http: consolidate the open fetch, Bun.serve, node:http, node:http2 and HTTP/3 pull requests - #46528

What does this PR do?

In progress. This text can lag a push behind.

Consolidates the open pull requests for fetch, Request / Response / Headers, Bun.serve, node:http, node:http2, HTTP/3, node:quic and the undici / node-fetch shims into one.

This branch is built on top of #46522 (node:net, node:tls, usockets) and contains its commits, so #46522 should be merged first. Until then the diff here shows both. Everything below is about this PR's own changes.

All 642 open PRs in that area were checked against Bun 1.4.4, which was main when the work started. For node:* behavior the same script ran on Node 26.12.1 first, and Node's answer decided. 146 PRs are included in part, 48 were already fixed, 15 are duplicates, 113 were skipped and 89 are left for a maintainer to decide. All the others are included whole, usually rewritten smaller.

After the ports, a second pass over the branch gave each rule one owner. A check that two layers made is now made once, in the layer that owns the data, and code that nothing calls any more is deleted with its tests. So this PR's own diff removes more than it adds: +21,450 -30,166 lines under src/ and packages/, a net 8,716 fewer. In the diff, req.socket is a plain net.Socket / tls.TLSSocket. node:http has one implementation per kind of connection (uWS for listen(), a port of Node's own connection code for every other stream) and one queue of waiting responses. node:http2 has one stream table and shares its wire types with fetch's HTTP/2 client, fetch has one table of in-flight requests, and Bun.serve, fetch and node:quic share one QUIC transport layer. Facts about a body (it was a string, fetch() decoded it, its type) travel with the body.

The body is at GitHub's size limit, so these lists are in comments below: every behavior change with its 1.4.4 behavior next to it (it continues in a second comment), after it the PRs that are not included, and what was added since.

Read these first

These are the changes most likely to be noticed by a program that works today.

Bun.serve

• A Bun.file() body whose file is missing answers 404, and 403 if the process may not read it. 1.4.4 answered 500 and printed the error. error() still runs first and its Response wins. (Bun.serve: map Bun.file() open errors to 404/403 instead of 500 #36593)
• HEAD has GET's status and headers for file bodies, so a HEAD health check on a missing file turns from 200 into 404. (Bun.serve: resolve a file body for HEAD the same way as for GET #41585)
• A proxy written as new Response(upstream.body, upstream) no longer forwards Content-Encoding next to a body fetch() already decoded. A body that went through pipeThrough() or the program's own code keeps the header. (Bun.serve: drop Content-Encoding when serving a fetch()-decoded Response #35546)
• A request that arrives while the previous response is pending now waits and is answered. 1.4.4 closed the connection. (Bun.serve: hold a pipelined request until the response ahead of it completes instead of closing the connection #38128)
• After a response that closes the connection, the server sends its FIN and waits for the client's, for 10 to 14 s at most. A client that's still uploading gets the response instead of a reset. 1.4.4 closed right away. stop() and the process don't wait for such a connection. (Bun.serve: hold a pipelined request until the response ahead of it completes instead of closing the connection #38128)
• The head of a streamed response goes out right away, so await fetch() against such a server resolves before the first body byte. A stream that produces its whole body in a later task is Transfer-Encoding: chunked where 1.4.4 sent Content-Length. (Bun.serve: send the whole HTTP/1.1 response head when a streamed body is not ready #45187)
• idleTimeout follows progress, not only reads. A download stays open while the client takes at least 16 KB/s, where 1.4.4 cut every response whose write stayed blocked for idleTimeout. The rule is the same after every kind of request. (Bun.serve: do not idle-time-out a response the peer is still reading #41602, Bun.serve: keep idleTimeout armed while an HTTP/1 response write is blocked #44894)
• idleTimeout applies before the first request too. 1.4.4 used about 10 s there, whatever the option said. (Bun.serve: apply server.timeout(req, n) to a Bun.file response body #45788)
• A response to Connection: close or HTTP/1.0 says Connection: close, and responses without a body carry Date. (Bun.serve: send Connection: close in the final response whenever the connection closes after it #43867)
• An unknown method gets a 501 instead of a closed socket, and the request head is validated more strictly. (Bun.serve: answer 501 to an unknown method and 404 to a router miss, not a closed socket #45396, Bun.serve: answer 400 to a request with more than one Host header line #44241)
• A chunked request body can end with a trailer section. 1.4.4 answered 400. (Bun.serve: consume chunked trailer-part instead of rejecting it #32887)
• process.env.NODE_ENV = "production" set before Bun.serve() selects production mode, as the docs say. 1.4.4 only looked at the value at process start. (Bun.serve: decide the development default from the live process.env #41926)
• await server.stop() waits for HTTP/3 and cleartext HTTP/2 connections to drain. The wait for an HTTP/2 client's FIN is capped at 10 to 14 s. stop(true) doesn't wait. (Bun.serve(http3): resolve stop() after the UDP socket and the last QUIC connection are gone #45419, Bun.serve http2: close a connection gracefully with a FIN, not with close(2) #44874)
• A body over maxRequestBodySize aborts req.signal, and a response that already started ends in a reset. (Bun.serve: abort the request when its body exceeds maxRequestBodySize #45999)
• A failed Bun.serve() or Bun.listen() has the kernel's code and a negative errno (-98, where 1.4.4 had 0 and 98). (Return the error of a failed listen from usockets to Bun.serve and Bun.listen #44651)

fetch, Request, Response

• A method outside Bun's table is sent as written. 1.4.4 sent GET for LIST or any other token it did not know. The six Fetch verbs are upper-cased, so fetch("s3://...", { method: "Delete" }) was a read and now deletes. (fetch, Request, server.fetch: stop sending GET for a method outside the method table #44718)
• text() and json() drop a leading BOM for every kind of body, not only for bytes from the network. (fetch, streams: drop one leading UTF-8 BOM in text() and json() of string and stream bodies #45486)
• (await req.blob()).type is the Content-Type header, however the body arrived. On 1.4.4 it was text/plain for a body that hadn't arrived yet and empty for a stream. A formData() that can't be parsed always rejects with a TypeError whose code is ERR_FORMDATA_PARSE_ERROR, where 1.4.4 had four texts. (Keep the body's Content-Type on Response and Request after the body is consumed #45601)
• Keep-Alive: timeout=N is honored. 1.4.4 reused an idle connection for up to 300 s whatever the server said. (fetch: stop reusing a pooled keep-alive connection before the origin closes it #45497)
• A response that's complete on the wire gives its connection back before the body is read, and an unread compressed body is decoded only as fast as it's read, on every protocol. (http3: pause a stream by holding its flow-control window #45612)
• A redirect's Location is resolved by the URL parser only. A few malformed values now go where new URL(), browsers and Node say. (http: don't treat relative redirect URLs containing '://' as absolute #30065)
• response.type is "basic", response.url has no fragment, and data: URLs go through the URL parser. (fetch: set Response.type and exclude URL fragments per the fetch spec #33499, fetch: data: URL Content-Type and fragment per the Fetch standard #34896)
• File.type of a multipart part is the part's Content-Type, not a guess from the file name. (Bun.serve, FormData: stop content-sniffing typeless Blob bodies into image/* types #35244)
• fetch() of a missing file: URL rejects. 1.4.4 resolved with a 200 and the body read rejected. (fetch: reject file: URLs whose path cannot be read #37425)
• Script reads on a cloned body get their own copy of each chunk. Both bodies used to hand out the same Uint8Array. Reading both with reader.read() is 2.0 to 3.6x slower. text(), json(), bytes() and sending the body copy nothing extra. (Response.clone(): copy a chunk when a body-clone branch hands it to script #46080)
• A pipe or device as a request body is read to EOF. 1.4.4 stopped after 262,160 bytes. An endless source such as /dev/zero is read up to 4 GiB and then rejects with ENOMEM. (fetch: stream a Bun.file() body that is a FIFO, socket, or device instead of reading it on the JS thread #41488)

node:http

• req.socket is a plain net.Socket or tls.TLSSocket, and 'upgrade' and 'connect' listeners get that same socket. socket.address() is the local address (1.4.4: the peer's), 'close' gets hadError, encrypted is undefined on a plain socket, _handle.fd is the descriptor, and unref() works after the hand-off.
• https.Server extends tls.Server, as in Node, so an https server is no instanceof http.Server. OpenTelemetry sees plain http.Server requests again. 1.4.4 lost them. (node:https: make https.Server extend tls.Server instead of http.Server #46589) Fixes https.Server inherits from http.Server since 1.4.4, which drops OpenTelemetry HTTP server spans #46567.
• An https.Server negotiates ALPN. A client that offers only h2 gets the no_application_protocol alert, as in Node. 1.4.4 served it. A failed handshake emits 'clientError' and 'tlsClientError'.
• headersTimeout decides how long a server waits for a complete request head: 60 s by default, then a 408, as in Node. 1.4.4 closed the connection after about 12 s. (node:http: apply the server's idleTimeout at accept so headersTimeout > ~13s is honored #35672)
• listen({ port, path }) binds the TCP port, also for port: 0, undefined or null, as in Node. 1.4.4 bound the unix socket. listen(null) picks a free port instead of 3000 or $PORT. listen({ fd }) listens on the descriptor instead of a random port. (Bun.serve: throw when both port and unix are given #41660, node:http: bind an ephemeral port when the listen() port is null #43726, Bun.serve({ fd }) and node:http listen({ fd }): serve on an inherited socket #44013)
• 'drain' fires once, when the bytes have left, so a writer paced by it runs at the client's speed. 1.4.4 fired it twice. (test(node:http): speed up node-http-connect.test.ts and assert exact tunnel bytes #40897, node:http: gate 'drain' on the bytes of the handle, give write callbacks to the stream #46014)
• In node:cluster workers listen() asks the primary, so server.address() is null until 'listening', listen(0) gives all workers one port, and worker.disconnect() closes http servers. Not on Windows. (node:http: cluster workers listen through the primary's shared handle, Bun.serve({ fd }) #45186)
• Listen errors have Node's message and a negative errno. Text that matched Failed to start server no longer matches. code and syscall are unchanged. (fix(node): format HTTP listen errors #42742, Return the error of a failed listen from usockets to Bun.serve and Bun.listen #44651)
• Connections passed in with emit('connection'), and HTTP/1.1 on an allowHTTP1 server, run a port of Node's own connection code, so they follow Node's rules for Host, backpressure, trailers and the server's timeouts. (node:http: answer a request without Host with 400 on emit('connection') and allowHTTP1 connections #37735, node:http: stop reading a connection served from JS while the request buffer is full #45841, node:http, node:http2: give emit('connection') and allowHTTP1 connections the server's timers and error path #46185)
• A response destroyed before it was sent resets the connection. 1.4.4 sent an empty 200. (node:http: send nothing on destroy() before the headers go out, and a 500 (not an empty 200) for a throwing listener #39366)
• A paused upload whose response was already sent no longer keeps the process alive after server.close(), as in Node. (node:http: a paused upload behind a sent response does not hold the event loop #46424)

