oven-sh/bun bun-v1.3.12 → bun-v1.3.13

Bun v1.3.13 is a broad stability and compatibility release, with a mix of crash fixes, runtime parity work, and a few bundler and server improvements. The most visible changes are around Node compatibility, WebSocket and fetch behavior, and fixes for bun build --compile on macOS arm64.

What's new

  • SubtleCrypto.deriveBits now works for X25519 keys, using BoringSSL’s X25519 scalar multiplication and matching the expected WebCrypto behavior for full, zero, and shorter output lengths. It also keeps rejecting small-order public keys per RFC 7748. (#29152)
  • WebSocket clients can now connect over Unix domain sockets with ws+unix:// and wss+unix://. The new support covers plain sockets, TLS over a Unix socket, query/path parsing after the socket path, and defaults the Host header to localhost. (#29203)
  • Bun.serve file responses were consolidated into a shared FileResponseStream, and static/file-backed responses now support Range requests. The new flow is shared by routes: entries and file bodies returned from fetch handlers. (#29202)
  • process.ppid is now a live getter instead of a startup snapshot, so it tracks reparenting the same way Node.js does. That makes orphan-detection patterns like process.ppid === 1 work again. (#29171)
  • bun test picked up new splitting and parallelism options, including --changed, --isolate, --parallel, and --shard=M/N, which make it easier to target subsets of a suite in CI and local runs. (#29262, #29354, #29366)

Breaking changes

  • Vendored Rust dependencies are now built with cargo --locked, so transitive crate versions will no longer silently re-resolve against crates.io. If you rely on updating those dependencies, you now need to update the lockfile intentionally. (#29095)
  • The mimalloc v3 upgrade changed several Zig-facing allocation bindings and APIs, including removing older mi_heap_* v1/v2 entry points and splitting the arena vtable paths. A later revert and re-application sequence also landed, so anyone depending on those internal bindings should double-check their usage against the current interfaces. (#29251)
  • bun build --compile on macOS arm64 had a code-signing regression in the previous release. This release sizes __LINKEDIT and LC_CODE_SIGNATURE to the signer’s actual output, which restores launchability for compiled binaries. (#29272)

Fixes

  • Fixed a memory leak in AbortSignal.timeout() when listeners were removed before the timer fired. (#28761)
  • Fixed process.ppid staying frozen after the parent process died. (#29171)
  • Fixed socket.setTimeout() so incoming data resets the idle timer, matching Node’s inactivity semantics. (#29287)
  • Fixed bun build stripping top-level @layer ordering statements from bundled CSS. (#28915)
  • Fixed re-export clauses with string-literal names so files like export { "a b c" } from ... transpile correctly. (#29245)
  • Fixed bun --cpu-prof output so .cpuprofile files match Node/Deno’s Chrome DevTools format. (#29241)
  • Fixed inspect so DOM constructors show their real class name instead of [class Function]. (#29229)
  • Fixed a MySQL multi-statement hang when an OK terminator carried an info string. (#29271)
  • Fixed path.win32.resolve() crashing on UNC plus drive-relative path combinations. (#29318)
  • Fixed a Windows readFile panic on files larger than 2GB. (#29327)
  • Fixed a sliced non-regular-file blob overflow when reading from pipes, fifos, or sockets. (#29284)
  • Fixed AbortSignal leaking on the WebSocket upgrade catch-all path. (#29329)
  • Fixed ResumableSink.cancel() so aborted fetch bodies do not re-enter after completion. (#29330)
  • Fixed bunx @anthropic-ai/claude-code fallback bin linking when the native-dependency redirect target is missing. (#29285)
  • Fixed several Bun.serve static file descriptor leaks on 304, HEAD, and bodiless response paths. (#29185)
  • Fixed MKADDRESSBOOK being dropped by Bun’s HTTP method allowlist. (#28955)
  • Fixed os.freemem() on Linux to use MemAvailable instead of MemFree. (#29080)
  • Fixed tls.connect({ host, port }) to keep hostname verification when servername is omitted. (#29096)
  • Fixed StringDecoder.write() crashing when the decoded result would exceed String::MaxLength. (#29111)
  • Fixed the bundler’s stale HTML import manifest etag so rebuilds now reflect changed imported chunks. (#29233)
  • Fixed bun build --compile asset inlining for standalone HTML so JS-imported file-loader assets are embedded instead of left as broken paths. (#29300)

Other notable changes

  • The WebCore bindings layer was synced with a set of upstream WebKit correctness, safety, and perf fixes. (#29316)
  • Bun also picked up additional WebKit upgrades during the release window. (#29161, #29281, #29294)
  • mimalloc was bumped multiple times during the range, including an upgrade to dev3 and follow-up crasher fixes. (#29251, #29420, #29435)
  • zlib was replaced with zlib-ng 2.3.3. (#29433)
  • bun build --compile got additional Nix/Guix and macOS arm64 fixes along the way. (#29292, #29272)
  • --locked is now passed through to cargo for vendored Rust dependencies. (#29095)

Contributors

@alii @ant-kurt @chrislloyd @cirospaciari @dylan-conway @jarred-sumner @robobun @sosukesuzuki

Only the most active 50 of 89 merged PRs were included. See the full compare view.

View on GitHub →