This repository was archived by the owner on Nov 7, 2026. It is now read-only.
Repository navigation
fix(opencode): bundle Bun 1.4.4 security update - #407
Merged
Merged
Conversation
Task: swxtchio/swx-opencode#392; donor anomalyco#58087 at 37d9737 with the required -x provenance. - Cherry-pick the donor and resolve fork-path conflicts in the existing runtime, workflow, dependency, and test owners. - Preserve the fork dependency graph, workflow guards, FFF packaging, and native fetch integrity; record the backport in CHANGESET.md. - Prove fresh-install photon behavior and Solid TSX component behavior with focused red/green tests, package typechecks, and the workflow guard. - Qualify clean, source-pinned native candidate bytes on the authorized build box; leave fleet installation to Firstmate after merge.
Author
|
Session ID: unknown |
Co-authored-by: Hona <[email protected]> (cherry picked from commit 37d9737)
Adapt the donor's dependency lock, test preloads, Nix pins, photon WASM patch, and FFF type surface to the fork. The focused Bun 1.4.4 tests and package-local typechecks are complete. Nix matrix hashes and leased ARM64/x64 candidate qualification remain pending.
# Conflicts: # CHANGESET.md
# Conflicts: # nix/hashes.json # package.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes swxtchio/swx-opencode#392.
Backports
anomalyco/opencode#58087from37d973754ba6cc31732f93421c0c18b675841573withgit cherry-pick -x, adapting the Bun 1.4.4 runtime/type pins and Solid TSX test setup to this fork. The donor-only fixture and Figma package paths remain omitted. Fork workflow guards and FFF sidecar packaging are preserved. The donor'sBUN_COMPILE_RELEASEexport remains inert inpublish.yml: neither build script consumes it, and the publish jobs are guarded toanomalyco/opencode.This PR is separately scoped to #392 and merges the
swxtchbase through #406 (including #399) without rebasing.Verification
bun install --frozen-lockfilepassed on the combined Solid 1.9.15 / Seroval 1.5.6 lock (2,356 packages); focused UI Solid JSX, photon WASM, App transition/session-router cleanup, and Console Seroval codec/forged-Promise tests passed.bun typecheckpassed.bun turbo typecheck: 30/30 packages passed on commitbdea406bed. Current-head GitHub typecheck run41938651389passed after its first attempt hit a transient HTTP 5xx downloading@solidjs/startfrom pkg.pr.new.41891323416passed all four Nix hash/package builds and both Windows FFF jobs; previous current-head run41938651318passed. New-head FFF run41950834172is queued.41950834116and unit/e2e run41950834253are queued. Firstmate's final pre-merge suite remains the merge gate.Round-two Bun 1.4.4 validation
bun-linux-aarch64.zipmatched itsSHASUMS256.txtentry (baa6bb36f51d6e58561e02bbea825038a9df454f673d6d776e8bbf86f8c7850e); the extracted binary SHA-256 is354c2b049c716aca07b2e5cddb887928ac58950675d1258bb6312083917793b6and reports Bun1.4.4+38afee6c8. The official x64 zip was checksum-verified too (bf8ccbfb2b0b80159e0f9a6d15c55317add8077534dbc6130a3edb52fccb395c); the test host is aarch64, so local runs used the native aarch64 binary, not the host Bun 1.4.2.packages/appbun run test:unitpassed 724 tests; fullbun run testpassed 724 unit and 49 browser tests.packages/opencodetest/pluginpassed 234 tests.packages/opencodebun run testrun reported 4653 pass, 29 skip, 1 todo, and 5 failures: ACP stdin-EOF timeout, online-prune child SIGTERM, failed-transport question timeout, Foundry progress timeout, and Chat Completions progress assertion. Filtered single-thread reruns passed prune and both progress tests; ACP and failed-transport question timeouts persisted. Existing follow-ups: Flaky: 'acp lifecycle subprocess > stdin EOF exits cleanly' fails via Effect TimeoutError - green in CI, red in worktree isolation on the same head #309, test: investigate held question receiver subprocess timeout in CI #327, test(opencode): prune.test.ts afterAll removes the shared scratch root other invocations use #409, Follow-up: validate Foundry keepalive signature after #302 #308 and Follow-up: account for non-text OpenAI SSE progress #310.1.4.4+38afee6c8, and a genericoopscannot satisfy the status check.Native candidate evidence
be97d389ea855ee8d209f2d66a68a8d8dbcc7793, version1.18.32-swxtch.be97d389; archive 79,293,696 bytes, SHA-25670855564b4a0845ba52c2ec02df5e4df8b00a7975cd4aba4d6bee8ff03532649. Native FFF/session/database probes passed. Full evidence:docs/verification/bun-1.4.4-candidate/final/arm64/evidence/.be97d389ea855ee8d209f2d66a68a8d8dbcc7793, version1.18.32-swxtch.be97d389, qualified onabbe-build-001; archive 79,891,319 bytes, SHA-2564c8b10337d1da27ee0803947a890bfab6ba648ef056d4d0c5e713c9db5c91b03, executable SHA-25678029fec8a2d5b6398e5cdb93b60c5e06e1da30aeba926f68d7718c3dd06894c, sidecar SHA-256977a96fc9911edd8cabacb098e90229c6a2dde7384f3291e5beccaf1ee93fef5. Native FFF/session/database probes passed. Full evidence:docs/verification/bun-1.4.4-candidate/final/x64/evidence/.Both final embedded-Bun proofs report
matches_compiler:falsebecause they literally compare the full compiler revision with Bun's abbreviated--revisionoutput;--versionis 1.4.4 and fallback binary strings match the full revision, so these are successful proofs.Neither candidate was installed on a fleet host or published.