Commit Graph

8712 Commits

Author SHA1 Message Date
Zack Radisic
68dd113bc5 this got removed by accident 2025-10-01 01:54:59 -07:00
Zack Radisic
6d4600ec63 okie dokie 2025-10-01 01:38:44 -07:00
Zack Radisic
4b4bc80715 forgot to deinit 2025-10-01 01:38:30 -07:00
taylor.fish
eac82e2184 Fix memory.deinit; handle more types (#23032)
* Fix `memory.deinit`; the previous PR erroneously added non-comptime
code in a comptime expression, which would result in a compile error
when trying to deinit an optional
* Handle arrays (distinct from slices)
* Handle error unions
* Disallow untagged unions, as this is probably an error; usually a
manual deinit impl is needed if untagged unions are involved
* Make switch exhaustive so we know we're not missing other types
(thanks @pfgithub)

(For internal tracking: fixes STAB-1295)
2025-09-30 16:14:55 -07:00
Marko Vejnovic
dac1ee73c6 fix: Ordering Semantics (#23144)
Co-authored-by: taylor.fish <contact@taylor.fish>
2025-09-30 16:13:23 -07:00
Ciro Spaciari
b88cecfe66 fix(redis) refactor valkey connection status and lifecycle handling (#23141)
### What does this PR do?
Status should reflect connect status now, making sure that js value is
alive long enough, redis still needs a refactor followup.
### How did you verify your code works?
Run valkey.test.ts duplicate tests 1k times
2025-09-30 13:32:03 -07:00
Alistair Smith
b613790451 Many more Redis commands (#23116) 2025-09-30 13:27:25 -07:00
Ciro Spaciari
5fe3e3774c fix(Bun.SQL) fix IN, UPDATE support in helpers, and fix JSONB/JSON serialization (#22700)
### What does this PR do?
Fixes https://github.com/oven-sh/bun/issues/20669
Fixes https://github.com/oven-sh/bun/issues/18775
Fixes https://github.com/oven-sh/bun/issues/22156
Fixes https://github.com/oven-sh/bun/issues/22164
Fixes https://github.com/oven-sh/bun/issues/18254
Fixes https://github.com/oven-sh/bun/issues/21267
Fixes https://github.com/oven-sh/bun/issues/20669
Fixes https://github.com/oven-sh/bun/issues/1317
Fixes https://github.com/oven-sh/bun/pull/22700
Partially Fixes https://github.com/oven-sh/bun/issues/22757 (sqlite
pending, need a followup and probably @alii help here)
### How did you verify your code works?
Tests

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2025-09-30 13:26:15 -07:00
robobun
c5005a37d7 Fix --tolerate-republish flag in bun publish (continues PR #22107) (#22381)
## Summary
This PR continues the work from #22107 to fix the `--tolerate-republish`
flag implementation in `bun publish`.

### Changes:
- **Pre-check version existence**: Before attempting to publish with
`--tolerate-republish`, check if the version already exists on the
registry
- **Improved version checking**: Use GET request to package endpoint
instead of HEAD, then parse JSON response to check if specific version
exists
- **Correct output stream**: Output warning to stderr instead of stdout
for consistency with test expectations
- **Better error handling**: Update test to accept both 403 and 409 HTTP
error codes for duplicate publish attempts

### Test fixes:
The tests were failing because:
1. The mock registry returns 409 Conflict (not 403) for duplicate
packages
2. The warning message wasn't appearing in stderr as expected
3. The version check was using HEAD request which doesn't reliably
return version info

## Test plan
- [x] Fixed failing tests for `--tolerate-republish` functionality
- [x] Tests now properly handle both 403 and 409 error responses
- [x] Warning messages appear correctly in stderr

🤖 Generated with [Claude Code](https://claude.ai/code)

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Dylan Conway <dylan.conway567@gmail.com>
2025-09-30 13:25:50 -07:00
Zack Radisic
a89e61fcaa ssg 3 (#22138)
### What does this PR do?

