Bump mimalloc

[Jarred-Sumner]

Bumps oven-sh/mimalloc from 942b834 to 6a64e1b (12 commits).

• Allocate the per-bin abandoned-page bitmaps on first abandon (arena: allocate the abandoned-page bitmaps on first abandon, and not at all for a heap that is being released mimalloc#32)
• A heap being released abandons its pages unmapped
• Order the heap delete walk against concurrent frees
• Take the meta-data lock before the arena reserve lock in the fork handlers (fork: take the meta-data lock before the arena reserve lock in the fork handlers mimalloc#33)
• Tests for heap release on many threads

[robobun]

^{Updated 11:34 PM PT - Sep 2nd, 2026}

@Jarred-Sumner, your commit 3a2cafb is building: #109666

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Essentials

Run ID: 228d5d3e-53fa-4ed7-89f2-5fae5418a794

📥 Commits

Reviewing files that changed from the base of the PR and between 286c402 and 3a2cafb.

📒 Files selected for processing (1)

• scripts/build/deps/mimalloc.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

Walkthrough

The pull request updates the mimalloc dependency source commit in the build configuration.

Changes

mimalloc update

Layer / File(s)	Summary
Update mimalloc source commit scripts/build/deps/mimalloc.ts	The mimalloc dependency now references commit 6a64e1ba7f5b2130d4efccb67ec87fd0003f0f6a instead of 942b8342575bdece649438ca76f32276a019c51e.

Suggested reviewers: dylan-conway, robobun

Merge Risk: ⚪ Minimal · up to 3a2ca

This updates the pinned mimalloc revision without changing local build integration. No current merge-readiness risk remains.

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the dependency update and lists included changes, but it does not use the required template headings and does not explain how the code was verified.	Add the required "What does this PR do?" and "How did you verify your code works?" sections. Include the verification steps and results, such as the relevant build or test command and its outcome.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely identifies the main change: updating the mimalloc dependency.

• Fix all pre-merge checks with AI

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

LGTM — straightforward vendored-dep pin bump.

What was reviewed:

• Single-line MIMALLOC_COMMIT change; constant name preserved (load-bearing for workflow sed).
• sources: ["src/static.c"] is the unity TU, so upstream file adds/removes don't need a source-list edit here.
• Repo is oven-sh/mimalloc (own fork); no patches to rebase; identity hash invalidates .ref and triggers re-fetch automatically.
• No CODEOWNERS entry covers this path.

Extended reasoning...

Overview

This PR changes exactly one line in scripts/build/deps/mimalloc.ts: the MIMALLOC_COMMIT constant is bumped from 942b834… to b20b60d…. mimalloc is Bun's allocator, vendored as a direct build dep from the oven-sh/mimalloc fork. The build spec compiles only src/static.c (mimalloc's unity translation unit that #includes every other source), so unlike other direct deps with hardcoded source lists, an upstream commit that adds or removes .c files does not require a matching edit here. No patches, defines, cflags, or source-list changes accompany the bump.

Security risks

None introduced by this diff itself — it's a commit-hash edit in a build-config script. The pinned commit is in Bun's own fork (oven-sh/mimalloc), not an arbitrary upstream, so the referenced code is under the project's control. The build system fetches by exact commit hash into vendor/, and the identity hash (sha256 of commit + patch contents) invalidates the .ref stamp so there's no risk of stale sources being reused. Any behavioral risk lives in the mimalloc changes themselves (allocator correctness under threading), which CI compile/link and the test suite exercise; that's outside what a diff review of this file can assess.

Level of scrutiny

Low. scripts/build/CLAUDE.md documents this exact operation as the canonical way to bump a dep ("edit the commit in scripts/build/deps/<name>.ts"), and deps/README.md notes the only follow-up concern for direct deps is source-list drift — which the unity-TU build here sidesteps. The MIMALLOC_COMMIT constant name is unchanged, so any .github/workflows/update-*.yml sed convention is preserved (no update-mimalloc workflow exists anyway). No CODEOWNERS rule covers scripts/build/deps/.

Other factors

The PR author is the project lead and the fork owner. Exit reason was dry_streak with no findings and no ruled-out candidates. The timeline shows no third-party reviews or outstanding objections. This is precisely the "config tweaks / version bumps" category the approval guidelines call out as safe to approve.

[claude]

Code review found no issues

No high-confidence issues detected in this change.