Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package bun for openSUSE:Factory checked in at 2026-09-08 16:54:37 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/bun (Old) and /work/SRC/openSUSE:Factory/.bun.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "bun" Tue Sep 8 16:54:37 2026 rev:4 rq:1376121 version:1.4.2 Changes: -------- --- /work/SRC/openSUSE:Factory/bun/bun.changes 2026-08-24 12:15:16.121777993 +0200 +++ /work/SRC/openSUSE:Factory/.bun.new.1265/bun.changes 2026-09-08 16:55:58.983636987 +0200 @@ -1,0 +2,40 @@ +Mon Sep 7 08:00:21 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 1.4.2: + * Security: fetch() verifies the TLS certificate against the + URL's hostname instead of a caller-supplied Host header. The + old behaviour was an insecure default for anything that + forwards a user-controlled Host, as proxies do. No CVE + assigned + * Bun.serve speaks HTTP/2; Bun.write(path, response) streams to + disk; WebSocket gains pause()/resume(); node:crypto gains + argon2 + * Up to 9x faster Buffer reads and writes, faster + AsyncLocalStorage, Bun.inspect and require() of builtins, + lower idle memory; TLS root CAs are embedded as DER and parsed + lazily and the system CA bundle is read once, so the first + HTTPS request is much cheaper + * bun install --offline/--prefer-offline; self-contained + node_modules for workspace packages + * bun build tree-shakes through dynamic import(), emits fewer and + smaller split chunks and gains --min-chunk-size; compiled + executables start faster, carry smaller bytecode and can + cross-compile with --bytecode + * 1.4.2 fixes a bun build variable name collision, an + AsyncLocalStorage leak, worker_threads 'online' ordering and + Bun.Image on CMYK/YCCK JPEGs + * WebKit 2e2aa229. Bundled BoringSSL moves 247 commits (x509 + pathLenConstraint on self-issued intermediates, an SSLBuffer + capacity overflow, an X509 RFC2253 name infinite loop, an + ML-KEM constant-time validation regression) and mimalloc 51 + (heap teardown and cross-thread free lifetimes); no CVEs + assigned against either range + * See upstream's release notes for the rest +- Drop bun-highway-scalable-sve.patch: upstream now disables the + scalable SVE targets itself - a superset of what the patch did, + it drops the fixed-length SVE_256 too - and a dependency's + defines finally reach bun's own objects, which is the + propagation gap the patch had to paper over +- Build the driver with nodejs26: 1.4.2 refuses any Node below 25 + +------------------------------------------------------------------- Old: ---- bun-1.4.0.tar.gz bun-highway-scalable-sve.patch bun-node-modules-1.4.0.tar.zst bun-prefetch-1.4.0.tar.zst bun-vendor-1.4.0.tar.zst webkit-1.4.0.tar.zst New: ---- bun-1.4.2.tar.gz bun-node-modules-1.4.2.tar.zst bun-prefetch-1.4.2.tar.zst bun-vendor-1.4.2.tar.zst webkit-1.4.2.tar.zst ----------(Old B)---------- Old: * See upstream's release notes for the rest - Drop bun-highway-scalable-sve.patch: upstream now disables the scalable SVE targets itself - a superset of what the patch did, ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ bun.spec ++++++ --- /var/tmp/diff_new_pack.MyFXA1/_old 2026-09-08 16:56:30.999978211 +0200 +++ /var/tmp/diff_new_pack.MyFXA1/_new 2026-09-08 16:56:31.001978295 +0200 @@ -17,13 +17,13 @@ # 1.4.0 is the first release written in Rust (1.3.14 was the last in Zig). -# git_commit