Fixes a crash related to the dev server overwriting the uws user context
pointer when setting abort callback.

Adds support for `return new Response(<jsx />, { ... })` and `return
Response.render(...)` and `return Response.redirect(...)`:
- Created a `SSRResponse` class to handle this (see
`JSBakeResponse.{h,cpp}`)
- `SSRResponse` is designed to "fake" being a React component 
- This is done in JSBakeResponse::create inside of
src/bun.js/bindings/JSBakeResponse.cpp
- And `src/js/builtins/BakeSSRResponse.ts` defines a `wrapComponent`
function which wraps
the passed in component (when doing `new Response(<jsx />, ...)`). It
does
    this to throw an error (in redirect()/render() case) or return the
    component.
- Created a `BakeAdditionsToGlobal` struct which contains some
properties
    needed for this
- Added some of the properties we need to fake to BunBuiltinNames.h
(e.g.
    `$$typeof`), the rationale behind this is that we couldn't use
`structure->addPropertyTransition` because JSBakeResponse is not a final
    JSObject.
- When bake and server-side, bundler rewrites `Response ->
Bun.SSRResponse` (see `src/ast/P.zig` and `src/ast/visitExpr.zig`)
- Created a new WebCore body variant (`Render: struct { path: []const u8
}`)
  - Created when `return Response.render(...)`
  - When handled, it re-invokes dev server to render the new path

Enables server-side sourcemaps for the dev server:
- New source providers for server-side:
(`DevServerSourceProvider.{h,cpp}`)
- IncrementalGraph and SourceMapStore are updated to support this

There are numerous other stuff:
- allow `app` configuration from Bun.serve(...)
- fix errors stopping dev server
- fix use after free related to in
RequestContext.finishRunningErrorHandler
- Request.cookies
- Make `"use client";` components work
- Fix some bugs using `require(...)` in dev server
- Fix catch-all routes not working in the dev server
- Updates `findSourceMappingURL(...)` to use `std.mem.lastIndexOf(...)`
because
  the sourcemap that should be used is the last one anyway

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Alistair Smith <hi@alistair.sh>
2025-09-30 05:26:32 -07:00
robobun
2b7fc18092 fix(lint): resolve no-unused-expressions errors (#23127)
## Summary

Fixes all oxlint `no-unused-expressions` violations across the codebase
by:
- Adding an oxlint override to disable the rule for
`src/js/builtins/**`, where special syntax markers like `$getter`,
`$constructor`, etc. are intentionally used as standalone expressions
- Converting short-circuit expressions (`condition && fn()`) to proper
if statements for improved code clarity
- Wrapping intentional property access side effects (e.g.,
`this.stdio;`, `err.stack;`) with the `void` operator
- Converting ternary expressions used for control flow to if/else
statements

## Test plan

- [x] `bun lint` passes with no errors

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2025-09-30 04:45:34 -07:00
Dylan Conway
25e156c95b fix(pnpm migration): correctly resolve link: dependencies on the root package (#23111)
### What does this PR do?
Two things:
- we weren't adding the root package to the `pkg_map`.
- `link:` dependency paths in `"snapshots"` weren't being joined with
the top level dir.
### How did you verify your code works?
Manually and added a test.
2025-09-30 00:10:15 -07:00
robobun
621066d0c4 Fix crash in toContainAnyKeys and toContainKeys with non-object values (#22977)
## Summary
- Fixed segmentation fault when calling `toContainAnyKeys`,
`toContainKeys`, and `toContainAllKeys` on non-object values (null,
undefined, numbers, strings, etc.)
- Added proper validation to check if value is an object before calling
`hasOwnPropertyValue` or `keys()`
- Added comprehensive test coverage for edge cases

