Claude Bot b98e287260 fix(fetch): respect --max-http-header-size for response headers ...

The --max-http-header-size CLI flag was only being enforced for
server-side request headers but not for client-side response headers
in fetch(). This adds validation to reject responses with headers
larger than the configured limit.

Fixes #20488

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2026-01-27 07:14:35 +00:00

..

allocators

Mimalloc v3 update (#26379)

2026-01-23 00:10:48 -08:00

analytics

…

api

feat(bundler): add statically-analyzable dead-code elimination via feature flags (#25462)

2025-12-11 17:44:14 -08:00

ast

feat(transpiler): add replMode option for REPL transforms (#26246)

2026-01-21 13:39:25 -08:00

async

feat: add Bun.Terminal API for pseudo-terminal (PTY) support (#25415)

2025-12-15 12:51:13 -08:00

bake

Revert 0c3b5e501b

2026-01-23 11:02:26 -08:00

base64

…

bun.js

fix(bundler): throw error when Bun.build is called from macro during bundling (#26361)

2026-01-23 20:24:12 -08:00

bundler

Revert 0c3b5e501b

2026-01-23 11:02:26 -08:00

cli

Revert 0c3b5e501b

2026-01-23 11:02:26 -08:00

codegen

Upgrade WebKit to ea1bfb85d259 (#26161)

2026-01-16 18:46:48 -08:00

collections

fix(bundler): fix out-of-bounds access in DynamicBitSetUnmanaged.bytes() (#26283)

2026-01-19 22:45:56 -08:00

create

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

css

fix(css): preserve logical border-radius properties (#26006)

2026-01-14 13:34:31 -08:00

deps

feat(unicode): migrate grapheme breaking to uucode with GB9c support (#26376)

2026-01-23 00:07:06 -08:00

errno

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

fs

…

glob

fix: handle DT_UNKNOWN in dir_iterator for bind-mounted filesystems (#25838)

2026-01-22 13:44:49 -08:00

http

fix(websocket): forward URL credentials as Authorization header (#26278)

2026-01-19 17:04:44 -08:00

init

fix(init): resolve TypeScript errors in react-tailwind template build.ts (#26258)

2026-01-19 17:12:42 -08:00

install

fix(install): show dependency name when file: path resolution fails (#26340)

2026-01-21 18:41:15 -08:00

interchange

fix(json): prevent stack overflow in JSONC parser on deeply nested input (#26174)

2026-01-16 16:23:01 -08:00

io

fix(process): emit EPIPE error on broken pipe for process.stdout.write() (#26124)

2026-01-14 18:37:54 -08:00

js

fix(readline): use symbol key for _refreshLine in tab completer (#26412)

2026-01-24 15:37:29 -08:00

js_lexer

…

libarchive

fix(install): prevent symlink path traversal in tarball extraction (#25584)

2026-01-09 16:56:31 -08:00

meta

…

napi

fix(bindings): handle errors from String.toJS() for oversized strings (#26213)

2026-01-21 13:01:25 -08:00

node-fallbacks

ENG-21534: Satisfy aikido (#24880)

2025-11-24 20:16:03 -08:00

paths

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

ptr

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

resolver

add test for dependency order when a package's name is larger than 8 characters + fix (#25697)

2025-12-25 23:49:23 -08:00

s3

feat(s3): add Content-Encoding header support for S3 uploads (#26149)

2026-01-15 18:09:33 -08:00

safety

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

semver

remove jsc.createCallback (#24910)

2025-11-20 20:56:02 -08:00

shell

fix(shell): prevent double-free of ShellArgs in error path (#26277)

2026-01-19 15:24:57 -08:00

sourcemap

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

sql

fix(bindings): handle errors from String.toJS() for oversized strings (#26213)

2026-01-21 13:01:25 -08:00

string

feat(unicode): migrate grapheme breaking to uucode with GB9c support (#26376)

2026-01-23 00:07:06 -08:00

sys

fix(bindings): handle errors from String.toJS() for oversized strings (#26213)

2026-01-21 13:01:25 -08:00

test

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

threading

perf: shrink ConcurrentTask from 24 bytes to 16 bytes (#25636)

2025-12-22 12:07:24 -08:00

unicode/uucode

feat(unicode): migrate grapheme breaking to uucode with GB9c support (#26376)

2026-01-23 00:07:06 -08:00

valkey

fix(bindings): handle errors from String.toJS() for oversized strings (#26213)