is the bun-v1.4.0 tag peel, used as GIT_SHA for bun --revision; +# git_commit is the bun-v1.4.2 tag peel, used as GIT_SHA for bun --revision; # it is not part of the RPM version. -%define git_commit 34cbb9a40b4bd1bd767d134a7065e66c2432a676 -%define git_short 34cbb9a4 +%define git_commit 744846f844374847c902b5e7fd59b4342a51ef99 +%define git_short 744846f8 # The WebKit revision Source1 was made from, for reference; it is read out of # the Bun tarball by bun_webkit, not set here. -# 0f966e81b78c84bb23213e391bc679c4ef83e56b +# 2e2aa2290fac856d6f451ceacb58f7f5b44dd057 # The SQLite amalgamation in Bun's tree. Used for both the bundled() Provides # and the %%check that asserts it against sqlite_version(), so the two cannot # drift apart on a version bump. @@ -51,7 +51,7 @@ # slower but keeps the package free of foreign binaries. %bcond_without webkit_source Name: bun -Version: 1.4.0 +Version: 1.4.2 Release: 0 Summary: Fast all-in-one JavaScript runtime and toolkit # Bun itself is MIT, but it is one statically linked executable and everything @@ -62,7 +62,7 @@ # picohttpparser (MIT OR Artistic-1.0-Perl) is taken under its permissive half. # See LICENSE.md, which upstream keeps current, and re-check this on every # version bump. IJG is gone with libjpeg-turbo, the only thing that carried it, -# now that Patch5 links it from the distribution. +# now that Patch4 links it from the distribution. # # LGPL-2.1 section 6 is satisfied by shipping the engine's source: WebKit is # Source1 and is part of the src.rpm. @@ -118,29 +118,25 @@ # and the workspace denies warnings, so the unknown lint is fatal. Allowing # unknown_lints alongside it is correct on both compilers. Patch1: bun-unknown-lint.patch -# Do not compile Highway's length-agnostic SVE targets: Highway defines -# BitsFromMask only for the fixed-length ones, and three of Bun's SIMD helpers -# call it unconditionally. -Patch2: bun-highway-scalable-sve.patch # Emit debug information debugedit can read, so rpm can build a debuginfo # package: DWARF 5 from rustc, as clang and the standard library already emit, # and without the DWARF 5 accelerator table, which debugedit does not know. -Patch3: bun-uniform-dwarf.patch +Patch2: bun-uniform-dwarf.patch # Do not let WebKit put types in their own units. The linker keeps one copy of # each and drops the rest, leaving .debug_str_offsets entries no unit refers to # any more, and debugedit asserts on the first of those. -Patch4: bun-webkit-no-type-units.patch +Patch3: bun-webkit-no-type-units.patch # Link zstd, brotli, libdeflate, libspng, libwebp and libjpeg-turbo from the # distribution instead of the vendored copies. These are the bundled C # libraries whose pin is an unmodified upstream release rather than a fork and # that Bun reaches through their installed public headers, so each can be # tracked like any other shared library. See the patch header for the details # that are specific to each of them. -Patch5: bun-system-libs.patch +Patch4: bun-system-libs.patch # Raise the LLVM version bun pins from 21 to the distribution default. -Patch6: bun-llvm-22.patch +Patch5: bun-llvm-22.patch BuildRequires: cargo -# LLVM 22.1.x, per Patch6. scripts/build/tools.ts enforces this for the C +# LLVM 22.1.x, per Patch5. scripts/build/tools.ts enforces this for the C # compiler and the linker only; see the PATH shim in %%build for the C++ # compiler, which it looks up without a version check. BuildRequires: clang22 @@ -151,7 +147,12 @@ BuildRequires: lld22 BuildRequires: llvm22 BuildRequires: ninja -BuildRequires: nodejs24 >= 24.3.0 +# The build driver runs on Node, and 1.4.2 refuses anything below 25 +# (scripts/build/configure.ts): the codegen scripts gate on import.meta.main, +# and upstream set the floor at the release after the one that added it rather +# than at 24.2. 