bundler: resolve require('bindings')(name) to the package's .node addon at build time

.aikido

@@ -5,7 +5,6 @@ exclude:
     - bench
     - packages/bun-lambda
     - packages/bun-release
-    - packages/bun-wasm
     - packages/bun-vscode
     - packages/bun-plugin-yaml
     - packages/bun-plugin-svelte

.buildkite/ci.mjs

@@ -188,7 +188,8 @@ const testPlatforms = [
   // lanes — see buildPlatforms).
   { os: "darwin", arch: "aarch64", release: "26", tier: "latest" },
   { os: "darwin", arch: "aarch64", release: "14", tier: "previous" },
-  { os: "darwin", arch: "x64", release: "14", tier: "latest" },
+  // x64 is off until enough Intel test agents are back on the queue.
+  // { os: "darwin", arch: "x64", release: "14", tier: "latest" },
   { os: "linux", arch: "aarch64", distro: "debian", release: "13", tier: "latest" },
   { os: "linux", arch: "x64", distro: "debian", release: "13", tier: "latest" },
   { os: "linux", arch: "x64", profile: "asan", distro: "debian", release: "13", tier: "latest" },
@@ -375,26 +376,17 @@ function getEc2Agent(platform, options, ec2Options) {
  * @param {PipelineOptions} options
  * @returns {string}
  */
-function getCppAgent(platform, options) {
+function getBuildAgent(platform, options) {
   // Every build lane runs on the single debian-13 aarch64 host image
   // (buildHostPlatform) and cross-compiles to its target; the target's
   // os/arch only affect build args, not agent tags or image-name.
+  const { os, arch, abi, profile } = platform;
+  // Lanes without LTO (see ltoDefault in scripts/build/config.ts): rustc does its own fat LTO + codegen inside cargo, so the C++ compile overlapping it costs ~20s on 16 vCPUs; give them 32.
+  const nonLto =
+    profile === "asan" || abi === "android" || os === "freebsd" || (os === "windows" && arch === "aarch64");
   return getEc2Agent(buildHostPlatform, options, {
-    instanceType: "c8g.4xlarge",
-  });
-}
-
-/**
- * @param {Platform} platform
- * @param {PipelineOptions} options
- * @returns {string}
- */
-function getLinkBunAgent(platform, options) {
-  return getEc2Agent(buildHostPlatform, options, {
-    // rust-and-link runs cargo (~200 crates) then ThinLTO-links the full graph
-    // on one box; r8g.xlarge is too tight. ASAN's -Zbuild-std cargo pass
-    // doubles the IR, so size that lane for cores.
-    instanceType: platform.profile === "asan" ? "r8g.4xlarge" : "r8g.2xlarge",
+    // Replaces the c8g.4xlarge (C++) + r8g.2xlarge (cargo + ThinLTO link; r8g.4xlarge for asan) pair.
+    instanceType: nonLto ? "r8g.8xlarge" : "r8g.4xlarge",
   });
 }
 
@@ -469,7 +461,7 @@ function getTestAgent(platform, options) {
  *
  * @param {Target} target
  * @param {PipelineOptions} options
- * @param {"cpp-only" | "rust-only" | "link-only" | "rust-and-link"} mode
+ * @param {"build" | "cpp-only" | "rust-only" | "link-only" | "rust-and-link"} mode
  * @returns {string}
  */
 function getBuildArgs(target, options, mode) {
@@ -498,7 +490,7 @@ function getBuildArgs(target, options, mode) {
 /**
  * @param {Target} target
  * @param {PipelineOptions} options
- * @param {"cpp-only" | "rust-only" | "link-only" | "rust-and-link"} mode
+ * @param {"build" | "cpp-only" | "rust-only" | "link-only" | "rust-and-link"} mode
  * @returns {string}
  */
 function getBuildCommand(target, options, mode) {
@@ -515,11 +507,13 @@ function getBuildCommand(target, options, mode) {
 }
 