## Problem
The matchers were crashing with a segmentation fault when called with
non-object values because:

1. `toContainAnyKeys` and `toContainKeys` were calling
`hasOwnPropertyValue` without checking if the value is an object first
2. `toContainAllKeys` was calling `keys()` without checking if the value
is an object first
3. The `hasOwnPropertyValue` function documentation explicitly states:
"If the object is not an object, it will crash. **You must check if the
object is an object before calling this function.**"

## Solution
- Added `value.isObject()` check in `toContainAnyKeys` before attempting
to check for properties
- Fixed `toContainKeys` by replacing the `toBoolean()` check with
`isObject()` check
- Fixed `toContainAllKeys` by adding proper object validation before
calling `keys()`
- For non-objects with empty expected arrays, the matchers return true
(matching jest-extended behavior)

## Test plan
- [x] Added comprehensive test coverage in
`test/js/bun/test/expect.test.js`
- [x] Tests cover: null, undefined, numbers, strings, booleans, symbols,
BigInt, arrays, functions
- [x] All existing jest-extended tests continue to pass
- [x] Debug build compiles and all tests pass

🤖 Generated with [Claude Code](https://claude.ai/code)

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Dylan Conway <dylan.conway567@gmail.com>
2025-09-29 16:10:56 -07:00
Meghan Denny
51a05ae2e3 safety: a few more exception validation fixes (#23038) 2025-09-29 15:27:52 -07:00
Dylan Conway
52629145ca fix(parser): TSX arrow function bugfix (#23082)
### What does this PR do?
Missing `.t_equals` and `.t_slash` checks. This matches esbuild.

```go
// Returns true if the current less-than token is considered to be an arrow
// function under TypeScript's rules for files containing JSX syntax
func (p *parser) isTSArrowFnJSX() (isTSArrowFn bool) {
	oldLexer := p.lexer
	p.lexer.Next()

	// Look ahead to see if this should be an arrow function instead
	if p.lexer.Token == js_lexer.TConst {
		p.lexer.Next()
	}
	if p.lexer.Token == js_lexer.TIdentifier {
		p.lexer.Next()
		if p.lexer.Token == js_lexer.TComma || p.lexer.Token == js_lexer.TEquals {
			isTSArrowFn = true
		} else if p.lexer.Token == js_lexer.TExtends {
			p.lexer.Next()
			isTSArrowFn = p.lexer.Token != js_lexer.TEquals && p.lexer.Token != js_lexer.TGreaterThan && p.lexer.Token != js_lexer.TSlash
		}
	}

	// Restore the lexer
	p.lexer = oldLexer
	return
}
```

fixes #19697
### How did you verify your code works?
Added some tests.
2025-09-29 05:10:16 -07:00
Dylan Conway
f4218ed40b fix(parser): possible crash with --minify-syntax and string -> dot conversions (#23078)
### What does this PR do?
Fixes code like `[(()=>{})()][''+'c']`.

We were calling `visitExpr` on a node that was already visited. This
code doesn't exist in esbuild, but we should keep it because it's an
optimization.

fixes #18629
fixes #15926

### How did you verify your code works?
Manually and added a test.
2025-09-29 04:20:57 -07:00
Dylan Conway
9c75db45fa fix(parser): scope mismatch bug from parseSuffix (#23073)
### What does this PR do?
esbuild returns `left` from the inner loop. This PR matches this
behavior. Before it was breaking out of the inner loop and continuing
through the outer loop, potentially parsing too far.

fixes #22013
fixes #22384

### How did you verify your code works?
Added some tests.

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2025-09-29 03:03:18 -07:00
Dylan Conway
f6e722b594 fix(glob): fix index out of bounds in GlobWalker (#23055)
### What does this PR do?
Given pattern input "../." we might collapse all path components.
### How did you verify your code works?
Manually and added a test.

