json (#30935)
655398c3a6 encoding: fix Vec->Vec layout UB in fs.readFile utf16le path (#30926)
c7a7579b11 Collapse ThreadPool::init dead generic and fix cpuid cfg gate (#30886)
172afa5320 Replace bun assert helpers with Rust builtin assert macros (#30918)
945b8946ed perf: bundler & transpiler hot-path optimizations (#30901)
112f3055bc refactor: remove unsafe for static strings (#30867)
e750984db6 cargo fmt
880ee8929f Clean up Zig-port phase comments and trivial lint warnings (#30877)
e520065ebb Harden 36 reachable security findings across runtime, install, parsers, http (#30722)
f7c692ae9c Fix worker teardown crash from missing dupeRef on synthetic-module specifiers (#30882)
8438ff7baa resolver: split the port's module wrapper into files; type the extern-Rust pointers (#30880)
f85020a32f hooks: deny direct rustfmt, point at cargo fmt --all (#30881)
2a3d0e7d29 resolver: keep forward slashes when imports target is a package specifier (#30845)
4d443e5402 collections: funnel multi_array_list SoA ops through Col/ColMut primitives (#30726)
bb1973e485 build: generate bun_core::build_options from Config (#30749)
314d044c0a JSON lexer: tokenize ?/*/(/) so define auto-quote can recover (#30679)
fe2635b460 ci: replace zig fmt with cargo fmt --all in the format workflow (#30682)
bbd3e624af bun:ffi: extract embedded shared libraries from bunfs in dlopen() (#30720)
428f61eb34 Bun.serve: finish h3/h1 → http3/http1 ServerConfig rename in Rust (#30741)
175f62ab15 ffi: cfg-gate local tcc_delete extern to match bun_tcc_sys (#30743)
952d337946 jsc: gate CallFrame::describe_frame on debug_assertions (#30742)
8093571242 rust: include target_os = "android" in linux-kernel cfg gates (#30735)