Claude Bot eb91dbdc77 fix(libarchive): use normalized path for directory creation on POSIX ...

The POSIX mkdiratZ calls for directory entries were using the
unnormalized `pathname` variable instead of the normalized `path`
variable. This allowed malicious tarballs with `../` in directory
entry names to create directories outside the extraction root.
The Windows codepath already correctly used the normalized `path`.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-02-12 04:44:59 +00:00

..

allocators

Revert "Mimalloc v3 update (#26379)" (#26783)

2026-02-06 18:05:17 -08:00

analytics

…

api

feat(md): Zig markdown parser with Bun.markdown API (#26440)

2026-01-28 20:24:02 -08:00

ast

feat(transpiler): implement TC39 standard ES decorators lowering (#26436)

2026-02-09 22:03:54 -08:00

async

feat: add Bun.Terminal API for pseudo-terminal (PTY) support (#25415)

2025-12-15 12:51:13 -08:00

bake

fix(bake): queue pending HMR scripts for reuse (#19736) (#23995)

2026-02-10 01:53:07 -08:00

base64

…

bun.js

perf(path): use pre-built Structure for path.parse() result objects (#26865)

2026-02-10 22:32:08 -08:00

bundler

feat(transpiler): implement TC39 standard ES decorators lowering (#26436)

2026-02-09 22:03:54 -08:00

cli

feat(test): add --retry flag and emit separate testcase entries for retries in JUnit XML (#26866)

2026-02-10 10:58:21 -08:00

codegen

Revert "fix(bindgen): prevent use-after-free for optional string argu… (#26742)

2026-02-04 19:38:12 -08:00

collections

fix(bundler): fix out-of-bounds access in DynamicBitSetUnmanaged.bytes() (#26283)

2026-01-19 22:45:56 -08:00

create

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

css

fix(css): preserve logical border-radius properties (#26006)

2026-01-14 13:34:31 -08:00

deps

perf(event_loop): avoid eventfd wakeup for setImmediate on POSIX (#26821)

2026-02-09 04:47:52 -08:00

errno

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

fs

…

glob

fix: handle DT_UNKNOWN in dir_iterator for bind-mounted filesystems (#25838)

2026-01-22 13:44:49 -08:00

http

fix(websocket): forward URL credentials as Authorization header (#26278)

2026-01-19 17:04:44 -08:00

init

fix(init): resolve TypeScript errors in react-tailwind template build.ts (#26258)

2026-01-19 17:12:42 -08:00

install

fix(install): show dependency name when file: path resolution fails (#26340)

2026-01-21 18:41:15 -08:00

interchange

feat: add native JSON5 parser (Bun.JSON5) (#26439)

2026-01-26 10:52:35 -08:00

io

Use edge-triggered epoll for eventfd wakeups (#26815)

2026-02-09 00:36:30 -08:00

js

fix(crypto): correct method and constructor names mangled by number renamer (#26876)

2026-02-10 23:06:22 -08:00

js_lexer

…

libarchive

fix(libarchive): use normalized path for directory creation on POSIX

2026-02-12 04:44:59 +00:00

md

fix ci (#26703)

2026-02-03 22:18:40 -08:00

meta

…

napi

fix(napi): return napi_function for AsyncContextFrame in napi_typeof (#26511)

2026-01-27 13:35:15 -08:00

node-fallbacks

ENG-21534: Satisfy aikido (#24880)

2025-11-24 20:16:03 -08:00

paths

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

ptr

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

resolver

feat(transpiler): implement TC39 standard ES decorators lowering (#26436)

2026-02-09 22:03:54 -08:00

s3

feat(s3): add Content-Encoding header support for S3 uploads (#26149)

2026-01-15 18:09:33 -08:00

safety

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

semver

remove jsc.createCallback (#24910)

2025-11-20 20:56:02 -08:00

shell

fix(shell): prevent double-free during GC finalization (#26626)

2026-01-31 16:57:59 -08:00

sourcemap

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

sql

fix(bindings): handle errors from String.toJS() for oversized strings (#26213)

2026-01-21 13:01:25 -08:00

string

fix(stringWidth): correct width for Thai/Lao spacing vowels (#26728)

2026-02-05 17:31:15 -08:00

sys

fix(bindings): handle errors from String.toJS() for oversized strings (#26213)

2026-01-21 13:01:25 -08:00

test

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

threading

perf: shrink ConcurrentTask from 24 bytes to 16 bytes (#25636)

2025-12-22 12:07:24 -08:00

unicode/uucode

feat(unicode): migrate grapheme breaking to uucode with GB9c support (#26376)

2026-01-23 00:07:06 -08:00

valkey

fix(bindings): handle errors from String.toJS() for oversized strings (#26213)

2026-01-21 13:01:25 -08:00

vm

Upgrade WebKit Dec 24, 2025 (#25684)