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
2025-09-29 02:21:13 -07:00
Ciro Spaciari
cf1367137d feat(sql.array) add support to sql.array (#22946)
### What does this PR do?
Fixes https://github.com/oven-sh/bun/issues/17030 
In this case should work as expected just passing a normal array should
be serialized as JSON/JSONB

Fixes https://github.com/oven-sh/bun/issues/17798
Insert and update helpers should work as expected here when using
sql.array helper:

```sql
CREATE TABLE user (
    id SERIAL PRIMARY KEY,
    name VARCHAR NOT NULL,
    roles TEXT[]
);
```

```js
const item = { id: 1, name: "test", role: sql.array(['a', 'b'], "TEXT") };
await sql`
  UPDATE user
  SET ${sql(item)}
  WHERE id = 1
`;
```
Fixes https://github.com/oven-sh/bun/issues/22281
Should work using  sql.array(array, "TEXT")

Fixes https://github.com/oven-sh/bun/issues/22165
Fixes https://github.com/oven-sh/bun/issues/22155
Add sql.array(array, typeNameOrTypeID) in Bun.SQL
(https://github.com/oven-sh/bun/issues/15088)

### How did you verify your code works?
Tests

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2025-09-27 01:12:29 -07:00
robobun
5a12175cb0 Fix V8StackTraceIterator to handle frames without parentheses (#23034)
## Summary
- Fixes V8StackTraceIterator terminating early when encountering stack
frames without parentheses (e.g., "at unknown")
- Ensures complete stack traces are shown by `Bun.inspect()` even after
`error.stack` property is accessed
- Addresses the root cause that PR #23022 was working around

## Problem
When the V8StackTraceIterator encountered a stack frame line without
parentheses (like `at unknown`), it would:
1. Set `offset = stack.length()` 
2. Return `false`, terminating the entire iteration
3. Only parse frames before the "unknown" frame

This caused `Bun.inspect()` to show incomplete stack traces after the
`error.stack` property was accessed, as documented in issue discussions
around PR #23022.

## Solution
Changed the parser to continue iterating through subsequent frames
instead of terminating. Frames without parentheses are now treated as
having a source URL but no function name or location info.

## Test plan
- [x] Added regression test
`test/regression/issue/23022-stack-trace-iterator.test.ts`
- [x] Verified existing stack trace tests still pass
- [x] Manually tested with Node.js stream errors that trigger this code
path

### Before fix:
```
error: Socket is closed
 code: "ERR_SOCKET_CLOSED"

      at node:net:1322:32
```

### After fix:
```
error: Socket is closed
 code: "ERR_SOCKET_CLOSED"

      at unknown:1:1
      at _write (node:net:1322:32)
      at writeOrBuffer (internal:streams/writable:381:18)
      at internal:streams/writable:334:16
      at testStackTrace (/workspace/bun/test.js:8:10)
      ...
```

🤖 Generated with [Claude Code](https://claude.ai/code)

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2025-09-27 00:55:54 -07:00
Michael H
ba20670da3 implement pnpm migration (#22262)
### What does this PR do?

fixes #7157, fixes #14662

migrates pnpm-workspace.yaml data to package.json & converts
pnpm-lock.yml to bun.lock

---

### How did you verify your code works?

manually, tests and real world examples

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Dylan Conway <dylan.conway567@gmail.com>
2025-09-27 00:45:29 -07:00
taylor.fish
73feb108d9 Handle optionals in bun.memory.deinit (#23027)
Currently, if you try to deinit an optional, `bun.memory.deinit` will
silently do nothing, even if the optional's payload is a struct with a
`deinit` method.

This commit makes sure the payload is deinitialized.

(For internal tracking: fixes STAB-1293)
2025-09-26 23:02:44 -07:00
Marko Vejnovic
5179dad481 hotfix(redis): Automatically connect on .subscribe() (#23018)
### What does this PR do?

Previously `redis.subscribe` did not automatically connect, which was in
contrast to other Redis functions. This PR changes the necessary
`PUB/SUB` things so that `.subscribe` automatically connects.

