Bun v1.4.2 Fixes Elysia, AsyncLocalStorage Regressions

Bun v1.4.2, released September 5, 2026, exists to clean up the 1.4 line: it fixes both regressions that shipped in v1.4.1 — an Elysia-breaking bun build bug and an AsyncLocalStorage memory leak — plus a @discordjs/ws hang, CMYK JPEG decoding in Bun.Image, a rare just-in-time (JIT) crash, and a garbage collector (GC) crash on musl. If you run any Bun 1.4.x in production, run bun upgrade today. Per the Bun v1.4.2 release notes, written by Dylan Conway, every changelog entry is a fix — there are no new APIs to adopt and no benchmark claims.

What Bun v1.4.2 fixes

Bun v1.4.2 is a pure repair release: two confirmed regressions from v1.4.1, a cluster of crashes and decoding bugs, and an upgraded JavaScriptCore engine. Here is the complete list and what changed:

Only the first two rows are confirmed regressions from v1.4.1. The release notes do not say which earlier versions carried the other bugs, so treat those as "fixed in 1.4.2" rather than "broken since 1.4.0".

The Elysia build failure is fixed

Bun v1.4.1 introduced a bundler regression that broke any build importing Elysia: bun build could rename a nested var to the same name as a let declared in the same block. The output then failed to load with SyntaxError: Cannot declare a var variable that shadows a let/const/class variable. Given this input:

function foo() {
  {
    let exports2 = {};
    var exports = exports2;
  }
  return exports;
}
module.exports = foo();

v1.4.1 produced output equivalent to this (inside the CommonJS module wrapper):

function foo() {
  {
    let exports2 = {};
    var exports2 = exports2; // SyntaxError
  }
  return exports2;
}
module.exports = foo();

The scarier variant: the same bug could give a let the name of a function parameter or catch binding, producing code that evaluates but computes incorrect values. If you shipped a v1.4.1 bundle and something calculated subtly wrong numbers, this bug is a prime suspect. Bun v1.4.2 fixes both forms and adds a regression test.

The AsyncLocalStorage memory leak is fixed

The second v1.4.1 regression hits servers that use AsyncLocalStorage for per-request context — tracing IDs, request-scoped caches, tenant data. In v1.4.1, a timer, immediate, or pending promise created inside store.exit() or a nested store.run() kept the outer store value alive for as long as that timer or promise existed.

getStore() still returned the correct value, so this was purely a memory problem — but a serious one at request volume:

const store = new AsyncLocalStorage();
 
store.run(bigPerRequestContext, () => {
  store.exit(() => setTimeout(() => {}, 3_600_000));
  // v1.4.1 kept bigPerRequestContext alive for an hour
});

One one-hour timer pins a large per-request context for an hour; multiply by traffic and resident memory climbs with no code change on your side. Bun v1.4.2 fixes the retention.

The @discordjs/ws hang is fixed

A Worker from node:worker_threads did not emit its 'online' event first, so a worker's first message could be missed — which is exactly how @discordjs/ws ended up hanging. The event order in Bun v1.4.2 now matches Node.js:

import { Worker, isMainThread, parentPort } from "worker_threads";
import { once } from "events";
 
if (isMainThread) {
  const worker = new Worker(new URL(import.meta.url));
  await once(worker, "online");
  worker.on("message", (msg) => {
    console.log(msg); // never received in v1.4.1
  });
} else {
  parentPort.postMessage("hi");
}

Because the release notes do not state when this ordering bug was introduced, any recent Bun version running @discordjs/ws with unexplained hangs should be upgraded before anything else is investigated.

Bun.Image now decodes CMYK and YCCK JPEGs

CMYK (cyan, magenta, yellow, key) and the related YCCK mode are the 4-component color spaces common in print-originated JPEGs. Before v1.4.2, Bun.Image rejected them with Image: decode failed. Both now decode, and both are converted to RGB on decode, so every transform and output format works on them:

await new Bun.Image("photo-cmyk.jpg").resize(400, 400).webp().bytes();

If your pipeline accepts user uploads, print-exported JPEGs no longer break image processing.

