OpenCode v1.19.4: Bun 1.4.4 security fixes, configurable reasoning variants#
Published by Alex Sorokoletov
Part of the OpenCode Version Tracker series. | OpenCode on GitHub | Releases
OpenCode v1.19.4 arrives two releases after v1.19.2 with two Core improvements: the bundled Bun runtime moves to 1.4.4, pulling in upstream security fixes across its TLS, HTTP, WebSocket, and fetch stack along with refreshed root certificates, and v1.19.3 adds configuration for model reasoning options.[1]
No environment variables or experimental configuration keys changed between v1.19.2 and v1.19.4. The two improvements below are the whole of the range.
| Change | Release |
|---|---|
Bundled Bun runtime upgraded to 1.4.4, with security fixes for Brotli, TLS, HTTP/1.1, HTTP/2, HTTP/3, WebSocket, and fetch, and root certificates updated to NSS 3.131.1 | v1.19.4 |
| Model reasoning options are configurable to generate reasoning variants, which replace catalog variants while configured variant overrides are preserved | v1.19.3 |
Bun 1.4.4 in the bundled runtime#
v1.19.4 upgrades the Bun runtime that OpenCode bundles to version 1.4.4. The release notes attribute the change to upstream security fixes spanning Brotli, TLS, HTTP/1.1, HTTP/2, HTTP/3, WebSocket, and fetch, together with a root certificate update to NSS 3.131.1.[1] The notes link to Bun's own 1.4.4 security writeup for the per-area details.[2]
Configurable reasoning variants#
v1.19.3 lets you configure model reasoning options so OpenCode generates reasoning variants. Per the release notes, these generated variants replace catalog variants, and any variant overrides you have configured are preserved.[1] The release notes describe the change at that level, without further detail on the configuration shape.
A release that carries the runtime's security work#
OpenCode bundles its own Bun runtime, so the 1.4.4 upgrade reaches users through an OpenCode update rather than a separate runtime install. A user does not upgrade Bun on the side; for anyone still on v1.19.2 or earlier, moving to v1.19.4 is how the TLS, HTTP, WebSocket, and fetch fixes and the refreshed root certificates land on their machine. The update channel doubles as the delivery path for runtime-level security.
The reasoning-variant change sits on the model-configuration side of the same range. Both are Core improvements, and neither touches the environment-variable or experimental-flag surface, which reads identically to v1.19.2. This is a small point release in OpenCode's near-daily cadence, a maintenance window between larger feature drops rather than a new capability.
Sources#
- OpenCode Releases: v1.19.3 and v1.19.4 release notes
- Bun v1.4.4 security fixes
This analysis is based on publicly available open-source code and release metadata, conducted for educational and research purposes. All trademarks and software referenced belong to their respective owners.
Previous OpenCode analysis: v1.19.2 (October 16, 2026)
All 8 OpenCode analyses: OpenCode Version Tracker · Official OpenCode changelog
OpenCode reference (v1.19.4)