26 is what upstream CI installs and what bun's own node headers +# dependency is pinned to, and Factory has no 25. +BuildRequires: nodejs26 # WebKit cmake. This is not a Perl package: spec-cleaner --perl explodes # this into hundreds of perl(...) module BRs and drops git-core. BuildRequires: perl @@ -163,7 +164,7 @@ BuildRequires: rust >= 1.97 BuildRequires: unzip BuildRequires: zstd -# Unbundled by Patch5. brotlicommon has no header of its own but is a separate +# Unbundled by Patch4. brotlicommon has no header of its own but is a separate # pkg-config module, and the link line names it. libwebp's sharpyuv needs no # entry of its own: it is a transitive dependency of libwebp.so. BuildRequires: pkgconfig(libbrotlicommon) @@ -183,7 +184,7 @@ # Bun is a single statically linked executable and everything still listed here # ends up inside it. Each is pinned to an exact commit, several are upstream # forks (boringssl, tinycc, mimalloc, lol-html) and the JavaScript engine is a -# fork of WebKit, so none of them can be unbundled the way the six in Patch5 +# fork of WebKit, so none of them can be unbundled the way the six in Patch4 # were. Unversioned because upstream pins commits rather than releases. # Regenerate from bun-prefetch.manifest, LICENSE.md and the crates.io # dependencies in Cargo.toml on a version bump - the manifest and LICENSE.md @@ -320,7 +321,7 @@ export GIT_SHA="%{git_commit}" # process.versions.zstd and .libdeflate are generated from the vendored commit # hashes, which say nothing once the distribution libraries are linked instead -# (Patch5). Report what is actually linked. The other four have no such macro, +# (Patch4). Report what is actually linked. The other four have no such macro, # so they need no counterpart. export BUN_SYSTEM_VERSION_ZSTD="$(pkg-config --modversion libzstd)" export BUN_SYSTEM_VERSION_LIBDEFLATE="$(pkg-config --modversion libdeflate)" @@ -373,7 +374,7 @@ %check %{buildroot}%{_bindir}/bun --version -# Anchored on the release form. A canary reports 1.4.0-canary.<stamp>+<sha>, +# Anchored on the release form. A canary reports <ver>-canary.<stamp>+<sha>, # which a bare substring match for the short sha would have accepted. %{buildroot}%{_bindir}/bun --revision | grep -E "^%{version}\+%{git_short}" %{buildroot}%{_bindir}/bun -e 'if (6 * 7 !== 42) process.exit(1)' @@ -401,14 +402,14 @@ EOF %{buildroot}%{_bindir}/bun -e 'import{cc}from"bun:ffi";const{symbols:{tcc_smoke:g}}=cc({source:"./_tcc_check.c",symbols:{tcc_smoke:{args:["int"],returns:"int"}}});const r=g(20);if(r!