What oven-sh/bun shipped
Written by FoxPlug from the repository's own releases; not affiliated with Bun. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/oven-sh/bun; Bun did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Bun v1.4.3 is released and can be installed or upgraded with the usual install and upgrade commands. Release
- A TypeScript type checker is built into Bun, available as bun check, and usable before running, bundling or testing a project. Pull request #44361
- The WebKit fork is upgraded to upstream WebKit dbdca7545d, with 1020 upstream commits since the previous pin, 188 of them in JavaScriptCore, WTF or bmalloc. Pull request #44615
- Every type error in test/ is fixed, so a check of that directory reports none across 2,615 files. Pull request #44614
- The open TLS fixes are consolidated into one change covering both engines, node:tls, node:https, WebSocket and SQL. Pull request #44618
- Fetch sets up TLS once per connection rather than once per request, fixing a panic when a TLS 1.2 server renegotiates on an idle keep-alive connection. Pull request #44507
- Bun.spawnSync no longer points the VM at the loop it waits on, and a child nobody will wait for is ended and reaped. Pull request #44581
- Two build options are added: compiling in --disallow-code-generation-from-strings=strict, and building without WebAssembly. Pull request #44819
- A native byte stream now reports a stored producer error and keeps the taken prefix with the buffer, so fetch bodies, req.body, S3File.stream() and HTMLRewriter output stop ending clean after 0 bytes. Pull request #38003
- A dropped body now releases its string, so fetch, Bun.spawn and the shell stop growing memory when a call ends before it queues a request. Pull request #44892
Why it matters
This week ships a release and lands a type checker inside the project, so checking types no longer needs a separate tool. Alongside it, the bundled WebKit is upgraded and a large batch of TLS, fetch, byte stream and SQL fixes addresses panics, memory growth, wrong rows and empty results that users could hit in production.
Changelog entry
- Release Bun v1.4.3. Release
- Add a TypeScript type checker built into Bun, used as bun check, bun --check, bun build --check and bun test --check. Pull request #44361
- Upgrade the WebKit fork to dbdca7545d, 1020 upstream commits since the previous pin. Pull request #44615
- Fix every type error in test/, so a check of that directory reports none in 2,615 files. Pull request #44614
- Consolidate the open TLS fixes across both engines, node:tls, node:https, WebSocket and SQL. Pull request #44618
- Set up TLS once per fetch connection instead of once per request. Pull request #44507
- Stop Bun.spawnSync pointing the VM at the loop it waits on, and end and reap a child nobody will wait for. Pull request #44581
- Add build options to compile in --disallow-code-generation-from-strings=strict and to build without WebAssembly. Pull request #44819
- Report a stored producer error on a byte stream and keep the taken prefix with the buffer. Pull request #38003
- Make a dropped body release its string so rejected calls with a large body stop growing memory. Pull request #44892
- Close the iterator of new Response(asyncIterable) with return() instead of throwing into it. Pull request #44862
- Give a shared chunk to an entry point whose order breaks no load-time read in --splitting bundles. Pull request #44876
Bun v1.4.3 is out. Type checking is built in: bun check, bun --check, bun build --check and bun test --check. Also upgraded WebKit, consolidated TLS fixes, one TLS setup per fetch connection, and spawnSync no longer points the VM at the loop it waits on.
Bun v1.4.3 is released, and type checking is now built in: bun check checks a project, and bun --check, bun build --check and bun test --check check before running, bundling or testing. This week also upgrades the WebKit fork to dbdca7545d, consolidates the open TLS fixes across both engines and node:tls, node:https, WebSocket and SQL, sets up TLS once per fetch connection instead of once per request, stops Bun.spawnSync pointing the VM at the loop it waits on, and reports stored producer errors on byte streams so fetch bodies and other native streams no longer end clean after zero bytes. Every type error in test/ is fixed, and two build options are added for compiling in strict disallow-code-generation-from-strings and building without WebAssembly.
Week of September 28, 2026
What shipped
- Module specifiers are now resolved once instead of up to three times, fixing a segfault in require() of an ES module and require() with a plugin's namespace. Pull request #44473
- Socket holder notifications are now sent exactly once, fixing a use-after-free that crashed bun test with --isolate or --parallel. Pull request #44327
- On macOS, dns.lookup(), fetch() and sockets now resolve split-DNS names like those behind iCloud Private Relay using DNSServiceQueryRecord. Pull request #44519
- Bun test --coverage-reporter now implies --coverage, so the coverage report is written when the flag is used. Pull request #44469
- A node:tls client now checks the server's name for a handshake that completes after end() is called. Pull request #44290
- CSS build no longer drops live rules with nested rules due to stale duplicate-rule indices. Pull request #41761
- React Fast Refresh no longer panics or produces invalid output for hook calls inside methods. Pull request #44345
- Fixed a segfault that occurred when a module was removed while its import() was in flight. Pull request #35119
Why it matters
This week fixes critical crashes in test isolation, module resolution, and development workflows, plus correctness issues in TLS, DNS, and CSS bundling. The module resolution fix is particularly important as it eliminates a class of segfaults for anyone using plugins or symlinks.