Crash fixes: JIT, musl, and more

Beyond the two regressions, Bun v1.4.2 fixes two crashes that could take down real workloads, plus two lower-severity bugs.

The rare JIT crash

Bun v1.4.2 fixes a rare crash in long-running processes that occurred after a prototype — one that JIT-optimized code had cached property lookups through — was garbage-collected. In practice, a server that has been up for days hits a collection and dies. The release notes describe the crash as rare, but if you have had unexplained overnight crashes on 1.4.x, this fix is the reason to upgrade.

The garbage collector crash on musl

On musl — the C library Alpine Linux uses — Array.prototype.splice, Array.prototype.shift, or shrinking an array's length on an array of objects could crash on the GC thread, or hang if the operation ran while the garbage collector was marking. These are ordinary array operations on plain object arrays, not exotic APIs. Deployments on Alpine or other musl-based systems should treat v1.4.2 as required.

Smaller fixes: JSON errors, an install panic, a descriptor leak

• Detailed JSON parse errors. .json() on a Response, Blob, Bun.file(), or proc.stdout used to reject invalid JSON with a generic Failed to parse JSON; it now surfaces the same SyntaxError message JSON.parse gives, such as JSON Parse error: Expected '}'.
• bun install panic. bun install and bun add could panic with range end index out of range when bun.lockb or a cached registry manifest stored a package-name hash that did not match the name. If you are reworking your package toolchain anyway, npm v12's install-script changes are the larger shift to plan for this year.
• FileSink double-close on Linux. If registering a Bun.file().writer() FileSink with epoll failed — for example when fs.epoll.max_user_watches is exhausted — the file descriptor was closed twice, which could close an unrelated descriptor that had reused the number.

JavaScriptCore gains about 350 WebKit commits

Bun v1.4.2 also pulls in roughly 350 upstream WebKit commits for JavaScriptCore (JSC), the JavaScript engine Bun builds on. The batch brings Intl and TypedArray correctness fixes, a Proxy crash fix, and cheaper Date objects.

Intl correctness fixes

• new Intl.PluralRules("en").select(1n) now returns "one"; it previously threw a TypeError.
• Intl.DurationFormat with style: "digital" no longer prints a stray : when minutes is 0 and hidden.

TypedArray correctness fixes

• new Int32Array(array) — and the other TypedArray constructors — no longer read a stale or missing element when an element's valueOf mutates the array during conversion.
• TypedArray.prototype.slice into a Symbol.species view that overlaps its source on the same buffer now copies in spec order.

The Proxy crash fix

Object.setPrototypeOf(handler, null) on a Proxy handler that had already served a trap could crash when the handler came from a class defined inside a function called many times. That is fixed, and Date objects are now cheaper to create.

Should you upgrade to Bun v1.4.2 today?

Yes in most cases — only the urgency differs by situation:

• You bundle Elysia on v1.4.1 — upgrade immediately. Builds either fail with the shadowing SyntaxError or silently compute wrong values; both forms are fixed.
• You run long-lived servers using AsyncLocalStorage — upgrade immediately. The v1.4.1 leak pins every exited store until its timers and promises settle, and memory grows with traffic.
• You use @discordjs/ws — upgrade; the hang is fixed and the event order now matches Node.js.
• You deploy on Alpine or another musl system — upgrade; ordinary array operations could crash the GC thread.
• You are on 1.4.0 or earlier with none of these symptoms — upgrade when convenient. The release notes list no breaking changes, and every entry is a fix or correctness improvement.

To upgrade, run:

bun upgrade

For a fresh install, the official install script is curl -fsSL https://bun.sh/install | bash; the release notes also list npm install -g bun, Homebrew, Scoop, PowerShell, and Docker (docker pull oven/bun). The release credits three contributors: Dylan Conway, Jarred Sumner, and robobun.

Regression-undoing patch releases are the ones worth shipping same-day — the same calculus behind Next.js's July 2026 CVE patch, where the fix list alone justified the upgrade. While you are auditing your toolchain, VS Code 1.128's agent sessions and Next.js's monthly security release program cover the other recent releases that change how teams plan upgrades. Full details, including the original code samples, are in the Bun v1.4.2 release notes.