==42)throw new Error("bundled(tinycc) returned "+r)' -# Patch5 must have taken effect: every unbundled library has to be an ELF +# Patch4 must have taken effect: every unbundled library has to be an ELF # dependency now. A silently reverted patch would otherwise still build and # still pass every test above. ldd %{buildroot}%{_bindir}/bun for lib in libzstd libbrotlienc libbrotlidec libbrotlicommon libdeflate \ libspng libwebp libwebpmux libwebpdemux libturbojpeg; do ldd %{buildroot}%{_bindir}/bun | grep -qE "\<$lib\.so" || \ - { echo "$lib is not linked - Patch5 did not take effect"; exit 1; } + { echo "$lib is not linked - Patch4 did not take effect"; exit 1; } done # ... and each one works through the binary, not just at link time. %{buildroot}%{_bindir}/bun -e 'const c=Bun.zstdCompressSync(Buffer.from("z".repeat(4096)));if(Bun.zstdDecompressSync(c).length!==4096)throw new Error("zstd round trip failed")' ++++++ README.SUSE-maint ++++++ --- /var/tmp/diff_new_pack.MyFXA1/_old 2026-09-08 16:56:31.052980432 +0200 +++ /var/tmp/diff_new_pack.MyFXA1/_new 2026-09-08 16:56:31.056980599 +0200 @@ -11,9 +11,9 @@ ---------------------- 1.4.0 is the first release written in Rust; 1.3.14 was the last written in -Zig. Source0 is the bun-v1.4.0 release tarball. %{git_commit} is the commit -that tag points at, passed as GIT_SHA so `bun --revision` reports it; it is -not part of the RPM version. +Zig. Source0 is the release tarball of the bun-vX.Y.Z tag. %{git_commit} is +the commit that tag points at, passed as GIT_SHA so `bun --revision` reports +it; it is not part of the RPM version. Regenerating the sources @@ -172,12 +172,12 @@ - remaining cfg.bun usage"); until then, turn %bcond bootstrap off once the package is in the distribution and it will build with the Bun already there. -1.3.14 is old - it is the last Zig release, while the source here is the 1.4.0 +1.3.14 is old - it is the last Zig release, while the source here is a 1.4.x Rust tree - but it does the job: the build applies no minimum Bun version, and upstream's own CI bootstraps this tree with 1.3.13 (scripts/bootstrap.sh). Keep 1.3.14 until bun is in the distribution, then turn %bcond bootstrap off -so the package builds with itself. Do not switch the bootstrap zips to 1.4.0 -while this package is still the first 1.4.0 in the distro - that would be +so the package builds with itself. Do not switch the bootstrap zips to a 1.4.x +while this package is still the only 1.4.x in the distro - that would be another foreign binary for no gain. The binaries are NoSource: uploaded to the build service but not shipped in the @@ -223,22 +223,16 @@ unknown lint name is fatal; allowing unknown_lints alongside it is correct on both the released compiler and the nightly upstream pins. -bun-highway-scalable-sve.patch sets HWY_DISABLED_TARGETS so that Highway's -length-agnostic SVE targets are not compiled. Highway implements BitsFromMask -only for the fixed-length SVE targets - a uint64_t with one bit per lane is not -well-defined when the vector length is not known until run time - but -highway_xml.cpp, highway_json.cpp and highway_sourcemap.cpp call it -unconditionally, so all three fail to compile for HWY_SVE and HWY_SVE2. Those -targets become attainable on aarch64 whenever the compiler knows SVE and -Highway has runtime dispatch, which is every clang new enough to build bun. - -What is left is NEON plus HWY_SVE_256 and HWY_SVE2_128, the fixed-length -targets that Neoverse V1, V2 and N2 select, and those do define BitsFromMask - -so no SVE hardware ends up on the NEON path. The define is applied both to -Highway's own translation units and to bun's, because HWY_TARGETS is derived -from it and the two disagreeing would misdispatch at run time. - -Worth reporting upstream: it is a portability