Follow Discord
Sweep 22 Oct 2026 · 21:04Z Build v2.1.309 528 read Stable v2.1.308 Latest v2.1.309 Next v2.1.309 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeReleasesv2.1.219entry #139

Claude Code v2.1.219 ·

bun:ffi dropped for native Bun and process APIs in three low-level paths

Low-level process and hardening paths now use built-in APIs instead of loading system libraries.

Under the hood Internal Changes
JSON All of v2.1.219
Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
ElsewhereArea: what it touches
Internal ChangesKind: in v2.1.219,
Internal ChangesSection of the release
What

Three places that used dlopen through bun:ffi now call native APIs directly, and a fourth FFI helper was deleted.

Details
  • Process replacement no longer dlopens libSystem/libc for execve; it calls process.execve with a sanitized env object where __proto__ is defined rather than assigned.
  • The macOS TCC responsibility-disclaim spawn dropped its posix_spawn FFI dance for process.execve(e, r, n, { macDisclaimResponsibility: !0 }).
  • PR_SET_DUMPABLE hardening now calls Bun.ant.setDumpable(!1).
  • The SO_PEERCRED/getpeereid FFI peer-credential helpers were removed outright.
  • These are macOS and Linux paths; the execve helper still returns early on Windows.
Evidence

prctl(PR_SET_DUMPABLE,0) returned nonzero

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.219 →

Feedback