node:http2

• close() and destroy() put Node's frames on the wire. write(x); close(code) in one tick sends RST_STREAM(code), not DATA with END_STREAM. destroy() sends only RST_STREAM and emits no 'finish'. The session's 'close' comes after its streams' events. A 'frameError' closes the session. (node:http2: send RST_STREAM when a server stream is reset #33380, node:http2: destroy streams before the native sweep in session teardown #42717, node:http2: reset the stream when respond() exceeds maxSendHeaderBlockLength #43440, node:http2: destroy the socket on session.destroy() without close(), emit the session 'close' once the socket has closed #38195)
• close(code) keeps its code when the peer's RST_STREAM crosses it, as in Node. On 1.4.4 it depended on timing. With no 'error' listener a peer's CANCEL still wins, so nothing that's silent on 1.4.4 throws. (node:http2: reset the stream when respond() exceeds maxSendHeaderBlockLength #43440)
• A pending request cancelled by destroy() has rstCode 2, as in Node. 1.4.4 had 8, which grpc-js reports as CANCELLED instead of INTERNAL. (node:http2: give pending requests cancelled by session.destroy() node's rstCode #37744)
• Send limits match Node's: a header block over 64 KiB is refused unless maxSendHeaderBlockLength is raised, connection-specific headers throw from respond() and request(), and respond({ ':status': 102 }) throws. res.setHeader() and res.writeHead() drop such headers with a warning instead, so a front end that copies an HTTP/1.1 upstream's headers keeps running (Node throws there too). (node:http2: refuse a header block over the default send limit, like node #43474, node:http2: encode each header block in one call, all fields or none #41520, node:http2: normalize outbound header objects like node #41614, node:http2: validate the server stream :status like node #43453)
• An open stream counts 756 bytes toward maxSessionMemory, about what Node counts and more than on 1.4.4. With the default of 10 MB a session refuses the 13,872nd concurrent stream that its peer opens (Node: the 13,867th). A client's own requests aren't held back, as in Node. (node:http2: do not refuse respond() when the session is over maxSessionMemory #43419)
• A session no longer re-emits its socket's 'timeout', and a throw in the connect() listener is an uncaught exception, both as in Node. (http2: give Http2Stream its own per-stream idle timer #30308, node:http2: register the connect() listener as a one-time 'connect' listener #43492)

HTTP/3 and node:quic

• An endpoint accepts 100 sessions per IP address unless maxConnectionsPerHost says otherwise, which is Node's default. A load test from one machine hits this. (node:quic: enforce QuicEndpoint maxConnectionsPerHost #35726)
• Default stream windows are 1 MiB on a server and 6 MiB on a client for every kind of stream. With a 1.4.4 peer on the other end, a server-opened bidirectional stream carries no data unless that peer sets its window. (node:quic: use one default stream window per endpoint #46321, node:quic: pick a bidirectional stream's send limit by who opened it #46322)
• Sessions without cc use Cubic. 1.4.4 picked Cubic or BBRv1 from the first RTT sample. (node:quic: default the congestion controller to Cubic #37468)
• 18 new patches to lsquic and lsqpack are in patches/, each described in scripts/build/deps/lsquic.ts and lsqpack.ts. They could live in the forks instead.
• An unread HTTP/3 body is taken out of lsquic and waits in memory, undecoded, up to one stream window. 1.4.4 left it in lsquic, where it used up the connection's window and was lost when the connection went away. (http3: pause a stream by holding its flow-control window #45612)

undici and node-fetch

• Dispatchers work: Agent, Pool, Client and ProxyAgent have request(), stream(), dispatch(), close() and destroy(), each has its own connection pool, and undici.fetch() applies a dispatcher's proxy and connect options. So new Agent({ connect: { rejectUnauthorized: false } }) now really skips verification, and new ProxyAgent() without a URI throws. (feat(undici): implement Pool, Client, Agent, and stream() #27338, undici: wire ProxyAgent/setGlobalDispatcher/{dispatcher} to native fetch proxy #35145, undici: implement dispatch(), close() and destroy() on the shim dispatchers #39250)
• node-fetch rejects with FetchError, not the native TypeError. err.code is unchanged. (node-fetch: reject fetch() and body reads with AbortError and FetchError #44297)

Where this PR still differs from Node on purpose, because 1.4.4 programs rely on it or because Bun's answer is the safer one:

• node:http: a socket nobody reads closes when its connection is gone, server.unref() also lets go of sockets that 'upgrade' or 'connect' got, and req.socket.remoteAddress = x sticks.
• node:http: a connection that closes under an ended response's last write still emits 'finish'. On listen() connections res.cork() has no effect and the head is always Latin-1.
• node:http: a connection that reported a parse error is closed about 10 s later, even if the 'clientError' listener leaves it open. A body under a non-chunked Transfer-Encoding is sent with Connection: close.
• node:http2: without an 'error' listener, a late write() on a response that respond() ended is dropped, a pushed stream's error isn't thrown, and an early NO_ERROR reset drops later writes. A client session with no 'stream' listener cancels pushes.

Fixes

node:quic

• A UDP socket's reads are bounded per event loop turn, as in libuv.
• One QUIC transport layer in usockets drives lsquic for Bun.serve, fetch and node:quic, and node:quic builds its TLS context with the code every other Bun TLS context uses.
• console.log() or Bun.inspect() of a QuicEndpoint, QuicSession or QuicStream now prints each session once. (node:quic: bound [kInspect] recursion through the endpoint<->session cycle #35742)
• A second connect() with different transportParams, application, cc, handshakeTimeout or keepAlive options now gets those options, also on an endpoint it shares with the first. (node:quic: key shared-client-endpoint reuse on engine-baked connect() options #35765)
• QuicEndpoint now applies udpReceiveBufferSize, udpSendBufferSize, udpTTL, ipv6Only and reusePort to its UDP socket. (node:quic: apply the endpoint's UDP socket options when binding #37456, in part)
• A node:quic session without the cc option now uses Cubic, Node's default. (node:quic: default the congestion controller to Cubic #37468)
• On an HTTP/3 node:quic stream, writing a body or ending the stream after sendHeaders() returned false now resets the stream with H3_INTERNAL_ERROR, and closed rejects on both ends. (node:quic: reset the stream when lsquic_stream_write fails instead of retrying on every tick #42892, in part)
• Using two of Bun.serve({ http3: true }), fetch(..., { protocol: "http3" }) and node:quic in one process no longer breaks QUIC handshakes that are in flight when the second one starts. (quic: run lsquic_global_init once per process #42913) Fixes node:quic: a client handshake fails with ERR_QUIC_TRANSPORT_ERROR when fetch() over HTTP/3 handshakes at the same time #42898.
• ondatagramstatus(id, status) now reports each datagram under its own id. (node:quic: report a datagram's status under the id kept in its lsquic frame #44680)
• A node:quic close with code 0 no longer reaches the peer as INTERNAL_ERROR, through the node:quic: send a close with code 0 as code 0, not INTERNAL_ERROR #45702 fix. (node:quic: send a client's coded close before the server's first packet, ignore close options without code #44846, in part)
• createUnidirectionalStream() before the handshake finishes now opens that stream when the handshake is done. (node:quic: open a uni stream requested before the handshake, keep pending streams paired with lsquic's requests #45342, in part) Fixes node:quic: a unidirectional stream created before the handshake never opens (raw QUIC) #44749.
• session.close() and session.destroy() with { code: 0n, type: "application" }, or with code 0 and a reason, now send code 0. (node:quic: send a close with code 0 as code 0, not INTERNAL_ERROR #45702) Fixes node:quic: an application close with error code 0 is sent as transport error INTERNAL_ERROR #45499.
• node:quic streams now have stream.opened (fulfilled once a stream created without stream credit gets its ID) and stream.onstopsending (called with the peer's application error). (node:quic: add QuicStream.opened and QuicStream.onstopsending #45712) Fixes node:quic: stream.opened and stream.onstopsending are not implemented #45501.
• A node:quic client with an IP address as servername ("127.0.0.1", "::1") now verifies it against the certificate's IP SANs. (node:quic: verify an IP servername against the certificate's IP SANs #45713) Fixes node:quic: an IP-address servername fails hostname verification despite a matching IP subjectAltName #45514.
• When the peer closes a QUIC connection with an error, a stream that was still open now fails with that error: a pending read and stream.closed reject with the same error as session.closed. (node:quic: give a stream still open at connection close the connection's error #45741) Fixes node:quic: a stream read ends cleanly when the peer closes the connection with an error #45500.
• resetStream(), setBody() and setOutbound() on a unidirectional stream that the peer opened no longer send RESET_STREAM or STREAM frames, which made the peer close the whole connection. (node:quic: ignore resetStream() and setBody() on a receive-only stream #45879, in part)
• stream.stopSending() and stream.destroy() on a node:quic stream whose send side is finished (every headers-only HTTP/3 GET) now send STOP_SENDING right away. (node:quic: make the connection tickable when lsquic queues STOP_SENDING #45931)
• When a node:quic stream's pendingTrailers can't be sent, the stream is now destroyed and stream.closed rejects (with the validation error, or ERR_QUIC_STREAM_ABORTED). (node:quic: destroy the stream when its pendingTrailers cannot be sent #45941)
• A QUIC connection no longer declares a packet lost that the peer acknowledged. (quic: keep every acknowledged packet when lsquic merges two ACK frames #46055)
• A non-HTTP/3 node:quic client now enforces, and returns credit for, the stream limits it advertises. (node:quic: seed the limits for peer-opened streams from the advertised stream counts #46305, in part)
• With default transportParams, a node:quic server can now open a bidirectional stream and send more than 16 KiB on it, and a resumed client can send more than 12 KiB on a unidirectional stream in 0-RTT. (node:quic: use one default stream window per endpoint #46321)
• A bidirectional stream that a node:quic server opens now respects the right flow-control window on both ends when initialMaxStreamDataBidiLocal and initialMaxStreamDataBidiRemote differ. (node:quic: pick a bidirectional stream's send limit by who opened it #46322, in part)
• onnewtoken(token, address) and the quic.session.new.token diagnostics channel now get the server's SocketAddress. (node:quic: give a session both addresses at construction, pass the peer address to onnewtoken #46343, in part)
• A node:quic client that resumes a session (sessionTicket) and calls stream.resetStream(), stream.stopSending() or stream.destroy() before opened now gets that frame to the server. (node:quic: type a resumed client's pre-handshake application packets as 0-RTT #46425)
• Ending a raw QUIC stream that has no flow-control credit (the peer's window is 0, or the body filled it exactly) now sends the FIN right away. (node:quic: send the end of a raw QUIC stream at once when it has no flow-control credit #46446)
• A node:quic session now reports the transport error code that its own side closed the connection with. (node:quic: report the error lsquic closes a connection with #46487, in part)
• Hardening against misbehaving peers: node:quic: enforce QuicEndpoint maxConnectionsPerHost #35726, node:quic: write the outbound queue to lsquic in place instead of copying it every on_write #37491, node:quic: create the endpoint socket without IP_RECVERR and count a refused datagram as sent #44800, node:quic: leave out received regular HTTP/3 fields that hold CR or LF #45537, node:quic: make the session the server connection's context from its first packet #46226, node:quic: return a stream's flow-control credit when JavaScript takes the bytes #46453.