 /**
+ * deps + C++ + cargo + link on one agent; also uploads libbun-*.a, libbun_rust.a and the dep libs.
+ *
  * @param {Platform} platform
  * @param {PipelineOptions} options
  * @returns {Step}
  */
-function getBuildCppStep(platform, options) {
+function getBuildBunStep(platform, options) {
   const { os, arch } = platform;
   // BoringSSL's win-x64 assembly is NASM syntax. The agent images bake nasm
   // (.buildkite/Dockerfile); best-effort install covers older images, and
@@ -531,35 +525,10 @@ function getBuildCppStep(platform, options) {
           "which nasm || (apt-get update -qq && apt-get install -y -qq nasm) || dnf install -y -q nasm || yum install -y -q nasm || true",
         ]
       : [];
-  return {
-    key: `${getTargetKey(platform)}-build-cpp`,
-    label: `${getTargetLabel(platform)} - build-cpp`,
-    agents: getCppAgent(platform, options),
-    retry: getRetry(),
-    cancel_on_build_failing: isMergeQueue(),
-    // cpp-only builds deps + bun's C++ in one ninja graph (ninja pulls
-    // everything the archive transitively needs). The old two-command
-    // split (--target bun, --target dependencies) was a cmake artifact.
-    command: [...nasmSetup, getBuildCommand(platform, options, "cpp-only")],
-  };
-}
-
-/**
- * cargo build + link on one agent. Runs in parallel with build-cpp (no
- * depends_on); the build script runs `ninja bun-rust` first, then polls
- * `buildkite-agent step get outcome` for `<target>-build-cpp`, downloads
- * its archive, and links. Key is `-build-bun` (it produces the final zip)
- * so test/release/verify-baseline/binary-size depends_on stay unchanged.
- *
- * @param {Platform} platform
- * @param {PipelineOptions} options
- * @returns {Step}
- */
-function getBuildBunStep(platform, options) {
   return {
     key: `${getTargetKey(platform)}-build-bun`,
     label: `${getTargetLabel(platform)} - build-bun`,
-    agents: getLinkBunAgent(platform, options),
+    agents: getBuildAgent(platform, options),
     retry: getRetry(),
     cancel_on_build_failing: isMergeQueue(),
     timeout_in_minutes: 60,
@@ -568,7 +537,7 @@ function getBuildBunStep(platform, options) {
       // linked binary's startup during the smoke test.
       ASAN_OPTIONS: "allow_user_segv_handler=1:disable_coredump=0:detect_leaks=0",
     },
-    command: getBuildCommand(platform, options, "rust-and-link"),
+    command: [...nasmSetup, getBuildCommand(platform, options, "build")],
   };
 }
 
@@ -1471,7 +1440,7 @@ async function getPipeline(options = {}) {
   }
 
   const { buildPlatforms = [], testPlatforms = [], buildImages, publishImages, imageFilter } = options;
-  // Every build lane runs on buildHostPlatform (see getCppAgent/getLinkBunAgent),
+  // Every build lane runs on buildHostPlatform (see getBuildAgent),
   // so the build-image set is exactly {buildHostPlatform} ∪ testPlatforms' native
   // images — buildPlatforms entries encode TARGET os/arch/abi, not a host image.
   const imagePlatforms = new Map(
@@ -1519,22 +1488,20 @@ async function getPipeline(options = {}) {
 
     steps.push(
       ...relevantBuildPlatforms.map(target => {
-        // build-cpp/build-bun always run on buildHostPlatform regardless of
+        // build-bun always runs on buildHostPlatform regardless of
         // target, so the only build-image dependency is the host's.
         const imageKey = getImageKey(buildHostPlatform);
         const dependsOn = [];
         if (imagePlatforms.has(imageKey)) {
           dependsOn.push(`${imageKey}-build-image`);
         }
 