2026-01-21 13:01:25 -08:00

vm

Upgrade WebKit Dec 24, 2025 (#25684)

2025-12-25 14:00:58 -08:00

watcher

fix(fs.watch): emit 'change' events for files in watched directories on Linux (#26009)

2026-01-14 16:46:20 -08:00

windows

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

.clang-format

…

AGENTS.md

…

allocators.zig

fix(http2): fix settings, window size handling, and dynamic header buffer allocation (#26119)

2026-01-22 14:35:18 -08:00

analytics.zig

Add analytics tracking for CPU profiling and heap snapshots (#25053)

2025-11-26 00:02:43 -08:00

asan-config.c

misc tidyings from another branch (#24406)

2025-11-05 15:28:28 -08:00

asan.zig

…

ast.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

bake.bind.ts

…

bake.zig

feat(ENG-21362): Environment Variables Store (#23930)

2025-10-23 23:08:08 -07:00

bits.zig

…

boringssl.zig

Harden TLS hostname verification (#25727)

2026-01-05 10:21:49 -08:00

brotli.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

btjs.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

bun.exe.manifest

…

bun.ico

…

bun.js.zig

fix(compile): apply BUN_OPTIONS env var to standalone executables (#26346)

2026-01-23 00:24:18 -08:00

bun.zig

fix(compile): apply BUN_OPTIONS env var to standalone executables (#26346)

2026-01-23 00:24:18 -08:00

bunfig.zig

update minimumReleaseAge (#25057)

2025-11-25 11:06:24 -08:00

c-headers-for-zig.h

…

cache.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

ci_info.zig

Update ci_info with more CI detection (#23708)

2025-11-10 19:58:02 -08:00

CLAUDE.md

Update CLAUDE.md

2026-01-07 12:33:21 -08:00

cli.zig

fix(compile): apply BUN_OPTIONS env var to standalone executables (#26346)

2026-01-23 00:24:18 -08:00

collections.zig

…

compile_target.zig

feat(windows): Add Windows ARM64 support (#26215)

2026-01-22 04:22:45 -08:00

comptime_string_map.zig

feat(ENG-21324): Implement hosted_git_info.zig (#24138)

2025-10-29 19:29:04 -07:00

ConfigVersion.zig

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

copy_file.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

crash_handler.zig

feat(windows): Add Windows ARM64 support (#26215)

2026-01-22 04:22:45 -08:00

csrf.zig

remove jsc.createCallback (#24910)

2025-11-20 20:56:02 -08:00

darwin.zig

…

defines-table.zig

…

defines.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

deprecated.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

dir.zig

…

dns.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

env_loader.zig

fix(http): respect port numbers in NO_PROXY environment variable (#26347)

2026-01-23 20:21:57 -08:00

env_var.zig

fix(compile): apply BUN_OPTIONS env var to standalone executables (#26346)

2026-01-23 00:24:18 -08:00

env.zig

feat(windows): Add Windows ARM64 support (#26215)

2026-01-22 04:22:45 -08:00

fallback-backend.html

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

fallback.html

…

fallback.ts

…

favicon.png

…

fd.zig

fix(bindings): handle errors from String.toJS() for oversized strings (#26213)

2026-01-21 13:01:25 -08:00

feature_flags.zig

feat(ENG-21362): Environment Variables Store (#23930)

2025-10-23 23:08:08 -07:00

fixtures_example.com.html

…

fmt.bind.ts

…

fmt.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

fs.zig

Align temp directory resolution with os.tmpdir() (#25878)

2026-01-07 16:09:49 -08:00

generated_perf_trace_events.zig

…

glob.zig

…

Global.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

handle_oom.zig

…

heap_breakdown.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

highway.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

hmac.zig

…

HTMLScanner.zig

…

http.zig

fix(fetch): respect --max-http-header-size for response headers

2026-01-27 07:14:35 +00:00

identity_context.zig

…

import_record.zig

feat(bundler): add metafile support matching esbuild format (#25842)

2026-01-07 22:46:51 -08:00

ini.zig

fix: dupe ca string in .npmrc to prevent use-after-free (#25563)

2025-12-17 19:56:25 -08:00

interchange.zig

…

js_lexer_tables.zig

…

js_lexer.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

js_parser.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

js_printer.zig

fix(bundler): add missing semicolons in minified bun module imports (#26372)

2026-01-23 23:09:01 -08:00

jsc_stub.zig

…

linear_fifo.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

linker.lds

…

linker.zig

perf: pack boolean flags and reorder fields to reduce struct padding (#25627)