HTTP/3

• fetch(url, { protocol: "http3", tls: { ca, cert, key, serverName } }) now works: the server is verified against your ca and serverName, and the client certificate is presented. (fetch: honor per-request TLS options on the HTTP/3 client #31420)
• On Windows, Cubic's pacing rate wrapped for every window, so a Cubic QUIC connection was paced at a more or less random rate. (quic: use Cubic for the HTTP/3 engines and fix its pacing rate wrapping on Windows #37455, in part)
• Over HTTP/3, a request with Expect: 100-continue that is the first request on its connection now gets its response. (Bun.serve(http3): resend the final header block that lsquic refuses behind a pending 100 Continue #42805) Fixes Bun.serve HTTP/3: 100-continue interim response breaks the final response on a fresh QUIC connection #33082.
• await server.stop() on an HTTP/3 server now resolves after the last QUIC connection is gone and the UDP socket is closed. (Bun.serve(http3): resolve stop() after the UDP socket and the last QUIC connection are gone #45419)
• With --experimental-http3-fetch, a request that Alt-Svc routed to HTTP/3 now falls back to TCP when the QUIC handshake fails or times out, and Bun skips that alternative for 5 minutes. (http(h3): use TCP when the QUIC connection to an Alt-Svc alternative cannot be established #45539, in part)
• Over HTTP/3, what one connection's handler writes to another connection's stream (a held response, an SSE or long-poll chunk) now goes out right away instead of waiting up to seconds for that connection's next packet or timer. (http3: tick a connection that another connection's callback acts on, and no connection twice in one pass #46103)
• Hardening against misbehaving peers: Bun.serve(http3): reset the stream when a response body fails mid-body #40598, Bun.serve(http3): reset the stream when lsquic refuses the response headers or a body write #42895, Bun.serve http3: 501 or 400 before the router for a request line the HTTP/2 listener refuses #45357, http3: pause a stream by holding its flow-control window #45612, http3: accept a QPACK field section with no field lines; node:quic sends none for empty hints, or for empty trailers after headers #46012.

node:http2

• A node:http2 session keeps one table of its streams, and shares its frame, settings and header checks with fetch's HTTP/2 client.
• Http2Stream.setTimeout() (and req.setTimeout() / res.setTimeout() in the compat API) now arms a timer for that stream only. (http2: give Http2Stream its own per-stream idle timer #30308) Fixes @fastify/http-proxy with HTTP/2 spuriously emits FST_REPLY_FROM_HTTP2_REQUEST_TIMEOUT after idle on Bun #30307.
• stream.close(code) called right after write() now resets the stream instead of ending it cleanly, so the peer no longer takes an aborted response or upload for a complete one. (node:http2: send RST_STREAM when a server stream is reset #33380, in part)
• req.end(callback) on a request that request() already ended (every GET, HEAD and DELETE) calls back asynchronously like Node, and passes ERR_STREAM_ALREADY_FINISHED or ERR_STREAM_DESTROYED once the stream is past that point. (node:http2: defer the callback in Http2Stream#end() on an already-ended stream #33489)
• internalBinding('http2') exists in the --expose-internals test shim, so Node's test-http2-binding.js and test-http2-respond-errors.js run and pass. (http2: implement internalBinding('http2') for the vendored node test shim (+2 upstream tests) #34499)
• stream.write(""), res.write("") and a client end() with trailers pending no longer put a zero-length DATA frame without END_STREAM on the wire. (node:http2: drop empty DATA frames that carry no END_STREAM, pass the stream id to frameError #37712)
• A client request with endStream (explicit, or implied by GET/HEAD/DELETE) plus waitForTrailers now ends on its HEADERS frame like Node, instead of sending HEADERS and then an empty END_STREAM DATA frame. (node:http2: put END_STREAM on the HEADERS frame of an endStream request even with waitForTrailers #37718)
• A client request that is still pending when session.destroy() runs now reports Node's rstCode: INTERNAL_ERROR (2) instead of CANCEL (8), and a code set earlier by req.close(code) or a received GOAWAY is kept. (node:http2: give pending requests cancelled by session.destroy() node's rstCode #37744)
• An array value in a raw [name, value, ...] header list passed to respond() or request() now goes out as one field per element, like Node. (node:http2: send array values in raw-form header lists as one field per element #37796, in part)
• A pushed stream that's ended before respond() (pushStream(headers, { endStream: true }) or push.end()) puts END_STREAM on its response HEADERS. (node:http2: end a pushed response on its HEADERS frame when the stream was ended before respond() #38104)
• session.destroy() now delivers its GOAWAY (and the initial SETTINGS, if they hadn't been flushed yet) when the session runs over a Duplex instead of a socket. (node:http2: deliver the destroy() GOAWAY on sessions whose socket has no native handle #38158)
• A node:http2 session keeps parsing inbound frames when code that continues after an awaited response spins the event loop (await expect(promise).resolves in bun test, require() of a module with top-level await), on macOS and Linux. On Windows it can still stall, depending on timing, because libuv re-arms a socket only after its callback returns. (node:http2: keep parsing inbound frames when a frame callback spins the event loop #39873) Fixes node:http2 client stops processing inbound frames for ~28s under load (regression 1.3.14 → 1.4.0) #39796.
• session.setLocalWindowSize(n) with n of 128 KiB or more no longer stalls every request or response body larger than 64 KiB. (node:http2: keep setLocalWindowSize() off SETTINGS_INITIAL_WINDOW_SIZE #40180)
• http2.connect(url, { maxFrameSize: NaN }) throws ERR_HTTP2_INVALID_SETTING_VALUE instead of spinning in request() until the process runs out of memory. (node:http2: read SETTINGS from options.settings and session limits from the top level #41305, in part)
• Open HTTP/2 streams now follow a SETTINGS_INITIAL_WINDOW_SIZE change in both directions. (node:http2: apply INITIAL_WINDOW_SIZE changes to open streams #41329) Fixes node:http2: setLocalWindowSize() inside a frame callback can end the session with FLOW_CONTROL_ERROR on a synchronous JS transport #43893.
• Raising setLocalWindowSize() after lowering it no longer grants the peer the same credit twice. (node:http2: withhold connection window credit after setLocalWindowSize() decreases it #41344, in part)
• Node's test-cluster-bind-twice.js passes and is added. The rest of this PR is in through node:http/http2 hardening: enforce h2 request pseudo-headers, never report a failed handler as success, and bound/validate the parser paths (+1 upstream test) #33191 and http2: implement internalBinding('http2') for the vendored node test shim (+2 upstream tests) #34499. (node: net/tls/http/http2 compat fixes #41400, in part)
• node:http2 now treats outbound header objects like Node: a property set to undefined is skipped instead of throwing ERR_HTTP2_INVALID_HEADER_VALUE, null and array items are stringified, and content-length: 0 on a GET is sent instead of resetting the request. (node:http2: normalize outbound header objects like node #41614)
• stream.endAfterHeaders no longer throws Invalid stream id on a request that has no id yet, keeps its value after the stream closes, and is only set by the request HEADERS that opened a server stream, like Node. (node:http2: make the stream lifecycle getters total, like node #41945, in part)
• A client session now destroys its transport when the transport emits 'error' without closing itself, instead of leaking the connection. (node:http2: destroy the transport when a transport error destroys a client session #42175)
• session.closed is now true on a client session whose server hung up, like Node. (node:http2: report session.closed when the transport goes away #42180)
• http2.connect() with an invalid setting still throws, but no longer leaves a connecting socket behind that spins the process at 100% CPU forever. (node:http2: drop the connecting socket when a client session constructor throws #42184)
• A graceful server.stop() no longer waits for a connection that hadn't made a request yet. (Bun.serve http2: close a connection that becomes HTTP/2 after a graceful stop() #42345, in part)
• An h2c node:http2 client whose own send() is the first to see the peer's reset now gets 'close' on the request and the session. (node:http2: submit a request's frames after request() returns #42353, in part)
• A client at the server's maxConcurrentStreams limit no longer sends the next queued request ahead of the RST_STREAM of the request that destroy() just cancelled. (node:http2: free a request's slot when its stream closes on the wire, abort request({ signal }) from JS only #42763)
• stream.sentHeaders on a node:http2 server is undefined until respond(), like Node. (node:http2: keep received headers out of sentHeaders #43206)
• pushStream() takes its default :authority from the request's host when the request has no :authority. (node:http2: default a push's :authority from the request's host #43298)
• node:http2 now honors SETTINGS_HEADER_TABLE_SIZE. (node:http2: apply SETTINGS_HEADER_TABLE_SIZE to the HPACK encoder and decoder #43345, in part) Fixes Bun's HTTP/2 server potentially ignores Nginx's HPACK for header compression setting SETTINGS_HEADER_TABLE_SIZE=0 #19152.
• A node:http2 server no longer drops responses without telling the client once more than maxSessionMemory (10 MB by default) of response data is queued. (node:http2: do not refuse respond() when the session is over maxSessionMemory #43419)
• A write on one HTTP/2 stream no longer stalls while another stream on the same session has data waiting for its own flow-control window. (node:http2: do not hold a stream's DATA behind another stream's queued frames #43422)
• session.destroy() now destroys a stream that already closed on the wire but whose data was never read, so it emits 'close' (and 'error' when the session was destroyed with one). (node:http2: destroy a closed stream with unread data when its session is torn down #43433)
• A node:http2 server whose respond() is over maxSendHeaderBlockLength now resets the stream with FRAME_SIZE_ERROR and closes the session gracefully like Node, instead of leaving the client hanging. (node:http2: reset the stream when respond() exceeds maxSendHeaderBlockLength #43440)
• respond(), respondWithFile() and respondWithFD() now throw ERR_HTTP2_STATUS_INVALID for a 1xx :status like Node, and additionalHeaders() no longer adds :status: 200 to a block without one. (node:http2: validate the server stream :status like node #43453, in part) Fixes node:http2: ServerHttp2Stream checks :status differently than Node (no integer conversion, respond() accepts 1xx) #43447.
• respondWithFile() on a directory with no onError now resets the stream without sending response headers first, like Node. (node:http2: do not call respond() when a file response fails before the headers are sent #43463, in part)
• server.updateSettings() and server.updateSettings(undefined) are no-ops again instead of throwing ERR_INVALID_ARG_TYPE. (node:http2: accept undefined in server.updateSettings() #43472)
• maxSendHeaderBlockLength now defaults to 65536 like Node. (node:http2: refuse a header block over the default send limit, like node #43474)
• respond(headers, options) only reads endStream, waitForTrailers, sendDate and paddingStrategy now, like Node. (node:http2: ignore request() options in respond(), like node #43478, in part)
• The listener passed to http2.connect() is now a one-time 'connect' listener, like Node: it gets (session, socket), session.off('connect', listener) removes it, and if it throws you get an uncaught exception instead of a silently destroyed session. (node:http2: register the connect() listener as a one-time 'connect' listener #43492)
• http2.connect() with createConnection accepts any URL protocol like Node, http2.connect({ port }, { protocol: 'http:' }) sends :scheme: http instead of https, and ERR_HTTP2_UNSUPPORTED_PROTOCOL has Node's message. (node:http2: match Node's unsupported-protocol check in connect() #43505)
• A node:http2 server stream that was open before session.close() now emits 'trailers' when the client's trailer block arrives after the GOAWAY. (node:http2: emit 'trailers' for a stream delivered before session.close() #43507) Fixes node:http2 server: request trailers that arrive after session.close() do not emit 'trailers' #43488.
• A client stream no longer emits 'response', 'headers', 'continue', 'push' or 'trailers' after your handler called close() or destroy() on it, when the header block arrived in the same socket read. (node:http2: emit no header events on a client stream that user code closed #43525)
• After session.close(), stream.pushAllowed is false and pushStream() throws ERR_HTTP2_PUSH_DISABLED, like Node. (node:http2: refuse pushStream() and ping() after session.close() #43531, in part)
• A stream sends at most one RST_STREAM, and none once it has closed. (node:http2: do not reset a stream the native layer already closed #43539, in part)
• A request or response body larger than the flow-control window no longer stalls over a synchronous transport such as stream.duplexPair(). (node:http2: send the rest of a body when WINDOW_UPDATE arrives inside the transport write #43562)
• stream.respondWithFD(fd) sends the whole file every time. (node:http2: port node's respondWithFD() and respondWithFile() response paths #43564, in part)
• session.request(headers, { parent, exclusive, weight }) no longer puts priority fields on the HEADERS frame, like Node. (node:http2: send no priority fields on HEADERS, like node #43599)
• session.settings(settings, callback) ignores a falsy callback (null, 0, "", false) like Node instead of throwing ERR_INVALID_ARG_TYPE, and checks settings before callback. (node:http2: check settings before callback in session.settings() #43605, in part)
• A node:http2 server stream that the handler paused now emits 'end' and 'close' once it has closed and holds no unread data. (node:http2: end a paused server stream that holds no data when it closes #43631)
• A node:http2 client no longer throws away response data that arrived before the server's RST_STREAM(NO_ERROR). (node:http2: keep the data that arrived before a peer's RST_STREAM(NO_ERROR) #43754, in part)
• stream.state, util.inspect(stream) and console.log(stream) no longer throw Invalid stream id on a stream that finished on the wire while its data is still unread, or on a pushed client stream. (node:http2: do not throw Invalid stream id from stream.state and util.inspect(stream) #43801, in part)
• A server handler that calls stream.close(NGHTTP2_REFUSED_STREAM) no longer gets its whole connection closed with GOAWAY(ENHANCE_YOUR_CALM) after 50 refusals. (node:http2: count a refused stream where the session refuses it, not in rstStream #44248)
• A node:http2 server no longer ends the whole session at the 100th stream it refuses for exceeding maxConcurrentStreams. (node:http2: refuse a stream over the advertised limit before it is opened, on maxSessionInvalidFrames #44337, in part)
• session.setTimeout() no longer fires 'timeout' in the middle of a download or upload. (node:http2: refresh the session idle timer where node does #44481, in part)
• respond() and request() with a raw [name, value, ...] list no longer push a repeated name's value into an array the caller passed. (node:http2: copy the array values of a raw header list in respond() and request() #44804)
• session.state is {} after session.destroy(), like Node, instead of undefined, so session.state.lastProcStreamID no longer throws. (node:http2: return {} from session.state without a handle, keep connecting true until the socket is ready #44816, in part)
• stream.close(code) on a stream that is read through pipeline() now resets it with the given code. (node:http2: store the code of close(code) before its listeners run #44848, in part)
• A graceful server.stop() or server.closeIdleConnections() no longer cuts an HTTP/2 response that the kernel hasn't delivered yet. (Bun.serve http2: close a connection gracefully with a FIN, not with close(2) #44874, in part)
• node:http2 no longer emits 'aborted' on a stream whose writable side already ended. (node:http2: emit 'aborted' only while the writable side is open #45056, in part)
• A node:http2 client request that is reset with close(code) while it waits for a stream slot (SETTINGS_MAX_CONCURRENT_STREAMS) is no longer sent. (node:http2: do not send a request that close(code) reset while it waited for a stream slot #45279, in part)
• A node:http2 client request that is destroyed or aborted while it waits for the connect or for a stream slot leaves the session's queue right away. (node:http2: take a request out of the client's pending queue when it is destroyed #45448, in part)
• session.close() and server.close() no longer cut a large response or upload that was already framed but not yet written to the socket. (node:http2: keep the unsent frames on a graceful close and send the FIN after them #45673, in part)
• A request made before the session connects is no longer sent if a 'connect' or 'secureConnect' listener destroys or closes the session first. (node:http2: submit requests made before the connect from a 'connect' listener #45992, in part)
• On a shared http2.connect() session, a request that waited for a stream slot or for the connect now runs its write() and end() callbacks, 'ready' and 'finish' in its own caller's AsyncLocalStorage context. (node:http2: submit a queued client request in the async context of its request() caller #46036, in part)
• Comment only: the one-tick cork in ClientHttp2Session.request() is Bun's own. (node:http2: correct the comment on the one-tick cork in request() #46234)
• stream.close() and close(NGHTTP2_CANCEL) no longer emit 'error' ERR_STREAM_PUSH_AFTER_EOF when a DATA frame arrives while close() is still running. (node:http2: drop DATA that arrives after close(code) ended the readable #46428)
• session.settings(settings, callback) now runs the callback and that frame's 'localSettings' event in the caller's AsyncLocalStorage context, like Node. (node:http2: deliver a settings() acknowledgement in the async context of its caller #46463, in part)
• Hardening against misbehaving peers: node:http/http2 hardening: enforce h2 request pseudo-headers, never report a failed handler as success, and bound/validate the parser paths (+1 upstream test) #33191, node:http2: cap CONTINUATION frames per header block (CVE-2024-28182) #36410, node:http2: reject a PUSH_PROMISE whose promised id does not exceed the previous one #37563, h2 server: decode and discard HEADERS on a closed client stream instead of resetting or re-opening it #37985, node:http2: destroy the socket on session.destroy() without close(), emit the session 'close' once the socket has closed #38195, node:http2: encode each header block in one call, all fields or none #41520, node:http2: tear the session down when a user-supplied transport reports EOF #42211, node:http2: don't track client streams opened by inbound HEADERS #42369, node:http2: cap the client originSet at maxOriginSetSize like node 26.4.0 #42411, node:http2: treat a SETTINGS ACK with no SETTINGS outstanding as a connection error #42519, node:http2: add nghttp2's glitch rate limit for ignored frames #42522, node:http2: destroy streams before the native sweep in session teardown #42717, node:http2: ignore a request that opens after the server's GOAWAY #43475, node:http2: refuse DATA from the client on a server-pushed stream #43494, node:http2: let a client close a pushed stream #43534, node:http2: close the native entry of a push released before its PUSH_PROMISE left #43553, node:http2: never send or accept DATA before the response HEADERS #43558, node:http2: refuse END_STREAM on a 1xx HEADERS block #43575, node:http2: close a pushed stream whose END_STREAM HEADERS and CONTINUATION arrive in separate reads #43586, node:http2: discard a PUSH_PROMISE that arrives after the client sent GOAWAY #43612, node:http2: check WINDOW_UPDATE against the sender's own window, drop the per-frame send list #44383, node:http2: hold a response to its content-length #45315, node:http2: close an answered, unread server stream once its response has left #46058, node:http2: do not start the readable when END_STREAM comes on a HEADERS frame #46121, node:http, node:http2: give emit('connection') and allowHTTP1 connections the server's timers and error path #46185, node:http2: do not run the frame queue inside the callback of a dequeued write #46451. Fixes http2: server stream emits 'drain' and accepts writes forever after the client disconnects #45728. Fixes node:http2 client: a pushed stream never closes when its END_STREAM HEADERS and the CONTINUATION arrive in different reads #43493. Fixes node:http2 server: a client frame on the id of a push that failed validation makes session.close() cut open streams #43509.

undici and node-fetch shims

• Pool, Client and Agent from the built-in undici work: request() and stream() send the request with Bun's fetch, close() waits for pending requests and destroy() aborts them. (feat(undici): implement Pool, Client, Agent, and stream() #27338, in part) Fixes @elastic/elasticsearch@8.11.0 not working due to missing undici.Pool.request #7920. Fixes undici.Agent is missing async close() method #14498. Thanks to @igorls.
• ProxyAgent from the built-in undici works. (undici: wire ProxyAgent/setGlobalDispatcher/{dispatcher} to native fetch proxy #35145, in part) Fixes Support undici ProxyAgent #4474.
• dispatch() works on Agent, Pool, Client and ProxyAgent of the built-in undici, with the handler callbacks of undici 6 and of undici 7, including pause, resume and abort. (undici: implement dispatch(), close() and destroy() on the shim dispatchers #39250, in part) Fixes undici shim: Pool lacks dispatch()/close()/destroy(), breaking miniflare + workerd (wrangler dev, @cloudflare/vite-plugin) #39247. Fixes bug: EventEmitter or something different? #8961.
• The body returned by the built-in undici.request() has dump() and bytes(). (undici: add dump() and bytes() to the request() response body #40206) Fixes undici shim: response body lacks dump() and bytes(), and the usual destroy(err) recovery kills the process #40205.
• The error classes in the built-in undici have undici's name, UND_ERR_* code and default message. (fix(node): preserve undici timeout error metadata #42716) Thanks to @steipete.
• new Request(url, { body }) from the built-in node-fetch reads an old-style Stream body such as form-data. (node-fetch: read an old-style Stream body of a Request #43773, in part)
• Response.type from the built-in node-fetch is "default" for a 404 or 500 instead of "error". (node-fetch: report Response.type as default for an HTTP error status #43966) Thanks to @breken-ai.
• FetchError from the built-in node-fetch has the name FetchError, sets errno and erroredSysCall, and has no code without a system error. (node-fetch: name FetchError and AbortError like node-fetch #43967, in part) Thanks to @breken-ai.
• Response.json(), Response.redirect() and Response.error() from the built-in node-fetch return a node-fetch Response, with buffer(), headers.raw() and a Node stream body. (node-fetch: return a node-fetch Response from Response.json(), redirect() and error() #43968) Thanks to @breken-ai.
• fetch() from the built-in node-fetch rejects with node-fetch's AbortError (type: "aborted") on abort and FetchError when the request fails. (node-fetch: reject fetch() and body reads with AbortError and FetchError #44297, in part) Fixes node-fetch: fetch() rejects with native errors, not node-fetch AbortError / FetchError #44282.
• The built-in undici.request() rejects a method that isn't a string, isn't an HTTP token, or is CONNECT with undici's InvalidArgumentError, instead of sending GET (or CONNECT). (undici.request: reject a method that is not a string, not an HTTP token, or CONNECT #44814, in part)