2025-12-25 14:00:58 -08:00

watcher

fix(fs.watch): emit 'change' events for files in watched directories on Linux (#26009)

2026-01-14 16:46:20 -08:00

windows

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

.clang-format

…

AGENTS.md

…

allocators.zig

fix(http2): fix settings, window size handling, and dynamic header buffer allocation (#26119)

2026-01-22 14:35:18 -08:00

analytics.zig

Add analytics tracking for CPU profiling and heap snapshots (#25053)

2025-11-26 00:02:43 -08:00

analyze_transpiled_module.zig

esm bytecode (#26402)

2026-01-30 01:38:45 -08:00

asan-config.c

misc tidyings from another branch (#24406)

2025-11-05 15:28:28 -08:00

asan.zig

…

ast.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

bake.bind.ts

…

bake.zig

feat(ENG-21362): Environment Variables Store (#23930)

2025-10-23 23:08:08 -07:00

bits.zig

…

boringssl.zig

Harden TLS hostname verification (#25727)

2026-01-05 10:21:49 -08:00

brotli.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

btjs.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

bun.exe.manifest

…

bun.ico

…

bun.js.zig

add --cpu-prof-interval flag (#26620)

2026-01-31 16:59:03 -08:00

bun.zig

feat(md): Zig markdown parser with Bun.markdown API (#26440)

2026-01-28 20:24:02 -08:00

bunfig.zig

feat(test): add --retry flag and emit separate testcase entries for retries in JUnit XML (#26866)

2026-02-10 10:58:21 -08:00

c-headers-for-zig.h

…

cache.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

ci_info.zig

Update ci_info with more CI detection (#23708)

2025-11-10 19:58:02 -08:00

CLAUDE.md

Update CLAUDE.md

2026-01-07 12:33:21 -08:00

cli.zig

feat(test): add --retry flag and emit separate testcase entries for retries in JUnit XML (#26866)

2026-02-10 10:58:21 -08:00

collections.zig

…

compile_target.zig

feat(windows): Add Windows ARM64 support (#26215)

2026-01-22 04:22:45 -08:00

comptime_string_map.zig

feat(ENG-21324): Implement hosted_git_info.zig (#24138)

2025-10-29 19:29:04 -07:00

ConfigVersion.zig

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

copy_file.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

crash_handler.zig

[publish images] Upgrade LLVM toolchain from 19.1.7 to 21.1.8 (#26667)

2026-02-02 23:12:21 -08:00

csrf.zig

remove jsc.createCallback (#24910)

2025-11-20 20:56:02 -08:00

darwin.zig

…

defines-table.zig

…

defines.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

deprecated.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

dir.zig

…

dns.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

env_loader.zig

fix(proxy): respect NO_PROXY for explicit proxy options in fetch and ws (#26608)

2026-01-30 16:20:45 -08:00

env_var.zig

fix(compile): apply BUN_OPTIONS env var to standalone executables (#26346)

2026-01-23 00:24:18 -08:00

env.zig

feat(windows): Add Windows ARM64 support (#26215)

2026-01-22 04:22:45 -08:00

fallback-backend.html

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

fallback.html

…

fallback.ts

…

favicon.png

…

fd.zig

fix(bindings): handle errors from String.toJS() for oversized strings (#26213)

2026-01-21 13:01:25 -08:00

feature_flags.zig

feat(ENG-21362): Environment Variables Store (#23930)

2025-10-23 23:08:08 -07:00

fixtures_example.com.html

…

fmt.bind.ts

…

fmt.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

fs.zig

Revert "feat(bundler): add configurable CJS→ESM unwrapping via unwrapCJSToESM"

2026-02-08 19:49:26 -08:00

generated_perf_trace_events.zig

feat: add native JSON5 parser (Bun.JSON5) (#26439)

2026-01-26 10:52:35 -08:00

glob.zig

…

Global.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

handle_oom.zig

…

heap_breakdown.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

highway.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

hmac.zig

…

HTMLScanner.zig

…

http.zig

fix(http): check socket state before operations in doRedirect (#26221)

2026-01-18 13:19:30 -08:00

identity_context.zig

…

import_record.zig

feat(bundler): add metafile support matching esbuild format (#25842)

2026-01-07 22:46:51 -08:00

ini.zig

fix: dupe ca string in .npmrc to prevent use-after-free (#25563)

2025-12-17 19:56:25 -08:00

interchange.zig

feat: add native JSON5 parser (Bun.JSON5) (#26439)

2026-01-26 10:52:35 -08:00

js_lexer_tables.zig

feat(transpiler): implement TC39 standard ES decorators lowering (#26436)

2026-02-09 22:03:54 -08:00

js_lexer.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

js_parser.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

js_printer.zig

feat(transpiler): implement TC39 standard ES decorators lowering (#26436)

2026-02-09 22:03:54 -08:00

jsc_stub.zig

…

linear_fifo.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

linker.lds

…

linker.zig

perf: pack boolean flags and reorder fields to reduce struct padding (#25627)