### How did you verify your code works?

Didn't

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2025-09-26 22:43:23 -07:00
Meghan Denny
97f6adf767 revert this change made to ShellRmTask.DirTask (#23028)
it caused deploying the site to hang and `ref.ref(` isnt threadsafe. the
proper fix should latch onto the shell command instead of the generic
task queue
2025-09-26 22:23:06 -07:00
Dylan Conway
8102e80f88 fix(build): Promise.all() async module dependencies (#22704)
### What does this PR do?
Currently bundling and running projects with cyclic async module
dependencies will hang due to module promises never resolving. This PR
unblocks these projects by outputting `await Promise.all` with these
dependencies.

Before (will hang with bun, or error with unsettled top level await with
node):
```js
var __esm = (fn, res) => () => (fn && (res = fn((fn = 0))), res);

var init_mod3 = __esm(async () => {
  await init_mod1();
});

var init_mod2 = __esm(async () => {
  await init_mod1();
});

var init_mod1 = __esm(async () => {
  await init_mod2();
  await init_mod3();
});

await init_mod1();
```

After:
```js
var __esm = (fn, res) => () => (fn && (res = fn((fn = 0))), res);
var __promiseAll = Promise.all.bind(Promise);

var init_mod3 = __esm(async () => {
  await init_mod1();
});

var init_mod2 = __esm(async () => {
  await init_mod1();
});

var init_mod1 = __esm(async () => {
  await __promiseAll([init_mod2(), init_mod3()]);
});

await init_mod1();
```

### How did you verify your code works?
Manually and tests

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Jarred Sumner <jarred@jarredsumner.com>
2025-09-26 22:21:00 -07:00
taylor.fish
ed72eff2a9 bun.ptr.Shared: fix dependency loop and add leak/adopt methods (#23024)
Fixes STAB-1292
2025-09-26 19:46:50 -07:00
Meghan Denny
da0babebd2 node:http2: fix leak in H2FrameParser (#22997) 2025-09-26 19:20:44 -07:00
Jarred Sumner
733e7f6165 Fix fetch-preconnect test failure (#23016)
### What does this PR do?

### How did you verify your code works?
2025-09-26 19:01:01 -07:00
Ciro Spaciari
d3ce459f0e fix(valkey/redis) fix tls (includes pub/sub) (#22981)
### What does this PR do?
Fix tls property not being properly set
Fixes https://github.com/oven-sh/bun/issues/22186
### How did you verify your code works?
Tests + Manually test with upstash using `rediss` protocol and tls: true
options

---------

Co-authored-by: Marko Vejnovic <marko.vejnovic@hotmail.com>
Co-authored-by: Marko Vejnovic <marko@bun.com>
Co-authored-by: Jarred Sumner <jarred@jarredsumner.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2025-09-26 18:57:06 -07:00
pfg
e14e42b402 fix lint (#23019)
Format action was failing
2025-09-26 18:05:01 -07:00
taylor.fish
eb04e4e640 Make bun.webcore.Blob smaller and ref-counted (#23015)
Reduce the size of `bun.webcore.Blob` from 120 bytes to 96. Also make it
ref-counted: in-progress work on improving the bindings generator
depends on this, as it means C++ can pass a pointer to the `Blob` to Zig
without risking it being destroyed if the GC collects the associated
`JSBlob`.

Note that this PR depends on #23013.

(For internal tracking: fixes STAB-1289, STAB-1290)
2025-09-26 17:18:30 -07:00
pfg
250d30eb7d Concurrent limit --max-concurrency, defaults to 20 (#22944)
### What does this PR do?

Adds a max-concurrency flag to limit the amount of concurrent tests that
run at once. Defaults to 20. Jest and Vitest both default to 5.

### How did you verify your code works?

Tests

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Jarred Sumner <jarred@jarredsumner.com>
2025-09-26 16:39:08 -07:00
taylor.fish
c58d2e3911 Add generic-allocator ArrayList (#22917)
Add a version of `ArrayList` that takes a generic `Allocator` type
parameter. This matches the interface of smart pointers like
`bun.ptr.Owned` and `bun.ptr.Shared`.

This type behaves like a managed `ArrayList` but has no overhead if
`Allocator` is a zero-sized type, like `bun.DefaultAllocator`.

(For internal tracking: fixes STAB-1267)

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2025-09-26 15:19:45 -07:00
taylor.fish
266fca2e5c Add ExternalShared and RawRefCount (#23013)
Add `bun.ptr.ExternalShared`, a shared pointer whose reference count is
managed externally; e.g., by extern functions. This can be used to work
with `RefCounted` C++ objects in Zig. For example:

```cpp
// C++:
struct MyType : RefCounted<MyType> { ... };
extern "C" void MyType__ref(MyType* self) { self->ref(); }
extern "C" void MyType__ref(MyType* self) { self->deref(); }
```

```zig
// Zig:
const MyType = opaque {
    extern fn MyType__ref(self: *MyType) void;
    extern fn MyType__deref(self: *MyType) void;

    pub const Ref = bun.ptr.ExternalShared(MyType);

    // This enables `ExternalShared` to work.
    pub const external_shared_descriptor = struct {
        pub const ref = MyType__ref;
        pub const deref = MyType__deref;
    };
};

// Now `MyType.Ref` behaves just like `Ref<MyType>` in C++:
var some_ref: MyType.Ref = someFunctionReturningMyTypeRef();
const ptr: *MyType = some_ref.get(); // gets the inner pointer
var some_other_ref = some_ref.clone(); // increments the ref count
some_ref.deinit(); // decrements the ref count
// decrements the ref count again; if no other refs exist, the object
// is destroyed
some_other_ref.deinit();
```

This commit also adds `RawRefCount`, a simple wrapper around an integer
reference count that can be used to implement the interface required by
`ExternalShared`. Generally, for reference-counted Zig types,
`bun.ptr.Shared` is preferred, but occasionally it is useful to have an
“intrusive” reference-counted type where the ref count is stored in the
type itself. For this purpose, `ExternalShared` + `RawRefCount` is more
flexible and less error-prone than the deprecated `bun.ptr.RefCounted`
type.

(For internal tracking: fixes STAB-1287, STAB-1288)
2025-09-26 15:15:58 -07:00
pfg
9d01a7b91a Require deinit function for memory.deinit() (#22923)
Co-authored-by: taylor.fish <contact@taylor.fish>
2025-09-26 13:47:24 -07:00
robobun
a329da97f4 Fix server stability issue with oversized requests (#22701)
## Summary
Improves server stability when handling certain request edge cases.

## Test plan
- Added regression test in `test/regression/issue/22353.test.ts`
- Test verifies server continues operating normally after handling edge
case requests
- All existing HTTP server tests pass

Fixes #22353

🤖 Generated with [Claude Code](https://claude.ai/code)

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Jarred Sumner <jarred@jarredsumner.com>
2025-09-26 04:59:07 -07:00
Filip Stevanovic
f45900d7e6 fix(fetch): print request body for application/x-www-form-urlencoded in curl logs (#22849)
### What does this PR do?

fixes an issue where fetch requests with `Content-Type:
application/x-www-form-urlencoded` would not include the request body in
curl logs when `BUN_CONFIG_VERBOSE_FETCH=curl` is enabled

previously, only JSON and text-based content types were recognized as
safe-to-print in the curl formatter. This change updates the allow-list
to also handle `application/x-www-form-urlencoded`, ensuring bodies for
common form submissions are shown in logs

### How did you verify your code works?

- added `Content-Type: application/x-www-form-urlencoded` to a fetch
request and confirmed that `BUN_CONFIG_VERBOSE_FETCH=curl` now outputs a
`--data-raw` section with the encoded body
- verified the fix against the reproduction script provided in issue
#12042
 - created and ran a regression test
- checked that existing content types (JSON, text, etc.) continue to
print correctly

fixes #12042
2025-09-26 03:54:41 -07:00
Jarred Sumner
00490199f1 bun feedback (#22710)
### What does this PR do?

### How did you verify your code works?

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2025-09-26 03:47:26 -07:00
Marko Vejnovic
17b503b389 Redis PUB/SUB 2.0 (#22568)
### What does this PR do?

**This PR is created because [the previous PR I
opened](https://github.com/oven-sh/bun/pull/21728) had some concerning
issues.** Thanks @Jarred-Sumner for the help.

The goal of this PR is to introduce PUB/SUB functionality to the
built-in Redis client. Based on the fact that the current Redis API does
not appear to have compatibility with `io-redis` or `redis-node`, I've
decided to do away with existing APIs and API compatibility with these
existing libraries.

I have decided to base my implementation on the [`redis-node` pub/sub
API](https://github.com/redis/node-redis/blob/master/docs/pub-sub.md).

#### Random Things That Happened

- [x] Refactored the build scripts so that `valgrind` can be disabled.
- [x] Added a `numeric` namespace in `harness.ts` with useful
mathematical libraries.
- [x] Added a mechanism in `cppbind.ts` to disable static assertions
(specifically to allow `check_slow` even when returning a `JSValue`).
Implemented via `// NOLINT[NEXTLINE]?\(.*\)` macros.
- [x] Fixed inconsistencies in error handling of `JSMap`.

### How did you verify your code works?

I've written a set of unit tests to hopefully catch the major use-cases
of this feature. They all appear to pass.


#### Future Improvements

I would have a lot more confidence in our Redis implementation if we
tested it with a test suite running over a network which emulates a high
network failure rate. There are large amounts of edge cases that are
worthwhile to grab, but I think we can roll that out in a future PR.

### Future Tasks

- [ ] Tests over flaky network
- [ ] Use the custom private members over `_<member>`.

---------

Co-authored-by: Jarred Sumner <jarred@jarredsumner.com>
2025-09-26 03:06:18 -07:00
Jarred Sumner
ea735c341f Bump WebKit (#22957)
### What does this PR do?

### How did you verify your code works?

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2025-09-26 01:46:26 -07:00
Jarred Sumner
064ecc37fd Move Bun__JSRequest__calculateEstimatedByteSize earlier (#22993)
### What does this PR do?

### How did you verify your code works?
2025-09-26 00:33:30 -07:00
robobun
5457d76bcb Fix double-free in createArgv function (#22978)
## Summary
- Fixed a double-free bug in the `createArgv` function in
`node_process.zig`

## Details
The `createArgv` function had two `defer allocator.free(args)`
statements:
- One on line 164 
- Another on line 192 (now removed)

This would cause the same memory to be freed twice when the function
returned, leading to undefined behavior.

Fixes #22975

## Test plan
The existing process.argv tests should continue to pass with this fix.

🤖 Generated with [Claude Code](https://claude.ai/code)

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Dylan Conway <dylan.conway567@gmail.com>
Co-authored-by: Jarred Sumner <jarred@jarredsumner.com>
2025-09-25 23:52:56 -07:00
pfg
c4519c7552 Add --randomize --seed flag (#22987)
Outputs the seed when randomizing. Adds --seed flag to reproduce a
random order. Seeds might not produce the same order across operating
systems / bun versions.

Fixes #11847

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2025-09-25 23:47:46 -07:00
Jarred Sumner
656747bcf1 Fix vm destruction assertion failure in udp socket, reduce usage of protect() (#22986)
### What does this PR do?

### How did you verify your code works?

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2025-09-25 22:41:02 -07:00
Jarred Sumner
2039ab182d Remove stale path assertion on Windows (#22988)
### What does this PR do?