-        const steps = [];
-        steps.push(getBuildCppStep(target, options));
-        steps.push(getBuildBunStep(target, options));
+        const steps = [getBuildBunStep(target, options)];
 
         if (needsBaselineVerification(target)) {
           // verify-baseline runs on a per-target-arch native host (see
           // getVerifyBaselineHost), not buildHostPlatform; its image dep goes
-          // on the step itself so build-cpp/build-bun don't wait for it.
+          // on the step itself so build-bun doesn't wait for it.
           const verifyImageKey = getImageKey(getVerifyBaselineHost(target));
           const verifyDeps =
             verifyImageKey !== imageKey && imagePlatforms.has(verifyImageKey) ? [`${verifyImageKey}-build-image`] : [];
@@ -1553,7 +1520,7 @@ async function getPipeline(options = {}) {
         );
         if (traceOn && (isMainBranch() || /\[generate symbol order\]/i.test(getCommitMessage()))) {
           // The trace host's image, same as verify-baseline: on the step, so
-          // build-cpp/build-bun don't wait for it. Darwin has no cloud image.
+          // build-bun doesn't wait for it. Darwin has no cloud image.
           const traceImageKey = getImageKey(traceOn.on);
           const traceDeps =
             traceImageKey !== imageKey && imagePlatforms.has(traceImageKey) ? [`${traceImageKey}-build-image`] : [];

.claude/commands/upgrade-nodejs.md

@@ -27,8 +27,8 @@ Bun reports a Node.js version for compatibility with the Node.js ecosystem. This
   - Update `Bun__versions_v8` with the V8 version (find using command below)
 
 ### 4. N-API Version
-- `src/napi/js_native_api.h`
-  - Update `NAPI_VERSION` define (check Node.js release notes)
+- `src/runtime/napi/js_native_api_types.h`
+  - Update `NAPI_VERSION` define (check Node.js release notes; see `src/runtime/napi/README.md` for the header resync procedure)
 
 ## Files That May Need Updates
 

.claude/skills/verify/SKILL.md

@@ -37,6 +37,8 @@ For worker/subprocess-shaped changes, spawn a subprocess (still `-e`) so worker
   formula shadows the pinned nightly, and `bun bd` dies with `the option 'Z' is only
   accepted on the nightly compiler`. `bun bd` re-runs cargo on every invocation, so
   this is needed for follow-up runs too, not just the first build.
+- `node:cluster` changes can't be driven with `-e`: `cluster.fork()` re-execs `argv[1]`, so workers need a real file on disk. Write a scratch script and run `./build/debug/bun-debug <file>`.
+- Only one `bun bd` per worktree at a time — a second one blocks on the build lock and looks like a runtime hang. Build once, then drive `./build/debug/bun-debug` directly under `timeout`.
 - `BUN_DEBUG_QUIET_LOGS=1` suppresses debug-build log spam.
 - Debug builds print `[cachefs]`/`[sys]` lines to stdout; filter them before diffing
   output against `node`.

.gitattributes

@@ -24,10 +24,15 @@
 
 *.lockb binary diff=lockb
 
+# XML loader fixtures in specific byte encodings (BOMs, UTF-16, ISO-8859-1);
+# any newline or encoding normalization would change what they test.
+test/js/bun/resolve/xml/xml-utf16le-bom.xml -text
+test/js/bun/resolve/xml/xml-utf16be-bom.xml -text
+test/js/bun/resolve/xml/xml-utf8-bom.xml -text
+test/js/bun/resolve/xml/xml-latin1.xml -text
+
 .vscode/launch.json linguist-generated
-src/api/schema.d.ts linguist-generated
 fixture.*.c linguist-generated
-src/api/schema.js linguist-generated
 *-fixture* linguist-generated
 src/jsc/bindings/ZigGeneratedCode.h linguist-generated
 src/jsc/bindings/ZigGeneratedCode.cpp linguist-generated

