opencode 1.19.4 runs on Bun 1.4.4, with its security fixes
v1.19.4"packageManager": "bun@1.3.14" "bun@1.4.4"
Version 1.19.4 moves opencode onto a newer Bun. The runtime goes from 1.3.14 to 1.4.4, which brings security fixes and newer root certificates. Two smaller changes ride along with it: the Linux musl builds keep working on the new Bun, and the Nix flake drops Intel Macs.
Bun 1.4.4 patches the network code an agent's requests travel through
v1.19.4The security fixes in Bun 1.4.4 cover Brotli compression, TLS, all three versions of HTTP, WebSocket, and fetch. That is the layer an agent's calls to a model provider go through. There's nothing to configure; upgrading is how you get the fixes.
Root certificates move to NSS 3.131.1
v1.19.4Bun's bundled root certificates move to Mozilla's NSS 3.131.1
the trusted certificate authorities Bun checks an HTTPS server against
Bun 1.4.4 also refreshes the root certificates it bundles, to version 3.131.1 of Mozilla's Network Security Services. That list of trusted certificate authorities is what Bun checks a server against when it opens an HTTPS connection, so certificate checks run against the current list.
Linux musl builds keep their native packages on Bun 1.4.4
v1.19.4// Bun 1.4.4 skips native packages for the other libc by default,
// but the musl targets need them.
bun install --os="*" --cpu="*" --libc="*" @opentui/core
bun install --os="*" --cpu="*" --libc="*" @parcel/watcher
bun install --os="*" --cpu="*" --libc="*" @ff-labs/fff-bunBun 1.4.4 also changed how it installs on Linux. It now skips native packages built for the other C library, which would have left the musl builds, the ones for systems like Alpine, without theirs. So the build scripts now pass libc star when they fetch OpenTUI, Parcel's file watcher and fff, and the musl builds keep their native code.
The Nix flake drops Intel Macs
v1.19.4systems = [
"aarch64-linux"
"x86_64-linux"
"aarch64-darwin"
"x86_64-darwin"
];packages = with pkgs; [
bun
nodejs_20
nodejs
…
];If you install opencode from its Nix flake, check your machine. The flake's list of systems drops x86_64-darwin, which is Intel Macs, and the hash workflow stops running on an Intel Mac. Apple silicon and both Linux architectures stay. The development shell also moves from Node 20 to the default Node in nixpkgs. Only the Nix files change here; the other install methods are untouched by this part of the release.
Upgrade with opencode upgrade v1.19.4
v1.19.4Upgrade to get Bun 1.4.4 and its security fixes
opencode upgrade v1.19.4
Except from the Nix flake on an Intel Mac, which it no longer lists.
To upgrade, run opencode upgrade with the version. The one exception is the Nix flake on an Intel Mac, which no longer lists that platform. Everyone else gets Bun 1.4.4 and its security fixes by upgrading, with no settings to change.