This assertion is occasionally incorrect, and was originally added as a
workaround for lack of proper error handling in zig's std library. We've
seen fixed that so this assertion is no longer needed.

### How did you verify your code works?

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2025-09-25 22:34:49 -07:00
Meghan Denny
5a709a2dbf node:tty: use terminal VT mode on Windows (#21161)
mirrors: https://github.com/nodejs/node/pull/58358
2025-09-25 19:58:44 -07:00
Meghan Denny
51ce3bc269 [publish images] ci: ensure tests that require docker have it available (#22781) 2025-09-25 19:03:22 -07:00
robobun
d3061de1bf feat(windows): implement authenticode stripping for --compile (#22960)
## Summary

Implements authenticode signature stripping for Windows PE files when
using `bun build --compile`, ensuring that generated executables can be
properly signed with external tools after Bun embeds its data section.

## What Changed

### Core Implementation
- **Authenticode stripping**: Removes digital signatures from PE files
before adding the .bun section
- **Safe memory access**: Replaced all `@alignCast` operations with safe
unaligned access helpers to prevent crashes
- **Hardened PE parsing**: Added comprehensive bounds checking and
validation throughout
- **PE checksum recalculation**: Properly updates checksums after
modifications

### Key Features
- Always strips authenticode signatures when using `--compile` for
Windows (uses `.strip_always` mode)
- Validates PE file structure according to PE/COFF specification
- Handles overlapping memory regions safely during certificate removal
- Clears `IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY` flag when stripping
signatures
- Ensures no unexpected overlay data remains after stripping

### Bug Fixes
- Fixed memory corruption bug using `copyBackwards` for overlapping
regions
- Fixed checksum calculation skipping 6 bytes instead of 4
- Added integer overflow protection in payload size calculations
- Fixed double alignment bug in `size_of_image` calculation

## Technical Details

The implementation follows the Windows PE/COFF specification and
includes:

- `StripMode` enum to control when signatures are stripped
(none/strip_if_signed/strip_always)
- Safe unaligned memory access helpers (`viewAtConst`, `viewAtMut`)
- Proper alignment helpers with overflow protection (`alignUpU32`,
`alignUpUsize`)
- Comprehensive error types for all failure cases

## Testing

- Passes all existing PE tests in
`test/regression/issue/pe-codesigning-integrity.test.ts`
- Compiles successfully with `bun run zig:check-windows`
- Properly integrated with StandaloneModuleGraph for Windows compilation

## Impact

This ensures Windows users can:
1. Use `bun build --compile` to create standalone executables
2. Sign the resulting executables with their own certificates
3. Distribute properly signed Windows binaries

Fixes issues where previously signed executables would have invalid
signatures after Bun added its embedded data.

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Jarred Sumner <jarred@jarredsumner.com>
2025-09-25 18:03:27 -07:00
Jarred Sumner
4dfd87a302 Fix aborting fetch() calls while the socket is connecting. Fix a thread-safety issue involving redirects and AbortSignal. (#22842)
### What does this PR do?

When we added "happy eyeballs" support to fetch(), it meant that
`onOpen` would not be called potentially for awhile. If the AbortSignal
is aborted between `connect()` and the socket becoming
readable/writable, then we would delay closing the connection until the
connection opens. Fixing that fixes #18536.

Separately, the `isHTTPS()` function used in abort and in request body
streams was not thread safe. This caused a crash when many redirects
happen simultaneously while either AbortSignal or request body messages
are in-flight.
This PR fixes https://github.com/oven-sh/bun/issues/14137



### How did you verify your code works?

There are tests

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Ciro Spaciari <ciro.spaciari@gmail.com>
2025-09-25 16:08:06 -07:00
Meghan Denny
20854fb285 node:crypto: add blake2s256 hasher (#22958) 2025-09-25 15:28:42 -07:00