Changelog entry
- Module specifiers are resolved once, fixing segfaults in require() of ES modules and with plugin namespaces Pull request #44473
- Fixed use-after-free in bun test --isolate and --parallel that caused crashes Pull request #44327
- MacOS DNS now resolves split-DNS names via DNSServiceQueryRecord for VPN and Private Relay Pull request #44519
- Bun test --coverage-reporter now implies --coverage to generate reports Pull request #44469
- TLS clients now validate server certificate names for handshakes completing after end() Pull request #44290
- CSS bundler no longer drops live rules with nested rules Pull request #41761
- React Fast Refresh fixed for hook calls in class methods Pull request #44345
- Fixed segfault when modules are removed during import() Pull request #35119
- Bun test asymmetric matchers no longer segfault on missing array elements Pull request #44348
- Bun test no longer stack overflows when printing deeply nested values Pull request #44353
- Dev server fixed for index out of bounds panic with unresolved imports Pull request #44340
- FileSystemRouter fixed for panics with absolute paths containing '..' Pull request #44342
Fixed module resolution segfaults, test isolation crashes, macOS split-DNS, TLS handshakes, and CSS bundling. React Fast Refresh and several io/networking edge cases also addressed.
This week's updates focus on stability and correctness. We fixed critical crashes in module resolution (segfaults with plugins and symlinks), test isolation, and development servers. TLS handshakes now properly validate server names, macOS DNS resolution works with split-DNS configurations, and CSS bundling no longer drops live rules. React Fast Refresh now handles hook calls in methods correctly. These changes address both high-impact crashes and correctness issues in networking, bundling, and testing.
Week of September 21, 2026
What shipped
- Node:http server now follows Node.js behaviour for request body, framing, response finish, and lifecycle. Pull request #43557
- WebKit upgraded to 7b485a76e9, including 970 upstream commits with updates to JavaScriptCore, WTF, and bmalloc. Pull request #43882
- Node:http2 now rate-limits stream resets per connection to prevent rapid reset attacks (CVE-2023-44487, CVE-2025-8671). Pull request #36230
- TLS server name validation now rejects non-hostname values that were previously accepted as certificate names. Pull request #43873
- Bundler splitting fixed to prevent shared chunks from importing entry files and running code twice. Pull request #44023
- Bun.serve now refuses Response bodies that a consumer already reads to prevent stack overflow crashes. Pull request #44014
- Code coverage now counts every load of a file, not only the last one. Pull request #43158
- Windows installations no longer hang when replacing a package whose exe holds the last hard link. Pull request #43864
- S3 tests migrated from MinIO container to an S3 server running on Bun.serve. Pull request #44054
- Process.exit() now throws proper error messages matching Node.js when process.reallyExit is not callable. Pull request #44057
Why it matters
This week ships fixes for node:http and node:http2 server behaviour, critical TLS and security improvements including rate-limiting for rapid reset attacks, and a major WebKit upgrade. Code coverage, bundler splitting, and Windows stability issues are also resolved, making Bun more compatible with Node.js and more secure.
Changelog entry
- Node:http server request body, framing, response finish, and lifecycle now match Node.js behavior Pull request #43557
- WebKit upgraded to 7b485a76e9 with 970 upstream commits Pull request #43882
- Node:http2 now rate-limits stream resets per connection to prevent CVE-2023-44487 and CVE-2025-8671 attacks Pull request #36230
- TLS server name validation now strictly checks hostnames and rejects non-hostname values Pull request #43873
- Bundler splitting fixed: shared chunks no longer import entry files, preventing duplicate code execution Pull request #44023
- Bun.serve now rejects Response bodies already consumed by a reader to prevent stack overflow Pull request #44014
- Code coverage now counts every file load, not just the last one Pull request #43158
- Windows bun install no longer hangs when replacing packages with running executables Pull request #43864
- S3 tests migrated from MinIO container to Bun.serve-based S3 server Pull request #44054
- Process.exit() throws proper error messages matching Node.js when process.reallyExit is not callable Pull request #44057
- IP address parsing now strictly validates format, rejecting partial notation and CIDR notation as hostnames Pull request #43979
- Build now requires clang's LLVM and rustc's LLVM to be the same major version Pull request #44091
Bun ships node:http server fixes, node:http2 rate-limiting for rapid reset attacks, TLS validation improvements, WebKit upgrade, bundler splitting fixes, and better code coverage counting.
This week's Bun release brings significant improvements across multiple areas. The node:http server now follows Node.js behavior more closely for request handling and lifecycle management. Critical security fixes include rate-limiting for node:http2 stream resets (CVE-2023-44487, CVE-2025-8671). TLS server name validation is stricter, rejecting non-hostname values. WebKit upgraded to include 970 upstream commits. Bundler splitting, code coverage, and Windows package installation stability are improved. These changes enhance Node.js compatibility and security.