node:http and node:https

• req.write(chunk, callback) on a client request whose socket is already destroyed now calls callback with the socket's error or ERR_STREAM_DESTROYED instead of never calling it.
• res.assignSocket(socket) listens with socket.on() like Node, so the socket stand-ins of serverless-http and @vendia/serverless-express (which have no once()) work instead of throwing socket.once is not a function.
• The callback of res.write() is always called when the connection has failed, and the callback of res.end() wherever Node or 1.4.4 calls it.
• node:http does less work for a pipelined response that waits for its turn and for each chunk of a request body, and a lone string written under socket.cork() is no longer copied twice.
• http and https servers honor listen({ ipv6Only: true }), like net.Server and Node.
• req.socket on a node:http / node:https server is a plain net.Socket / tls.TLSSocket from accept on, and 'upgrade' and 'connect' listeners get that same socket over the same handle.
• https.Server#listen() negotiates ALPN (ALPNProtocols, http/1.1 by default, ALPNCallback, req.socket.alpnProtocol) and emits 'keylog', like a tls.Server.
• server.emit('connection', socket), http._connectionListener and http2's allowHTTP1 run a port of Node's own connection code, and every kind of connection has one queue of waiting responses.
• req.socket.bytesRead on a node:http / node:https server now counts every byte the connection has read (after TLS decryption) instead of staying 0, and keeps its value after 'close'. (Fix req.socket.bytesRead returning 0 in node:http server #28710) Fixes req.socket.bytesRead returns 0 when using node:http server #28709.
• http._connectionListener is exported (httpolyglot and spdy call it). (node:http: adopt external sockets fed in via server.emit('connection') #35285, in part) Thanks to @steipete.
• A 'data' or 'readable' listener on a node:http / node:https server's connection socket (server.on('connection'), 'secureConnection', req.socket) now gets the raw request bytes, like Node. (node:http: emit 'data' on the server 'connection' socket with the raw request bytes #35661) Fixes Unable to read raw data from http/https requests, using either "node:http" or "node:https" #11924.
• res.end() now undoes a res.cork() that was never uncorked, so a later CONNECT or Upgrade on the same keep-alive connection can write to its socket instead of buffering forever. (node:http: don't leave the server socket Duplex corked across kept-alive requests #35664, in part)
• http.Server now sets server._handle while it listens (null before listen() and after close()), so a supertest request closes its server and the process exits instead of hanging. (node:http: expose Server._handle so supertest's ephemeral server gets closed #36685) Fixes Bun process hangs when using Supertestwith Express — does not exit after test completion #23648.
• On emit('connection') and allowHTTP1 connections, res.end(body) followed right away by req.socket.destroy(), res.destroy() or closeAllConnections() no longer cuts the response off after its headers. (node:http: deliver a fallback response in full when the connection is torn down right after res.end() #37710, in part)
• An HTTP/1.1 request without a Host header now gets 400 Bad Request with Connection: close on emit('connection') and allowHTTP1 connections, like a listening http.Server and like Node. (node:http: answer a request without Host with 400 on emit('connection') and allowHTTP1 connections #37735)
• On emit('connection') and allowHTTP1 connections, closing a socket that was handed to an 'upgrade' or 'connect' listener no longer emits 'aborted', 'error' and 'close' on the upgrade request. (node:http: abort the in-flight request when an HTTP/1 fallback connection closes #37748, in part)
• A Content-Length: 0 request whose head arrives in two TCP reads now counts as complete. (http: classify idle connections by request message state, not response end #37889, in part)
• A node:http server's keepAliveTimeout is measured on the clock its timer runs on, so setSystemTime() or a wall-clock step no longer closes an idle connection early or keeps it open, and under jest.useFakeTimers() it closes when the fake clock says so. (node:http: measure the keep-alive idle period on the monotonic clock #37974)
• res.destroy() or req.destroy() before the response head is sent now closes the connection without sending anything, like Node. (node:http: send nothing on destroy() before the headers go out, and a 500 (not an empty 200) for a throwing listener #39366, in part)
• res.statusMessage goes on the wire as Latin-1 on listen() connections, like the header values there (OKé was sent as UTF-8). (node:http statusMessage as Latin-1, spec-compliant Blob.type from headers, UTF-8 property keys #40416, in part) Thanks to @dylan-conway.
• The socket handed to a 'connect' or 'upgrade' listener emits 'drain' once per backed-up write instead of twice. (test(node:http): speed up node-http-connect.test.ts and assert exact tunnel bytes #40897)
• http.request(), http.get() and https.request() accept a URL object from another implementation or one created before globalThis.URL was replaced, and req.write() / req.end() accept a Uint8Array from a node:vm context. (node:http, node:fs, node:worker_threads: detect URLs structurally, and Uint8Array by cell type #41117, in part)
• clientError reports an empty, non-numeric or oversized Content-Length as HPE_INVALID_CONTENT_LENGTH and two different values as HPE_UNEXPECTED_CONTENT_LENGTH, with Node's message, and every parse error has err.reason. (node:http: report each bad Content-Length with node's code and reason #41234, in part)
• server.listen({ port, path }) on a node:http server now binds the TCP port and ignores path, and listen({ path, host }) binds the path instead of emitting an 'error', like Node. (Bun.serve: throw when both port and unix are given #41660, in part)
• A failed server.listen() now reports Node's error: listen EADDRINUSE: address already in use 127.0.0.1:3000, with errno, syscall, address and port set. (fix(node): format HTTP listen errors #42742) Thanks to @steipete.
• server.listen({ port, reusePort: true }) now sets SO_REUSEPORT outside a cluster worker, so two processes can share a port as they can with node:net and Bun.serve. (node:http: honour listen({ reusePort: true }) in the primary process #43692) Fixes node:http listen({ reusePort: true }) is silently ignored; node:net honours it #43690.
• server.listen(null) and server.listen(null, host) bind a free port, like Node, instead of port 3000 (or PORT). (node:http: bind an ephemeral port when the listen() port is null #43726, in part)
• A node:http request with a Content-Length body now emits 'end' after the promise jobs queued by the last chunk's 'data' listeners, like Node. (node:http: run nextTicks and promise jobs where Node's parser does #43736, in part)
• server.timeout and the setTimeout() of a server, request, response or socket no longer cut a response that's still being written: res.write(), res.end(), res.flushHeaders(), a 1xx response and a drained write now count as socket activity, and the timer waits while the peer keeps taking bytes of a queued write, like Node. (node:http: refresh the socket inactivity timer in the native write path #43753, in part)
• With rejectNonStandardBodyWrites: true, res.write("") on a HEAD, 204 or 304 response now throws ERR_HTTP_BODY_NOT_ALLOWED like Node, also on a queued pipelined response. (fix(node:http): reject empty writes for bodyless responses #43994) Fixes node:http: res.write("") on a HEAD or 204 response does not throw ERR_HTTP_BODY_NOT_ALLOWED with rejectNonStandardBodyWrites #43535. Thanks to @aryan1306.
• http.Server.listen({ fd }) (and https) serves on the inherited socket. (Bun.serve({ fd }) and node:http listen({ fd }): serve on an inherited socket #44013, in part) Fixes systemd socket activation doesn't work #22559.
• res.socket.end() on a node:http server now sends its FIN once the bytes res.write() left buffered are out, even if the response never ends. 1.4.4 never sent it, so the client waited forever. (node:http: half-close from the drain gate when socket.end() waited for buffered bytes #44244, in part)
• A node:http server no longer copies the bytes that follow each request head into a Buffer nobody reads. (node:http: create the 'head' Buffer only for a CONNECT or an Upgrade request without a body #44296) Fixes node:http: every request copies the bytes behind its head into a head Buffer that only 'connect' and 'upgrade' read #44208.
• res.end(data) sends its body when a replaced res.writeHead calls flushHeaders() or write(). (node:http: res.end() completes the response when a replaced writeHead() sent the head #44442)
• res.writeEarlyHints(), writeContinue() and writeProcessing() send the 1xx response right away instead of when the handler returns, so Early Hints reach the client before synchronous rendering. (node:http: send a 1xx response when it is written #44468, in part)
• http.Server.call(httpsServer) leaves that server alone, as in Node, and http.createServer({ _pfxExtraCACerts }) no longer throws. (Type check src/js under TypeScript 7 with skipLibCheck off, and fix the node:http bugs it found #44609, in part)
• A failed Bun.serve(), Bun.listen(), http.Server#listen() or net.Server#listen() now reports the error of the call that actually failed, on every platform. (Return the error of a failed listen from usockets to Bun.serve and Bun.listen #44651) Fixes binding privileged port incorrectly reports EADDRINUSE instead of EACCES on macos #30363.
• A chunked http.request() body written under req.cork() is no longer sent after the terminating chunk when req.end() runs before req.uncork(), req.uncork() emits 'drain' after a corked write() returned false, and an uncork() with no matching cork() no longer holds the next chunks of a message back until end(). (node:http: deliver every chunk that a corked OutgoingMessage accepts #44676)
• res.writeHead() with a raw [name, value, ...] list no longer changes an array the caller passed as a value. (node:http: copy the array values of a header list in writeHead() and res.headers= #44778)
• A process now exits after server.close() even if a 'connect' or 'upgrade' socket still has its reads stopped, for example the two-pipe CONNECT proxy from Node's docs whose upstream stalled and whose client gave up. (node:http: a tunnel holds the event loop only while it reads or has bytes left to send #44885, in part)
• Its writeHead() fix is in through node:http: copy the array values of a header list in writeHead() and res.headers= #44778. (node:http: walk the headers of writeHead(status, headers) in native code and send them as given #44944, in part)
• req.socket.setKeepAlive() and http.createServer({ keepAlive, keepAliveInitialDelay }) now turn on TCP keep-alive for server connections, so a peer that vanishes under an SSE stream or a tunnel gets detected. (node:http: make setKeepAlive() and the keepAlive option act on server sockets #45006)
• A change to an array passed to res.writeHead(status, headers) after the call no longer reaches the wire. (node:http: render the response head inside writeHead() #45047, in part)
• In a node:cluster worker, http and https servers share a Unix socket path, listen(0) and listen({ fd }) through the primary, like Node. (node:http: cluster workers listen through the primary's shared handle, Bun.serve({ fd }) #45186, in part) Fixes node:http cluster workers fail to share a Unix socket with EADDRINUSE #44794.
• When a 'checkContinue' listener answers Expect: 100-continue with a final status and never calls writeContinue(), the response now says Connection: close and the server closes the connection, like Node. (node:http: close the connection after a final response to an unanswered Expect: 100-continue #45189)
• server.close(callback), the server's 'close' event and await using server no longer hang when user code removes the last socket's 'close' listeners or when one of its 'close' listeners throws. (node:http: queue the server 'close' check from the connection's close handler, not from a socket 'close' listener #45257)
• node:http ('connect' / 'upgrade' hand-off) and node:dgram (Symbol.asyncDispose) no longer call the program's Function.prototype.bind on an internal function. (node:dgram, node:http: don't pass promise-settling internals to Function.prototype.bind #45292)
• res.writeHead(200); res.write("") now sends the complete response head, so a client (an EventSource, for example) sees the response before the first real chunk. (node:http: an empty write terminates the header section #45986) Fixes node:http: res.write("") sends the response head without the final empty line #45722.
• bun --hot no longer keeps the http.Server (and the whole app behind it) of every earlier reload alive. (node:http: release the earlier http.Server under bun --hot #46039)
• ConnectionsList#expired() from process.binding('http_parser') no longer wraps timeouts above 4294 ms. (http_parser: multiply ConnectionsList#expired() timeouts in 64 bits #46411)
• A node:http server process now exits right after server.close() or server.unref() when the only thing left is a paused upload whose response was already sent, like Node and Bun 1.4.2. (node:http: a paused upload behind a sent response does not hold the event loop #46424)
• Hardening against misbehaving peers: node:http: frame the response body by the value of Transfer-Encoding #33871, node:http: apply the server's idleTimeout at accept so headersTimeout > ~13s is honored #35672, node:https: limit the proxy CONNECT response headers #44454, node:http: write() and end() check the chunk and res.statusCode before the response starts #44505, node:http: stop reading a connection served from JS while the request buffer is full #45841, node:http: gate 'drain' on the bytes of the handle, give write callbacks to the stream #46014, node:http: fix a process exit when a tunnel socket with a pending response is given to emit('connection') #46421.

