Files
i098andRobin Malfait d580998627 Bump Bun to 1.4 so macOS standalone binaries get a valid code signature (#20578)
## Summary

Fixes #20544.

`bun build --compile` in Bun 1.3.14 writes the ad-hoc Mach-O signature
with the hash of the last 4 KiB page taken over a zero-padded page, not
the real bytes. `codesign --verify` reports an invalid signature, and
macOS 27 checks that page at launch and kills `tailwindcss-macos-arm64`.
Bun 1.4.1 and later sign the real bytes.

This bumps `bun` and `@types/bun` in `@tailwindcss/standalone` from
`^1.3.14` to `^1.4.1`. The lockfile now resolves Bun 1.4.3. The fix
reaches users with the next release, because the binaries are built at
release time.

## Test plan

I built the standalone binaries before and after the bump on Linux (`cd
packages/@tailwindcss-standalone && pnpm build`) and hashed every
4096-byte page of `dist/tailwindcss-macos-arm64` against its
`LC_CODE_SIGNATURE` CodeDirectory:

| | Bun | bad pages | last page hash matches the zero-padded page |
|---|---|---|---|
| `main` | 1.3.14 | `[(17905, 2736)]` | yes |
| this PR | 1.4.3 | none | no |

I could not run the binary on macOS 27, so the launch kill itself is not
tested here.

Also checked with the bump: `pnpm install --frozen-lockfile` passes, the
build finishes for all 7 targets, and the `tailwindcss-linux-x64` binary
builds `@import "tailwindcss"` and generates `.flex`, `.p-4` and
`hover:underline` for a small HTML file.

`dist/tailwindcss-macos-arm64` grows from 73.9 MB to 81.3 MB.

I did not run `integrations/cli/standalone.test.ts`, because it needs
`pnpm pack` tarballs of every package, including the WASM build.

I am new to open source, and this pull request was made with AI
assistance.

---------

Co-authored-by: Robin Malfait <robin.malfait@shopify.com>
2026-10-15 23:18:06 +02:00
..
2026-07-02 11:45:49 +02:00
2024-09-02 15:23:46 +02:00