bug, not a packaging workaround. +bun-highway-scalable-sve.patch is gone as of 1.4.2. It disabled Highway's +length-agnostic SVE targets, which fail to compile because Highway defines +BitsFromMask only for the fixed-length ones while highway_xml.cpp, +highway_json.cpp and highway_sourcemap.cpp call it unconditionally. Upstream +now does the same thing itself, in scripts/build/deps/highway.ts, and 1.4.2 +also grew the mechanism the patch had to work around: a dependency's +provides().defines now reaches bun's own translation units +(scripts/build/bun.ts), so the value no longer has to be repeated in flags.ts +to keep HWY_TARGETS consistent between the two. Upstream disables all of +HWY_ALL_SVE except HWY_SVE2_128, which is a superset of what the patch did. bun-uniform-dwarf.patch makes the debug information something debugedit can process, which rpm needs before it can extract a debuginfo package. Both of its ++++++ bun-1.4.0.tar.gz -> bun-1.4.2.tar.gz ++++++ /work/SRC/openSUSE:Factory/bun/bun-1.4.0.tar.gz /work/SRC/openSUSE:Factory/.bun.new.1265/bun-1.4.2.tar.gz differ: char 16, line 1 ++++++ bun-node-modules-1.4.0.tar.zst -> bun-node-modules-1.4.2.tar.zst ++++++ /work/SRC/openSUSE:Factory/bun/bun-node-modules-1.4.0.tar.zst /work/SRC/openSUSE:Factory/.bun.new.1265/bun-node-modules-1.4.2.tar.zst differ: char 7, line 1 ++++++ bun-prefetch-1.4.0.tar.zst -> bun-prefetch-1.4.2.tar.zst ++++++ /work/SRC/openSUSE:Factory/bun/bun-prefetch-1.4.0.tar.zst /work/SRC/openSUSE:Factory/.bun.new.1265/bun-prefetch-1.4.2.tar.zst differ: char 24, line 1 ++++++ bun-prefetch.manifest ++++++ --- /var/tmp/diff_new_pack.MyFXA1/_old 2026-09-08 16:56:31.205986842 +0200 +++ /var/tmp/diff_new_pack.MyFXA1/_new 2026-09-08 16:56:31.208986967 +0200 @@ -2,17 +2,17 @@ 1685a3355527fdec398ccf10f79b3f75 c9ea1b3029b23b04376c229bd519489cee180874ec48cd863a5dcba628c0fe03 https://github.com/c-ares/c-ares/archive/c7a3138dcfe3bb0eaaf10c0c24c36dc66dc790ab.tar.gz 297099166a01f75e9a0caaa17f7b74f3 440f3a94390c78eab88f74b92944d2f6b248e592e984412e389885dfb5796bf0 https://github.com/libjpeg-turbo/libjpeg-turbo/archive/e352b02f794f701407b39af08576035ba3360d60.tar.gz 2ced709f169b40bd84b3e0dc2765aff8 76fb89b4454ff2161bb0cca2cf832e19b8b4001b0ef42fbcc2b4a437c945b2b6 https://github.com/webmproject/libwebp/archive/b7e29b9d75bd31422b00c2a446d49d7af06c328d.tar.gz -355b3176162682e2288fd449c39f7939 0f9abe027fe4aa9943c2df3523043c6ae9eb4c8241febc0091b6f537222d26d8 https://github.com/oven-sh/mimalloc/archive/6a14aee24315e503fa295a1fa90fe8b24ad91774.tar.gz 4296b191210d6b1b3f6c85bbce59eddf 042f0efe7147063ff9ba10f1a38ed080e949bcbd04bdbf3592b8846dd11b1da2 https://github.com/libarchive/libarchive/archive/ded82291ab41d5e355831b96b0e1ff49e24d8939.tar.gz 45e9cfbefdc7f69b2e025785c7bd7616 fca113c5d5add8bfb1aa31129a24acb8d49aa69ab3c22a2cc569aec88960526d https://nodejs.org/dist/v26.3.0/node-v26.3.0-headers.tar.gz +46af79b3cf5b69771234ee14b41700ca f36343416ad823dfcca61bd18ad4bb7f0d8814ab77e0fd5ef169f4a9cddeb8b8 https://github.com/oven-sh/mimalloc/archive/6a64e1ba7f5b2130d4efccb67ec87fd0003f0f6a.tar.gz 655c6ecdb6fc9cd5621eb37cad3758da a0d2a5d122c84b56a793a1553a9c3327fb2eb7469bf7a86b79e3c7be5d92e8d6 https://github.com/zlib-ng/zlib-ng/archive/12731092979c6d07f42da27da673a9f6c7b13586.tar.gz 723494d4c3a9902a1edf3613ad3d0cdb e720a6ca29428b803f4ad165371771f5398faba397edf6778837a18599ea13ff