Bun.serve

• HTTP/1, HTTP/2 and HTTP/3 requests and WebSocket handshakes take one path from the parser to the handler, and a server's state (listening, stopping, closed, drained) is computed in one place.
• Bun.serve sends the automatic 100 Continue for any casing of Expect: 100-continue. (Bun.serve: handle Expect per RFC 9110 (case-insensitive, params/list, auto-417) #30250, in part) Fixes Bun.serve does not auto-respond "100 Continue" when "Expect" header value uses non-lowercase casing (RFC 7231 violation) #30248.
• A response without a body (new Response(), Response.redirect(), a 204 or 304, an untyped stream) never gets a fallback Content-Type: application/octet-stream, whatever the build. (server: don't send a fallback content-type on detached responses #30997)
• An async error() handler that finishes later without returning a Response now answers 500, like a sync one. (Fix Bun.serve error() returning a deferred Promise<undefined> responding 204 #33140) Fixes Bun.serve: error() returning a deferred Promise<undefined> swallows the original error and responds 204 #33137.
• The Content-Disposition header that Bun.serve adds to a Bun.file() response now has a disposition type (inline; filename="a.bin"), so RFC 6266 parsers such as npm content-disposition accept it. (Bun.serve: include disposition-type in auto Content-Disposition header #33655)
• The docs and types for server.timeout(req, seconds) now say that values above 255 are clamped to 255. (Bun.serve: validate server.timeout() seconds argument #34958, in part)
• A request with Expect: 100-continue and a Content-Length over maxRequestBodySize gets the 413 alone, over HTTP/1, HTTP/2 and HTTP/3. 1.4.4 sent 100 Continue first, which started an upload that the server then refused. (Bun.serve: skip 100 Continue when Content-Length exceeds maxRequestBodySize #34960)
• A routes entry of new Response(Bun.file(path), { status: 307 }) (or 308, or 205) no longer leaves keep-alive clients waiting until the idle timeout. (Bun.serve: stream the body for a 307/308 Bun.file() route instead of hanging keep-alive #35024)
• With development: true, the "Welcome to Bun!" page that Bun.serve sends when a handler returns no Response no longer carries Content-Length twice. (Bun.serve: drop duplicate Content-Length on the dev missing-response page #35294) Fixes Bun.serve default fallback response emits duplicate Content-Length header (RFC 7230 violation) #29714.
• Bun.serve no longer sends the upstream's Content-Encoding next to a body that fetch() already decoded, however the handler hands that body on: return fetch(upstream), new Response(res.body, res), a clone, a tee() branch, a Blob, a static route, HTMLRewriter. (Bun.serve: drop Content-Encoding when serving a fetch()-decoded Response #35546)
• server.url no longer throws Invalid URL for a unix socket path such as C:\test, and #, ? or a space in the path no longer cut it short. (Bun.serve: percent-encode unix socket paths in server.url #35806) Fixes Bun.Server.url can return invalid url in windows #40182.
• A fetch handler that returns new Response(Bun.file(path)) for a path that can't be opened now gets 404 Not Found (ENOENT, ENOTDIR, EISDIR, ENAMETOOLONG) or 403 Forbidden (EACCES, EPERM) instead of a 500. (Bun.serve: map Bun.file() open errors to 404/403 instead of 500 #36593) Fixes turn new Response(Bun.File(...)) to proper status code, instead of 500 #4292.
• A Worker that runs Bun.serve or node:http no longer leaks about 800 KB per server type (HTTP, HTTPS, HTTP/2 and HTTP/3) when it exits. (Bun.serve: free a Worker's RequestContext pools when its VM is torn down #37513)
• Bun.serve closes the connection after it answers a CONNECT request. (Bun.serve: close the connection after responding to a CONNECT request #37585)
• An HTML route whose bundle or plugin load failed now answers every request with 500. (Bun.serve: answer requests to a failed HTML route with 500 instead of an empty 200 #37916)
• req.params is no longer shifted when a route has a : inside a literal segment: /files:batchGet/:id now gives { id: "123" } instead of { batchGet: "123", id: "" }. (Bun.serve: only treat a route segment as a parameter when it starts with ':' #37983, in part)
• A Bun.file() response reaches a client that half-closes right after its request (nc -N, socat, Go's CloseWrite, some health checkers) in full. (Bun.serve: finish a Bun.file() response after the client half-closes #38107)
• server.fetch("/path") on a server started with port: 0 gives the handler a request.url with the port the server bound, not :0. (Bun.serve: join server.fetch() relative URLs onto the port the listener bound #39027)
• routes accepts an in-memory Blob as a route value, so "/favicon.ico": Bun.file(favicon) with favicon imported with { type: "file" } no longer throws at startup in a bun build --compile executable. (Bun.serve: accept in-memory Blobs (embedded files, Bun.embeddedFiles) as route values #39304)
• req.body of an upload that arrived completely stays readable after the request ended. (Bun.serve: keep a complete request body readable after the request ends #39660)
• --define and the bunfig [define] table now apply to the scripts of HTML imports served by Bun.serve and bun ./index.html, in development and production. (Apply CLI and bunfig define to HTML bundles served by Bun.serve #40485) Fixes define does not work with run command #40479.
• Types only: a method key in routes now accepts every static value the runtime already accepts there, not just a Response or a handler. (Bun.serve: answer non-GET methods on { dir } routes with 405 #40901, in part)
• Bun.serve falls back to read() + write() when sendfile(2) refuses a file of 1 MiB or more with EINVAL, ENOSYS, EOPNOTSUPP or EPERM (a filesystem without splice support, a seccomp policy). (Bun.serve: fall back to read+write when sendfile(2) refuses the file #41474, in part)
• The development error page cuts each source line at 1024 bytes, like the terminal error printer. (Cap each source line in the dev error page at 1024 bytes #41537)
• After server.reload() with the same HTML import, the /chunk-*.js and /chunk-*.css URLs of the page that was already built keep working. (Bun.serve: keep the chunk routes of a built html route across server.reload() #41576)
• HEAD for a Bun.file() Response from a fetch handler now sends the status and headers GET would: 404 for a missing file or a directory, 206 / 416 for a Range request or a slice, plus Content-Type and Content-Disposition. (Bun.serve: resolve a file body for HEAD the same way as for GET #41585, in part)
• Bun.serve no longer aborts a response that a slow client is still reading. (Bun.serve: do not idle-time-out a response the peer is still reading #41602)
• When a Bun.file() response runs out of bytes before its Content-Length (the file shrank while it was being sent, or fstat overstates it as for a sysfs file), Bun.serve sends what the file has and closes the connection. (Close the connection when a Bun.file response ends short of its Content-Length #41622)
• server.fetch() now calls the handler with (request, server), so fetch(req, server) { server.upgrade(req) } no longer throws undefined is not an object under server.fetch(). (server.fetch(): pass the server as the handler's second argument, accept a URL #41755, in part)
• Bun.serve() defaults to production mode when the program set process.env.NODE_ENV (or BUN_ENV) to "production" before the call, as the docs say (@default process.env.NODE_ENV !== 'production'). (Bun.serve: decide the development default from the live process.env #41926)
• A string Response is sent as text/plain;charset=utf-8 after something read .body or cloned it. (Bun.serve: keep text/plain for a string body whose .body was read #42064)
• With development: true, an HTML route that arrives through server.reload() (or a second Bun.serve() under bun --hot) on a server that started without one now gets the dev server. (Bun.serve: start the dev server when server.reload() adds the first html route #42834) Fixes server.reload doesn't initialize dev server if dev server wasn't previously loaded #23564.
• A static Response route or a Bun.file() route whose headers say Connection: close now closes the connection after that response and doesn't answer requests pipelined behind it. (Bun.serve: close the connection after a static or file route sends Connection: close #43107)
• A Bun.file() route ignores Transfer-Encoding and Content-Length headers on its Response and frames the body from the file's size, like static routes and fetch handlers do. (Bun.serve: drop Transfer-Encoding and Content-Length from a Bun.file() route's Response headers #43108)
• Bun.serve no longer adds the automatic Content-Disposition header when the file name isn't safe inside a quoted string. (Bun.serve: omit the automatic content-disposition for a file name with a control byte or a backslash #43742)
• Bun.serve sends Connection: close in the last response on an HTTP/1 connection: when the request said Connection: close, when it was HTTP/1.0, and when a graceful server.stop() closes the connection after the response in flight. (Bun.serve: send Connection: close in the final response whenever the connection closes after it #43867) Fixes node:http default agent reuses a socket after a Connection: close request in 1.4.2 (every second request ECONNRESET/EPIPE) #43853.
• The server no longer cancels or closes a Response body stream that another reader holds. (Bun.serve: do not end a body stream that a reader holds, and refuse it on HEAD as on GET #43973, in part)
• A % that isn't followed by two hex digits stays a literal % in req.params and in cookie values (req.cookies, Bun.CookieMap). (Bun.serve: keep a % that is not an escape in route params and cookies #44664)
• A Bun.file(path) slice that starts past byte 0 and is as long as the file (slice(5, 21) of 16 bytes) now answers 206 with Content-Range: bytes 5-15/*, like slice(5, 20) and slice(5, 22) already did. (Bun.serve: answer 206 for a Bun.file() slice as long as the file that starts past byte 0 #44827)
• fetch(url, { method: 'TRACE' }) now reads the response body instead of resolving with an empty one, over HTTP/1.1, HTTP/2 and HTTP/3. (fetch, Bun.serve: stop dropping the body of a TRACE response #44889) Fixes TRACE body not sent #19615.
• A streamed Response now sends its complete HTTP/1 head as soon as the handler's microtasks are done, instead of holding the end of the header section back until the first body chunk. (Bun.serve: send the whole HTTP/1.1 response head when a streamed body is not ready #45187)
• new Response(Bun.file(fd)) from a fetch handler now sends the file from byte 0 (or from the slice's or Range's offset) wherever the descriptor's position is, and doesn't move the position. (Bun.serve: read a Bun.file(fd) body at its offset, not at the descriptor's position #45266, in part)
• server.timeout(req, seconds) now works when Bun.serve listens on a unix socket. (Bun.serve: apply server.timeout() on a unix socket server #45360) Fixes Bun.serve: server.timeout(request, seconds) is inert on a unix-socket listener — the same code works on a TCP listener #43816.
• With a "/*" route that names only some methods, every other method now falls through to fetch (or the 404). (Bun.serve: register the default handler on "/*" for every method #45397, in part)
• With development: false, an HTML route that fails to bundle now prints the bundler's error to stderr once. (Print an html route's bundle error to stderr in production too #45580) Fixes Bun.serve with development: false never reports why an HTML route failed to bundle #45238.
• server.timeout(req, n) now holds for a Bun.file() response body over HTTP/1, TLS and HTTP/2. (Bun.serve: apply server.timeout(req, n) to a Bun.file response body #45788)
• Hardening against misbehaving peers: Bun.serve: consume chunked trailer-part instead of rejecting it #32887, Bun.serve: free a gracefully stopped server at VM teardown #37500, Bun.serve: hold a pipelined request until the response ahead of it completes instead of closing the connection #38128, HTTP: cancel unread lazy fetch bodies for HEAD responses #44227, Bun.serve: answer 400 to a request with more than one Host header line #44241, Bun.serve: leave a Response without a body unused when its request is dropped #44753, Bun.serve: write the Content-Length of a file response from the window it streams #44826, Bun.serve: keep idleTimeout armed while an HTTP/1 response write is blocked #44894, Bun.serve: answer 501 to an unknown method and 404 to a router miss, not a closed socket #45396, Bun.serve: stop(true), an HTTP/2 idle timeout with a stream open and a refused client certificate close a TLS connection at once #45990, Bun.serve: abort the request when its body exceeds maxRequestBodySize #45999. Fixes Bun.serve: HEAD of a proxied fetch() Response holds the upstream request open, and fetch() stops after 256 requests #43970. Fixes Bun.serve accepts HTTP/1.1 requests with more than one Host header instead of answering 400 #44232.