2025-12-21 17:12:42 -08:00

linux.zig

feat(ENG-21362): Environment Variables Store (#23930)

2025-10-23 23:08:08 -07:00

logger.zig

perf: pack boolean flags and reorder fields to reduce struct padding (#25627)

2025-12-21 17:12:42 -08:00

logo.svg

…

macho.zig

fix(macho): only update signature size on ARM64 with codesigning enabled (#26175)

2026-01-16 14:18:48 -08:00

main_test.zig

fix(compile): apply BUN_OPTIONS env var to standalone executables (#26346)

2026-01-23 00:24:18 -08:00

main_wasm.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

main.zig

fix(compile): apply BUN_OPTIONS env var to standalone executables (#26346)

2026-01-23 00:24:18 -08:00

memory.zig

Port SocketConfig to bindings generator (#23755)

2025-10-18 18:14:01 -07:00

meta.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

node_fallbacks.zig

…

open.zig

…

options.zig

feat(transpiler): implement TC39 standard ES decorators lowering (#26436)

2026-02-09 22:03:54 -08:00

output.zig

fix(windows): use GetConsoleCP() instead of GetConsoleOutputCP() for input codepage (#25252)

2025-11-30 23:11:33 -08:00

OutputFile.zig

esm bytecode (#26402)

2026-01-30 01:38:45 -08:00

patch.zig

fix(bindings): handle errors from String.toJS() for oversized strings (#26213)

2026-01-21 13:01:25 -08:00

paths.zig

…

pe.zig

fix(compile): use 8-byte header for embedded section to ensure bytecode alignment (#25377)

2025-12-06 16:37:09 -08:00

perf.zig

Add fake timers for bun:test (#23764)

2025-12-01 21:59:11 -08:00

pool.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

Progress.zig

Fix progress showing kb for downloading packages instead of count (#24700)

2025-11-13 19:29:16 -08:00

ptr.zig

…

renamer.zig

fix(bundler): rename named function expressions when shadowing outer symbol (#26027)

2026-01-14 12:52:41 -08:00

result.zig

…

router.zig

zig: fix missing uses of bun.callmod_inline (#24738)

2025-11-15 16:36:15 -08:00

runtime.bun.js

…

runtime.js

feat(transpiler): implement TC39 standard ES decorators lowering (#26436)

2026-02-09 22:03:54 -08:00

runtime.zig

feat(transpiler): implement TC39 standard ES decorators lowering (#26436)

2026-02-09 22:03:54 -08:00

safety.zig

…

semver.zig

…

sha.zig

…

SignalCode.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

StandaloneModuleGraph.zig

fix(compile): use remaining buffer in standalone POSIX write loop (#26882)

2026-02-10 23:04:46 -08:00

StaticHashMap.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

string.zig

fix(bindings): handle errors from String.toJS() for oversized strings (#26213)

2026-01-21 13:01:25 -08:00

symbols.def

…

symbols.dyn

feat: implement V8 Value type checking APIs (#22462)

2025-12-15 19:50:11 -08:00

symbols.txt

feat: implement V8 Value type checking APIs (#22462)

2025-12-15 19:50:11 -08:00

sys_uv.zig

fix(windows): chunk large buffers in preadv/pwritev to avoid integer overflow (#26303)

2026-01-20 12:47:07 -08:00

sys.zig

fix(compile): seek to start of file before EXDEV cross-device copy (#26883)

2026-02-10 22:32:31 -08:00

system_timer.zig

…

threading.zig

…

tmp.zig

…

tracy.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

trait.zig

…

transpiler.zig

feat(transpiler): implement TC39 standard ES decorators lowering (#26436)

2026-02-09 22:03:54 -08:00

tsconfig.json

…

unit_test.zig

…

url.zig

fix(http): support proxy passwords longer than 4096 characters (#25530)

2025-12-15 13:21:41 -08:00

util.zig

…

walker_skippable.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

Watcher.zig

fix(fs.watch): emit 'change' events for files in watched directories on Linux (#26009)

2026-01-14 16:46:20 -08:00

which_npm_client.zig

…

which.zig

…

windows-app-info.rc

feat(windows): Add Windows ARM64 support (#26215)

2026-01-22 04:22:45 -08:00

windows.zig

fix(windows): use GetConsoleCP() instead of GetConsoleOutputCP() for input codepage (#25252)

2025-11-30 23:11:33 -08:00

work_pool.zig

…

workaround_missing_symbols.zig

Update to zig 0.15.2 (#24204)

2025-11-10 14:38:26 -08:00

wyhash.zig

…

zlib.test.gz

…

zlib.test.txt

…

zlib.zig

fix: memory leaks in error-handling code for Brotli, Zstd, and Zlib compression state machines (#25592)

2025-12-18 21:42:14 -08:00