BunProduct update
Bun v1.3.6
Bun v1.3.6 adds Bun.Archive for creating and extracting tar archives with optional gzip, and fixes a path traversal bug where tarball extraction followed symlinks, now refusing absolute symlink targets and relative ones that climb out of the extraction directory. Null bytes are rejected in Bun.spawn arguments, environment variables and shell template literals to block null byte injection (CWE-158), and wildcard certificates are matched more strictly per RFC 6125; Bun.JSONC parses JSON with comments, and Bun.build gains metafile and files options.
Fixed: Path traversal vulnerability via symlink in tarball extraction.
Saved . A shortened excerpt from Product release notes; the original publisher retains authorship.