https://github.com/google/brotli/archive/v1.1.0.tar.gz 73e0c55d12ea4fc2665ba0e3b1461100 07d8bf901bb1b15543f38eabd23938519e1210eebadb52f3d651d6ef130ef973 https://github.com/litespeedtech/ls-hpack/archive/8905c024b6d052f083a3d11d0a169b3c2735c8a1.tar.gz 87c5404c7fc9aa9ce3a44b8b1929b357 e77c797444f191faf488d49c76c4f45c10b3d9275e0364ee10b6d05cfbe57baf https://github.com/sru-systems/rust-argon2/archive/ed81866f163f0c7026aa6fd8388adf37242eb32a.tar.gz 97084f213075a65efe2e2346b2ee6c5c 811c5e5ae5303a75ade50688880af6aad5d2f951ec5785f68186bd18635cdfc9 https://github.com/HdrHistogram/HdrHistogram_c/archive/be60a9987ee48d0abf0d7b6a175bad8d6c1585d1.tar.gz b2dcc6002e95cc474624da9a4aaea204 741d705781e0b3e406beda8f1f994fbae01321237ce8023a1ad90fbaf7940c25 https://github.com/google/highway/archive/2607d3b5b0113992fe84d3848859eae13b3b52c1.tar.gz -c6d78bf3f3d4c21ebdd735187b665bda 6c7aaf0d99ff35475c8678a43543f94d55f68d4956c4b73ce01417fc358cefe7 https://github.com/oven-sh/boringssl/archive/2288897e2e716330490893d226b4f079f9da9e0c.tar.gz ce0e2d9805b30dcc2686113111c1dfba 1e5cc06bdbf3e1245d8b89c9e3588f507e3c8bc53fe8b8229770a9e8661dea81 https://github.com/ebiggers/libdeflate/archive/c8c56a20f8f621e6a966b716b31f1dedab6a41e3.tar.gz +ce854d7300ee8a356e6889a0f6a965ee a5028d5475f1eaf0ad785c18666b330027a923121d601129f4a61e7bfc89a1dd https://github.com/oven-sh/boringssl/archive/41bf9b59c2ebf277a7aa427e1ecad5cc80dd4d4f.tar.gz ceeb8e315778b9385bcaa3d3cd60390b e9d8abe5b7c1e35b9908a9521e2acd7c1d17547babc01d73c7297e02aebbcc2d https://github.com/litespeedtech/ls-qpack/archive/1e9c5b8e59f8161c54f168a570c8bfdc59ded0c3.tar.gz d3ef6cf1fbedd7f9d706da665bc05f6b f8cb90fb327eb91597c23163bf596c0d1882560be35b661d9ba84891cc461735 https://github.com/litespeedtech/lsquic/archive/3181911301b1aa4f54c1ed690901abc674ee08fb.tar.gz d63099fc6ce4f6e5281d442e8feb24e9 afd83edbe1a2d4accb72e869cd4218bb8665fda2b7cb2c5106fc4be80001a748 https://github.com/oven-sh/lol-html/archive/725ce499aa9b71e38b7a2d0a9fbb6d7294a4079e.tar.gz ++++++ bun-uniform-dwarf.patch ++++++ --- /var/tmp/diff_new_pack.MyFXA1/_old 2026-09-08 16:56:31.231987931 +0200 +++ /var/tmp/diff_new_pack.MyFXA1/_new 2026-09-08 16:56:31.234988056 +0200 @@ -1,7 +1,7 @@ --- a/scripts/build/rust.ts +++ b/scripts/build/rust.ts -@@ -391,6 +391,18 @@ - // Keep frame pointers — matches the C++ side's `-fno-omit-frame-pointer` / `/Oy-` +@@ -376,6 +376,18 @@ + // Keep frame pointers — matches the C++ side's `-fno-omit-frame-pointer` // (flags.ts:293-301). Needed so profilers and crash backtraces can walk Rust frames. rustflags.push("-Cforce-frame-pointers=yes"); + // Emit the same DWARF version as everything else linked in. Clang 21 and the ++++++ bun-vendor-1.4.0.tar.zst -> bun-vendor-1.4.2.tar.zst ++++++ /work/SRC/openSUSE:Factory/bun/bun-vendor-1.4.0.tar.zst /work/SRC/openSUSE:Factory/.bun.new.1265/bun-vendor-1.4.2.tar.zst differ: char 7, line 1 ++++++ webkit-1.4.0.tar.zst -> webkit-1.4.2.tar.zst ++++++ /work/SRC/openSUSE:Factory/bun/webkit-1.4.0.tar.zst /work/SRC/openSUSE:Factory/.bun.new.1265/webkit-1.4.2.tar.zst differ: char 8, line 1 ++++++ webkit.revision ++++++ --- /var/tmp/diff_new_pack.MyFXA1/_old 2026-09-08 16:56:31.321991701 +0200 +++ /var/tmp/diff_new_pack.MyFXA1/_new 2026-09-08 16:56:31.325991869 +0200 @@ -1,2 +1,2 @@ -0f966e81b78c84bb23213e391bc679c4ef83e56b webkit-1.4.0.tar.zst +2e2aa2290fac856d6f451ceacb58f7f5b44dd057 webkit-1.4.2.tar.zst