fetch, Request, Response, Headers

• A response body that the program cancelled is dropped instead of being decoded.
• fetch keeps one table of its in-flight requests for HTTP/1.1, HTTP/2 and HTTP/3, and requests with the same tls options share one TLS context through a CONNECT tunnel and over HTTP/3.
• new Request() reads its arguments by the rule fetch() uses, and text(), json(), bytes(), arrayBuffer(), blob() and formData() read a body through one function.
• fetch() follows a relative redirect whose Location has :// in its path, query or fragment, like /login?next=https://app.example.com, because every Location is now resolved the way new URL(location, currentURL) does. (http: don't treat relative redirect URLs containing '://' as absolute #30065)
• Acquiring a reader on response.body or request.body no longer uses the body. (Stop treating a locked body stream as a consumed one #33461, in part)
• A fetched Response has type === "basic" and a url without the #fragment, including after a redirect. (fetch: set Response.type and exclude URL fragments per the fetch spec #33499)
• formData() on Request, Response and Blob keeps a leading UTF-8 BOM in urlencoded names and multipart string values, like Node and browsers. (fetch: preserve a leading UTF-8 BOM in formData() #33631)
• fetch() of a data: URL follows the Fetch standard: unpadded or line-wrapped base64 decodes, ;BASE64 is recognized, Content-Type is the URL's own MIME type, it stays readable after the body is consumed, and a bad URL rejects with a TypeError. (fetch: data: URL Content-Type and fragment per the Fetch standard #34896)
• fetch() treats a 204 or 304 response as complete at its header block even if it carries Transfer-Encoding: chunked. (http: ignore Transfer-Encoding: chunked on 1xx/204/304; remove force_last_modified #34919, in part)
• Response.redirect(url, { headers }) is a 302 again instead of a 200 with a Location header, and a string status such as "307" is honored instead of becoming 302. (Response.redirect: coerce status via WebIDL ToNumber and fix {status:200} bypass #35222, in part)
• request.formData() now gives an uploaded file the type the client sent. (Bun.serve, FormData: stop content-sniffing typeless Blob bodies into image/* types #35244, in part) Fixes multipart/form-data: File type is empty for WebP uploads #33012.
• new Request(request, init) and new Request(url, response) copy an empty body instead of sharing the input's stream, so both can be read. (webcore: new Request(request) transfers the body; a used or locked body throws in every copy #35858, in part)
• Headers.prototype.getSetCookie and getAll throw a TypeError when this is not a Headers, instead of returning undefined. (Headers: add brand checks to getSetCookie()/getAll()/count #36000, in part)
• fetch() and node:http requests send every header. (fetch: send every request header instead of silently dropping past the 250th #36433)
• fetch("file:///missing") rejects with a TypeError (code: "ENOENT"), and a directory rejects with EISDIR, instead of resolving with status: 200, ok: true and failing when the body is read. (fetch: reject file: URLs whose path cannot be read #37425)
• fetch() with a Bun.file() body that can't be read (missing file, directory, closed descriptor) rejects with a TypeError, like its other failures. (fetch: reject an unreadable Bun.file() request body with a TypeError #37501)
• Windows: fetch(url, { body: Bun.file(fd) }) no longer leaks one C runtime file descriptor per upload. (fetch: release the CRT fd behind a Bun.file(fd) request body on Windows #37509)
• fetch() with a FormData body that holds a Bun.file() that can't be read rejects with a TypeError, like a bare Bun.file() body (fetch: reject an unreadable Bun.file() request body with a TypeError #37501). (fetch: reject a FormData body whose Bun.file() cannot be read with a TypeError #37514)
• fetch() no longer fails with ECONNRESET when a POST or PATCH gets a 307/308 and the server closes the connection right after it without Connection: close. (fetch: only pool a redirecting connection for idempotent hops; derive the pool key in one place #37522, in part)
• Response.redirect("") has a readable empty Location header: headers.get("location") is "" and iteration and new Headers(h) include it. (Response.redirect(""): store an empty Location value instead of a null one #37893)
• fetch(url, { unix }) follows a same-origin redirect (a relative Location, or an absolute one on the same host and port) over the unix socket. (fetch: follow same-origin redirects over the unix socket #38394)
• fetch() re-sends a Bun.file() body of 32 KiB or more when it follows a 307 or 308 (or a 301/302 for PUT, PATCH, DELETE). (fetch: re-send a Bun.file() body when following a redirect #38406)
• The verbose trace (verbose: true, BUN_CONFIG_VERBOSE_FETCH, bun install --verbose) prints > in front of request lines again, and the dim [fetch] tag on a color terminal, as the docs show. (http: restore the "> " and "[fetch] " prefixes on verbose trace request lines #38691)
• A fetch() body that is a pipe, FIFO or socket (body: Bun.stdin, Bun.file("/dev/stdin"), or such a file inside a FormData) uploads every byte. (fetch: stream a Bun.file() body that is a FIFO, socket, or device instead of reading it on the JS thread #41488, in part)
• new Request() with no argument, undefined, null, a number, a boolean, a symbol, "" or an object without a url throws a TypeError instead of a plain Error, like an invalid URL already did. (Throw TypeError from the Request constructor for a missing or empty url #41551)
• The curl command that verbose: "curl" and BUN_CONFIG_VERBOSE_FETCH=curl print can be pasted into bash or zsh as is. (fetch, audit: write the verbose curl line and the audit fix --ignore line as shell words #41726, in part)
• fetch() sends the body's Content-Type for an empty URLSearchParams, typed Blob or File, also through fetch(new Request(...)). (fetch: send the body's Content-Type for a zero-length typed body #41752)
• fetch(url, { unix }) rejects with a TypeError when unix is a Buffer, URL, number, true or any other truthy non-string, instead of ignoring it and sending the request to the URL's host over TCP. (fetch: reject a non-string unix option instead of dialing the URL host over TCP #41786)
• The redirect half is in with Response.redirect: coerce status via WebIDL ToNumber and fix {status:200} bypass #35222 (Response.redirect(url, {}) is a 302), and new Request(url, { status: 0 }) no longer throws since Request: take a method from RequestInit only when it has one #41994. (Response.redirect/json: check status the same way on the number and ResponseInit forms #41841, in part)
• On macOS, fetch() no longer uploads a Bun.file() body with sendfile(2). (fetch: stop using sendfile(2) for file request bodies on macOS #41905)
• new Request(input, init) keeps the input's method when init has no method, whatever kind of object input and init are. (Request: take a method from RequestInit only when it has one #41994) Fixes new Request(input, init) drops the input's method when input is not a native Request #42759.
• New test: a thread that ends between the delivery of a failed response body and the rejection of the next read releases the fetch once. (fetch: deliver the chunks ahead of a malformed chunk-size before the error #42261)
• The docs now state the size of fetch's idle connection pool (64 per pool, longest-idle eviction) and list BUN_CONFIG_HTTP_IDLE_TIMEOUT. (fetch: raise the keep-alive pool to 128 idle connections and document the bound #42617, in part)
• A headers value that isn't an object (new Headers(1), fetch(url, { headers: "a: b" }), new Response("", { headers: true })) throws Node's ERR_INVALID_ARG_TYPE instead of TypeError: Type error. (Name the argument or option in HeadersInit conversion errors #42961, in part)
• A Headers subclass or instance with its own Symbol.iterator is converted through that iterator wherever a HeadersInit is accepted, from new Headers(h) to server.upgrade(). (HeadersInit: honor an overridden Symbol.iterator on a Headers object #43023)
• fetch.preconnect("https://bun.com") and bun --fetch-preconnect https://bun.com work. (fetch: accept a preconnect URL that has no port #43034) Fixes preconnect URL must have a valid port: #19626.
• fetch() accepts an HTTP/1.1 response with up to 1000 header fields. (fetch: accept responses with up to 1000 header fields #43181, in part)
• fetch(undefined), fetch(123) and fetch({ toString() { return "/path" } }) reject with fetch() URL is invalid instead of the misleading fetch() URL must not be a blank string. (fix(fetch): clearer errors for non-string / host-less URLs #43389, in part) Fixes Misleading error message "URL must not be a blank string" when URL is a non-string value which does not stringify to a fully valid URL with a hostname #21361. Thanks to @TastyHeadphones.
• fetch(url, { body: Bun.file(path).slice(a, b) }) uploads the whole slice of a procfs file, a device or a pipe. (fetch: read a Bun.file() body with st_size 0 to EOF, up to the JS size limit #43964, in part)
• fetch(), new Request() and server.fetch() keep a method that isn't in Bun's method table. (fetch, Request, server.fetch: stop sending GET for a method outside the method table #44718, in part)
• fetch() no longer leaks a file descriptor when the body is an empty window at offset 0 of a file of 32 KiB or more (Bun.file(path).slice(0, 0), or a Bun.file() handle whose size was read as 0 before the file was written). (fetch: send an empty Bun.file() slice without sendfile and close its file #44896)
• text() and json() drop one leading UTF-8 BOM for every kind of body. (fetch, streams: drop one leading UTF-8 BOM in text() and json() of string and stream bodies #45486, in part)
• fetch() honors the server's Keep-Alive: timeout=N header: it stops reusing an idle connection 2 seconds before the timeout runs out, or halfway through it when N is under 4, so a POST no longer fails with ECONNRESET because it raced the server's idle close. (fetch: stop reusing a pooled keep-alive connection before the origin closes it #45497, in part)
• response.headers and request.headers keep the Content-Type of a typed body (Blob, Bun.file(), URLSearchParams, FormData with its boundary) when they are first read after .body, after a reader such as .text(), or after fetch(request). (Keep the body's Content-Type on Response and Request after the body is consumed #45601) Fixes Implicit Content-Type (e.g. FormData boundary) is null if headers are first read after the body is consumed #45245.
• A Content-Encoding: gzip body with junk after its last member decodes the same way however the bytes are split across socket reads. (http: judge the byte after a gzip member once #45715)
• A chunk that script reads from a Response or Request body no longer shares memory with the body's clone. (Response.clone(): copy a chunk when a body-clone branch hands it to script #46080, in part) Fixes fetch: Response.clone() shares chunk buffers between the original and the clone #45782.
• fetch() and static or file routes no longer send an empty Content-Type: header for a Blob whose type is "", such as file.slice(0, n) or an S3 file without type. (Blob: treat an empty type as no Content-Type in fetch and Bun.serve routes #46194)
• With --experimental-http2-fetch, a request the server refuses with HTTP_1_1_REQUIRED is sent again over HTTP/1.1 instead of rejecting with HTTP2StreamReset or HTTP2GoAway. (http(h2): send the request again over HTTP/1.1 after HTTP_1_1_REQUIRED #46259)
• Response.json() decides by what JSON.stringify returns, like the spec and Node. (Response.json: throw TypeError when JSON.stringify returns undefined #46397)
• A program that only reads res.status of large responses no longer stalls in await fetch() for about 15 seconds. (fetch: tell the collector about response body bytes that nothing reads #46434, in part)
• Hardening against misbehaving peers: fetch: never pool an HTTP/1.1 connection that received bytes past the end of a response #42091, fetch: treat a :status of 101 as malformed over HTTP/2 and HTTP/3 #43618, http: fail a tunnelled request with the error its callback found #44534.

