sproutboat 0.49.0 → 0.50.0

package/CHANGELOG.md

@@ -10,6 +10,24 @@ maintained going forward by the `release` skill.
 
 ## Unreleased
 
+## [0.50.0] - 2026-11-02
+
+Built on `@sproutboat/runtime` 0.41.0, `@sproutboat/toolchain` 0.22.0 and `@sproutboat/wire` 0.21.4. Each change below that an existing app could observe starts at a new compatibility date; earlier dates answer as before.
+
+### Added
+
+- **`fetch()` on a standalone binary runs off the event loop from `2026-11-16`**: 20 concurrent fetches to a 100 ms endpoint take about
+  105 ms instead of 2,040 ms, and other requests keep being served meanwhile. Requests now interleave across `await fetch()`, as in workerd,
+  which is why it starts at a new date; earlier dates answer as before.
+
+### Changed
+
+- **Secrets from the environment decode as UTF-8 from `2026-11-07`** on a standalone binary. Before, the handler got the environment's bytes one char per byte, so `é` arrived as `é`.
+
+### Performance
+
+- **ES256 (ECDSA P-256) in `crypto.subtle` signs 2.2x and verifies 3.1x faster** (macOS arm64, standalone and broker: 2,563 to 5,621 signs and 1,318 to 4,050 verifies per second). BearSSL is pinned to master commit `7bea48e` instead of 0.6 (source: the bearssl.org gitweb snapshot, sha256 `ed397832…`) and the runtime selects its 64-bit P-256 code (`ec_p256_m64`) where the target has a 128-bit multiply, which includes both Linux targets. Results are unchanged, so there is no new compatibility date; every other primitive is as before.
+
 ## [0.49.0] - 2026-10-31
 
 Built on `@sproutboat/runtime` 0.39.0, `@sproutboat/toolchain` 0.22.0 and `@sproutboat/wire` 0.21.2. Nothing an app can observe changes, so there is no new compatibility date.

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.49.0
+**Package:** `sproutboat` 0.50.0
 
 ## Commands
 

package/THIRD_PARTY_NOTICES.md

@@ -10,7 +10,7 @@ to its upstream source.
 | Zig | `0.16.0` | Acquired cross-compiler | MIT | https://ziglang.org |
 | uWebSockets and uSockets | `360c276d609d59af56ae6932adb95154ace9f15f` | Embedded source and static archive | Apache-2.0 | https://github.com/uNetworking/uWebSockets |
 | SQLite | `3.50.4` | Acquired for standalone builds | Public domain | https://sqlite.org |
-| BearSSL | `0.6` | Acquired for standalone builds | MIT | https://bearssl.org |
+| BearSSL | `7bea48e` (master) | Acquired for standalone builds | MIT | https://bearssl.org |
 
 ## Integrity pins
 
@@ -19,7 +19,7 @@ to its upstream source.
 | Porffor source archive | `1a62187a93356b36cb6ac703ce9770c8917e4fa65545fd7c33ee8a180ae5a4c9` |
 | Embedded uWebSockets archive | `e83736f3f8cf9d56a1ebe6ea61625a7af12386763374d47c14cff472ada7484a` |
 | SQLite amalgamation archive | `1d3049dd0f830a025a53105fc79fd2ab9431aea99e137809d064d8ee8356b032` |
-| BearSSL source archive | `6705bba1714961b41a728dfc5debbe348d2966c117649392f8c8139efc83ff14` |
+| BearSSL source archive | `ed397832b1613582737d9c1ce01c1af74ad6a9e9c52a341e24433987cda0f372` |
 | Mozilla CA bundle | `f66dff1bdf8f96060b8177976f8b7d9254bc89bc4db933d769f7384d28480bc9` |
 