.github/actions/setup-bun/action.yml

@@ -23,6 +23,10 @@ runs:
   steps:
     - name: Setup Bun
       shell: bash
+      env:
+        BUN_VERSION: ${{ inputs.bun-version }}
+        BUN_BASELINE: ${{ inputs.baseline }}
+        BUN_DOWNLOAD_URL: ${{ inputs.download-url }}
       run: |
         case "$(uname -s)" in
           Linux*)  os=linux;;
@@ -33,19 +37,19 @@ runs:
           arm64 | aarch64)  arch=aarch64;;
           *)                arch=x64;;
         esac
-        case "${{ inputs.baseline }}" in
+        case "$BUN_BASELINE" in
           true | 1) target="bun-${os}-${arch}-baseline";;
           *)        target="bun-${os}-${arch}";;
         esac
-        case "${{ inputs.bun-version }}" in
+        case "$BUN_VERSION" in
           latest) release="latest";;
           canary) release="canary";;
-          *)      release="bun-v${{ inputs.bun-version }}";;
+          *)      release="bun-v${BUN_VERSION}";;
         esac
-        curl -LO "${{ inputs.download-url }}/${release}/${target}.zip" --retry 5
-        unzip ${target}.zip
-        mkdir -p ${{ runner.temp }}/.bun/bin
-        mv ${target}/bun* ${{ runner.temp }}/.bun/bin/
-        chmod +x ${{ runner.temp }}/.bun/bin/*
-        ln -fs ${{ runner.temp }}/.bun/bin/bun ${{ runner.temp }}/.bun/bin/bunx
-        echo "${{ runner.temp }}/.bun/bin" >> ${GITHUB_PATH}
+        curl -LO "${BUN_DOWNLOAD_URL}/${release}/${target}.zip" --retry 5
+        unzip "${target}.zip"
+        mkdir -p "$RUNNER_TEMP/.bun/bin"
+        mv "${target}"/bun* "$RUNNER_TEMP/.bun/bin/"
+        chmod +x "$RUNNER_TEMP"/.bun/bin/*
+        ln -fs "$RUNNER_TEMP/.bun/bin/bun" "$RUNNER_TEMP/.bun/bin/bunx"
+        echo "$RUNNER_TEMP/.bun/bin" >> "$GITHUB_PATH"

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directories:
+      - /
+      - /.github/actions/*
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]

.github/workflows/CLAUDE.md

@@ -21,7 +21,7 @@ The `format.yml` workflow runs code formatters (Prettier, clang-format, and `car
 
 **Important exclusions**:
 
-- `src/napi/` - Node API headers (third-party)
+- `src/runtime/napi/` - Node API headers (third-party)
 - `src/jsc/bindings/libuv/` - libuv headers (third-party)
 - `src/jsc/bindings/sqlite/` - SQLite headers (third-party)
 - `src/runtime/ffi/ffi-*.h` - FFI headers (generated/third-party)
@@ -55,7 +55,7 @@ The workflow runs all three formatters simultaneously:
 
 1. Bump `channel` in `rust-toolchain.toml` (and `Dockerfile`/`bootstrap.sh` to match).
 2. Bump `RUSTUP_TOOLCHAIN` in the `Format Code` step's `env:` block in `format.yml` to the same value.
-3. Bump `RUSTUP_TOOLCHAIN` in the workflow-level `env:` block in `clippy.yml` and `miri.yml` to the same value.
+3. Bump `RUSTUP_TOOLCHAIN` in the workflow-level `env:` block in `clippy.yml`, `miri.yml`, and `lolhtml.yml` to the same value.
 4. `cargo fmt` formatting can change between nightlies; run `cargo fmt --all` locally on the new toolchain and include the resulting diff in the same PR.
 
 #### To update clang-format version:

.github/workflows/auto-assign-types.yml

@@ -1,5 +1,8 @@
 name: Auto Assign Types Issues
 
+permissions:
+  contents: read
+
 on:
   issues:
     types: [labeled]
@@ -15,5 +18,6 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}
+          ISSUE: ${{ github.event.issue.number }}
         run: |
-          gh issue edit ${{ github.event.issue.number }} --add-assignee alii
+          gh issue edit "$ISSUE" --add-assignee alii

.github/workflows/auto-close-duplicates.yml

@@ -1,4 +1,7 @@
 name: Auto-close duplicate issues
+permissions:
+  contents: read
+
 on:
   schedule:
     - cron: "0 9 * * *"
@@ -17,7 +20,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Bun
         uses: ./.github/actions/setup-bun

.github/workflows/auto-label-claude-prs.yml

@@ -1,5 +1,8 @@
 name: Auto-label Claude PRs
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     types: [opened]
@@ -13,7 +16,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Add claude label to PRs from robobun
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             github.rest.issues.addLabels({

.github/workflows/bun-types.yml

@@ -30,7 +30,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Bun
         uses: ./.github/actions/setup-bun
         with: