opencode 1.19.4 runs on Bun 1.4.4, with its security fixes

Version 1.19.4 moves opencode onto a newer Bun. The runtime goes from 1.3.14 to 1.4.4, which brings security fixes and newer root certificates. Two smaller changes ride along with it: the Linux musl builds keep working on the new Bun, and the Nix flake drops Intel Macs.

Slide text

v1.19.4

core

"packageManager": "bun@1.3.14"  "bun@1.4.4"

package.json · previous release v1.19.3

The security fixes in Bun 1.4.4 cover Brotli compression, TLS, all three versions of HTTP, WebSocket, and fetch. That is the layer an agent's calls to a model provider go through. There's nothing to configure; upgrading is how you get the fixes.

Slide text

v1.19.4

security

Brotli

TLS

HTTP/1.1

HTTP/2

HTTP/3

WebSocket

fetch

+ root certificates

Fig. Areas named in the release notes · bun.com/blog/bun-v1.4.4#security

Bun 1.4.4 also refreshes the root certificates it bundles, to version 3.131.1 of Mozilla's Network Security Services. That list of trusted certificate authorities is what Bun checks a server against when it opens an HTTPS connection, so certificate checks run against the current list.

Slide text

v1.19.4

security

Bun's bundled root certificates move to Mozilla's NSS 3.131.1

3.131.1

the trusted certificate authorities Bun checks an HTTPS server against

Fig. NSS: Mozilla's Network Security Services

Bun 1.4.4 also changed how it installs on Linux. It now skips native packages built for the other C library, which would have left the musl builds, the ones for systems like Alpine, without theirs. So the build scripts now pass libc star when they fetch OpenTUI, Parcel's file watcher and fff, and the musl builds keep their native code.

Slide text

v1.19.4

fixed · #58107

// Bun 1.4.4 skips native packages for the other libc by default,
// but the musl targets need them.
bun install --os="*" --cpu="*" --libc="*" @opentui/core
bun install --os="*" --cpu="*" --libc="*" @parcel/watcher
bun install --os="*" --cpu="*" --libc="*" @ff-labs/fff-bun

Fig. packages/opencode/script/build.ts (same flag in packages/cli/script/build.ts)

If you install opencode from its Nix flake, check your machine. The flake's list of systems drops x86_64-darwin, which is Intel Macs, and the hash workflow stops running on an Intel Mac. Apple silicon and both Linux architectures stay. The development shell also moves from Node 20 to the default Node in nixpkgs. Only the Nix files change here; the other install methods are untouched by this part of the release.

Slide text

v1.19.4

could break · Nix

flake.nix · systems

systems = [
  "aarch64-linux"
  "x86_64-linux"
  "aarch64-darwin"
  "x86_64-darwin"
];

flake.nix · devShells.default

packages = with pkgs; [
  bun
  nodejs_20
  nodejs
  …
];

Fig. flake.nix, nix/node_modules.nix, .github/workflows/nix-hashes.yml (macos-15-intel runner removed)

To upgrade, run opencode upgrade with the version. The one exception is the Nix flake on an Intel Mac, which no longer lists that platform. Everyone else gets Bun 1.4.4 and its security fixes by upgrading, with no settings to change.

Slide text

v1.19.4

upgrade

Upgrade to get Bun 1.4.4 and its security fixes

opencode upgrade v1.19.4

Except from the Nix flake on an Intel Mac, which it no longer lists.

github.com/anomalyco/opencode/releases/tag/v1.19.4