Other

• After worker.disconnect() or cluster.disconnect() in the primary, a worker's IPC channel stays open until its servers and sockets have closed, as in Node, so a process.send() from a 'close' listener arrives.
• A child's messages, 'disconnect', 'exit' and 'close' come in that order (onDisconnect before exited and onExit for Bun.spawn). On Linux without pidfd (kernels before 5.6, gVisor) 'exit' can still come first, as on 1.4.4. The callback of a send() that the other end never took is called with EPIPE instead of never.
• Bun.gunzipSync() decodes every member of a concatenated gzip stream (cat a.gz b.gz, BGZF, WARC), with both library: "zlib" and "libdeflate". (zlib: decode all members of a concatenated gzip stream, not just the first #31522, in part)
• Readable.fromWeb(stream) reads everything that is left in a native stream (Bun.file().stream(), blob.stream(), response.body, proc.stdout) that something has already started, and ends without data for one that was cancelled or read to the end. (node:stream: take the native handle in Readable.fromWeb only from a stream no consumer has started #42281, in part)
• response.clone() and request.clone() are typed as Bun's Response and Request in a project without lib.dom. (types: preserve Bun types on Response.clone() and Request.clone() #42672) Fixes Fetch and Response.clone() type errors #41860. Thanks to @davidhevn.
• Bun.serve({ unix, idleTimeout }) type-checks. (bun-types: accept idleTimeout, http2 and http1 with a unix socket listener in Bun.serve #46341) Fixes Types: idleTimeout is missing from UnixServeOptions, though Bun.serve applies it on a unix socket #46138.

Tests, docs and types

Deflakes, faster test files, new coverage, docs and type fixes: #24276, #31354, #32755, #33787, #34833, #35419, #35424, #35744, #35921, #35929, #36153, #36154, #36207, #36376, #36444, #36890, #36945, #36946, #37209, #37433, #37439, #37475, #37806, #37809, #37818, #37832, #37910, #37913, #37935, #38470, #38490, #39042, #39068, #39903, #39948, #39950, #39951, #40083, #40088, #40090, #40197, #40297, #40451, #40453, #40539, #40890, #41111, #41336, #41427, #41919, #41951, #42156, #42206, #42255, #42985, #43627, #44069, #44076, #44080, #44113, #44203, #44256, #44308, #44423, #44427, #44927, #44978, #44979, #45428, #45773, #45953, #46027.

How did you verify your code works?

• Each fix has a test that fails on 1.4.4 and passes on the branch. Bugs only a sanitizer sees were checked against a debug + ASAN build of main. A few tests can't fail on Linux (macOS and Windows fixes), and a few pass on both builds because they guard what the second pass could have broken.
• CI at 9d5ba06: every static check and every lane that has machines pass (Linux, the sanitizer lane, Windows, macOS arm64). Not done yet: the macOS x64 lane has had no machine since be1b3a2, and there's no release benchmark of the final state. The source lints, tsc on the three projects and the check of the published types against the schemas pass.
• For node:* changes, the same script prints the same on Node 26.12.1 and on the branch, apart from the differences listed in the behavior changes. The shims were compared with undici 6.29.0 / 7.30.0 and node-fetch 2 / 3 under Node in the same way. The Node build used has no node:quic, so Node's answers there come from its source and from the original PRs' runs.
• Test files, compared by test name on debug + ASAN builds. Before the second pass, about 1,400 files against main. During it, each group of changes against the build before it: the plain req.socket 236 files (227 pass, and the other 9 also fail on main or need Docker, the internet or a non-root user), node:http responses 108 files (6,261 tests pass, 3 failed: one is fixed since, one belongs to #46522, one needs a non-root user), Bun.serve 106 files (4,845 pass, 1 needs a non-root user), bodies 121 files (7,553 pass, 2 fail: that one, and a 10 s limit on a loaded machine), fetch and the shims 112 files (6,897 tests, 2 failed and are fixed), node:http2 13 files (1,232 pass).
• Node's own tests during the second pass: 465 of 467 test-http-* and test-https-* files (the other 2 fail on main too), 257 of 259 http2 files (the other 2 pass when run separately), 305 of 311 test-quic-* and test-dgram-* files (6 failed before it too, 5 of them the same).
• HTTP client: 2,406 scripted rows differ in 3 from the build before the pass (one connection saved, two races). 1,200 random response streams: no outcome differs. 1,650 random redirect chains: none differs from that build or from Node. Of 90 shapes of Location, 83 equal Node and 7 are as on 1.4.4.
• Request parsing: the old and the new parser in one ASAN + UBSAN binary, 6,000 request streams split at every byte offset, 1.74 million runs: no difference. 8,000 trailer sections against an independent strict parser, 896,000 runs: no mismatch.
• Tables: 1,116 raw requests to Bun.serve (header order, letter case and the Content-Encoding change differ, plus 2 rows by timing), 2,870 rows of Bun.serve options (only an internal key differs), 44 failed listens (all 22 node:* rows equal Node, none did on 1.4.4), 1,440 rows of node:http response bytes (450 changed, all to Node's), 798 TLSSocket members of an https req.socket (all equal a tls.Server socket's), 308 proxy shapes (78 lose a false Content-Encoding, none a true one), 7,104 node:http2 teardown cases (2 differ, listed under #43433), 35 ways to end a server under LeakSanitizer (no leak).
• Random programs: before the second pass, 8,830 programs (24,228 runs on 1.4.4, Node and the branch) found six unintended differences, all fixed. During it, each group reran the families it touches, 240 to 1,300 programs each: no crash, sanitizer report or new hang. What they found is fixed, for example a graceful stop() that waited 16 s for a client.
• The 1,077 identifiers the pass had deleted when #46522 was merged in were searched for in every tracked file, the exported ones also in the prebuilt WebKit and the vendored libraries. One deletion broke the link and was repaired.
• Syscalls (strace): a node:http connection costs the same 8 calls as before the pass, and 800 Bun.serve keep-alive requests the same sendto, recvfrom and epoll_pwait2 counts.
• Speed, on CI's release builds from before the second pass, with main against a copy of itself as the noise control (typically 1 to 3 %). Bun.serve over HTTP/1.1 and node:http hello world were within noise. fetch keep-alive (plain, TLS, and with Keep-Alive: timeout=5) was within 0.7 % of main in cycles per request, with 2 to 4 % fewer user instructions. Slower: a node:http2 server with 100 streams (1 to 2.5 % more cycles) and a node:http2 client downloading 1 MB bodies (4 to 5 %). require("node:http") took 1 % longer and the binary grew by 418 KB.
• Speed during the pass. On CI's profile build with about a third of the node:http2 work: a server's 300,000 GETs take 4.0 % fewer user instructions than main (it was 3.7 % more), and a client's 1 GB download 0.3 % more cycles (it was 5.0 %). uWS by itself, compiled with release-like flags on stubbed sockets, in instructions per request: hello world 3,537 to 2,901, 16 headers 8,959 to 4,912, a static route 3,996 to 3,134, a file 3,875 to 2,786.
• A known cost, not measured on a release build: a node:http response that has to wait for its turn (a pipelined request with an async handler) takes about twice the instructions. Without pipelining, or with a synchronous answer, it's the same or cheaper.
• Same results before and after the pass: http-proxy, socket.io, supertest, koa, got, svelte, vite 6.2's dev server with HMR, hono, express, body-parser, @fastify/websocket. elysia, grpc-js and http2-wrapper fail what they failed before it, plus one elysia test that sleeps 3 ms. Before the pass, fastify, ws, axios, superagent and miniflare matched 1.4.4 too.
• Windows, macOS and FreeBSD code is compiled and run by CI only: the half-close under kqueue, a socket's hand-off on libuv, the QUIC timer and the send loop without sendmmsg, the named pipe's listen error, and #46434's collection on Windows, whose test is skipped there. The HTTP/3 stream reset has no test here, because no lsquic peer can send that stream. It was checked against another QUIC implementation.