2025-12-21 17:12:42 -08:00

linux.zig

feat(ENG-21362): Environment Variables Store (#23930)

2025-10-23 23:08:08 -07:00

logger.zig

perf: pack boolean flags and reorder fields to reduce struct padding (#25627)

2025-12-21 17:12:42 -08:00

logo.svg

…

macho.zig

fix(macho): only update signature size on ARM64 with codesigning enabled (#26175)

2026-01-16 14:18:48 -08:00

main_test.zig

fix(compile): apply BUN_OPTIONS env var to standalone executables (#26346)

2026-01-23 00:24:18 -08:00

main_wasm.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

main.zig

fix(compile): apply BUN_OPTIONS env var to standalone executables (#26346)

2026-01-23 00:24:18 -08:00

memory.zig

…

meta.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

node_fallbacks.zig

…

open.zig

…

options.zig

feat(transpiler): add replMode option for REPL transforms (#26246)

2026-01-21 13:39:25 -08:00

output.zig

fix(windows): use GetConsoleCP() instead of GetConsoleOutputCP() for input codepage (#25252)

2025-11-30 23:11:33 -08:00

OutputFile.zig

Revert 0c3b5e501b

2026-01-23 11:02:26 -08:00

patch.zig

fix(bindings): handle errors from String.toJS() for oversized strings (#26213)

2026-01-21 13:01:25 -08:00

paths.zig

…

pe.zig

fix(compile): use 8-byte header for embedded section to ensure bytecode alignment (#25377)

2025-12-06 16:37:09 -08:00

perf.zig

Add fake timers for bun:test (#23764)

2025-12-01 21:59:11 -08:00

pool.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

Progress.zig

Fix progress showing kb for downloading packages instead of count (#24700)

2025-11-13 19:29:16 -08:00

ptr.zig

…

renamer.zig

fix(bundler): rename named function expressions when shadowing outer symbol (#26027)

2026-01-14 12:52:41 -08:00

result.zig

…

router.zig

zig: fix missing uses of bun.callmod_inline (#24738)

2025-11-15 16:36:15 -08:00

runtime.bun.js

…

runtime.js

…

runtime.zig

feat(transpiler): add replMode option for REPL transforms (#26246)

2026-01-21 13:39:25 -08:00

safety.zig

…

semver.zig

…

sha.zig

…

SignalCode.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

StandaloneModuleGraph.zig

Revert 0c3b5e501b

2026-01-23 11:02:26 -08:00

StaticHashMap.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

string.zig

fix(bindings): handle errors from String.toJS() for oversized strings (#26213)

2026-01-21 13:01:25 -08:00

symbols.def

…

symbols.dyn

feat: implement V8 Value type checking APIs (#22462)

2025-12-15 19:50:11 -08:00

symbols.txt

feat: implement V8 Value type checking APIs (#22462)

2025-12-15 19:50:11 -08:00

sys_uv.zig

fix(windows): chunk large buffers in preadv/pwritev to avoid integer overflow (#26303)

2026-01-20 12:47:07 -08:00

sys.zig

fix: handle DT_UNKNOWN in dir_iterator for bind-mounted filesystems (#25838)

2026-01-22 13:44:49 -08:00

system_timer.zig

…

threading.zig

…

tmp.zig

…

tracy.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

trait.zig

…

transpiler.zig

Revert 0c3b5e501b

2026-01-23 11:02:26 -08:00

tsconfig.json

…

unit_test.zig

…

url.zig

fix(http): support proxy passwords longer than 4096 characters (#25530)

2025-12-15 13:21:41 -08:00

util.zig

…

walker_skippable.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

Watcher.zig

fix(fs.watch): emit 'change' events for files in watched directories on Linux (#26009)

2026-01-14 16:46:20 -08:00

which_npm_client.zig

…

which.zig

…

windows-app-info.rc

feat(windows): Add Windows ARM64 support (#26215)

2026-01-22 04:22:45 -08:00

windows.zig

fix(windows): use GetConsoleCP() instead of GetConsoleOutputCP() for input codepage (#25252)

2025-11-30 23:11:33 -08:00

work_pool.zig

…

workaround_missing_symbols.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

wyhash.zig

…

zlib.test.gz

…

zlib.test.txt

…

zlib.zig

fix: memory leaks in error-handling code for Brotli, Zstd, and Zlib compression state machines (#25592)

2025-12-18 21:42:14 -08:00