 The complete Apache-2.0 notice for uWebSockets and uSockets is retained in the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.49.0",
+  "version": "0.50.0",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,9 +64,9 @@
     "@sproutboat/artifact": "^0.3.0",
     "@sproutboat/assets": "^0.3.0",
     "@sproutboat/config": "^0.6.0",
-    "@sproutboat/runtime": "^0.39.0",
+    "@sproutboat/runtime": "^0.41.0",
     "@sproutboat/toolchain": "^0.22.0",
-    "@sproutboat/wire": "^0.21.2"
+    "@sproutboat/wire": "^0.21.4"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.85.0",
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.49.0",
-    "@sproutboat/cli-darwin-x64": "0.49.0",
-    "@sproutboat/cli-linux-arm64": "0.49.0",
-    "@sproutboat/cli-linux-x64": "0.49.0"
+    "@sproutboat/cli-darwin-arm64": "0.50.0",
+    "@sproutboat/cli-darwin-x64": "0.50.0",
+    "@sproutboat/cli-linux-arm64": "0.50.0",
+    "@sproutboat/cli-linux-x64": "0.50.0"
   },
   "engines": {
     "node": ">=18"

package/src/bearssl.ts

@@ -22,9 +22,16 @@ import { resolve } from "node:path";
 import { LINUX_TARGETS, type BuildTarget } from "./targets";
 import { resolveHostCompiler } from "./toolchain";
 
-export const BEARSSL_VERSION = "0.6";
-const BEARSSL_URL = `https://bearssl.org/bearssl-${BEARSSL_VERSION}.tar.gz`;
-const BEARSSL_SHA256 = "6705bba1714961b41a728dfc5debbe348d2966c117649392f8c8139efc83ff14";
+/**
+ * BearSSL master, pinned to a commit: 0.6 (2018) predates `ec_p256_m64`, the 64-bit P-256 code that
+ * crypto.subtle selects explicitly (ES256 sign 2.9x, verify 5.7x faster). There is no release after 0.6,
+ * so the source is the gitweb snapshot of this commit, pinned by the digest of its bytes.
+ */
+export const BEARSSL_COMMIT = "7bea48e5e850ab4cafbe68d3765cdaba13a86d6f";
+export const BEARSSL_VERSION = BEARSSL_COMMIT.slice(0, 7);
+const BEARSSL_TREE = `BearSSL-${BEARSSL_VERSION}`;
+const BEARSSL_URL = `https://bearssl.org/gitweb/?p=BearSSL;a=snapshot;h=${BEARSSL_COMMIT};sf=tgz`;
+const BEARSSL_SHA256 = "ed397832b1613582737d9c1ce01c1af74ad6a9e9c52a341e24433987cda0f372";
 
 /**
  * The Mozilla root set, as curl publishes it. Pinned by hash like everything
@@ -118,7 +125,7 @@ async function download(url: string, expected: string, to: string): Promise<Buff
 /** Unpack the source tree once, and build the host tools we need from it. */
 async function sourceTree(): Promise<string> {
   const dir = cacheDir();
-  const tree = resolve(dir, `bearssl-${BEARSSL_VERSION}`);
+  const tree = resolve(dir, BEARSSL_TREE);
   return withBearsslLock(dir, "source", async () => {
     const tarball = resolve(dir, "bearssl.tar.gz");
     const sourceManifest = resolve(tree, ".sproutboat-source");
@@ -142,7 +149,7 @@ async function sourceTree(): Promise<string> {
     await mkdir(stage, { recursive: true });
     const untar = await run("tar", ["xzf", tarball, "-C", stage]);
     if (untar.code !== 0) throw new Error(`could not unpack BearSSL: ${untar.stderr}`);
-    const stagedTree = resolve(stage, `bearssl-${BEARSSL_VERSION}`);
+    const stagedTree = resolve(stage, BEARSSL_TREE);
     if (!existsSync(resolve(stagedTree, "inc/bearssl.h"))) {
       await rm(stage, { recursive: true, force: true });
       throw new Error("BearSSL archive did not contain bearssl.h");