From 975ee21cdf7d6f0d756d5e620a2133d3e3c70622 Mon Sep 17 00:00:00 2001 From: Ori Erel Date: Sun, 25 Oct 2026 07:34:33 +0000 Subject: [PATCH] chore: bump Bun to 1.4.4 (CVE-2026-111497) Bun 1.4.3 and older bundle a vulnerable Brotli decoder (CVE-2026-111497). Move the setup-bun pins, packageManager and the @types/bun / bun-types lockfile resolutions to 1.4.4. Signed-off-by: Ori Erel --- .github/workflows/ci.yml | 2 +- .github/workflows/deploy-wmux-client.yml | 2 +- .github/workflows/release.yml | 2 +- bun.lock | 4 ++-- package.json | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c23531e..bfd04d6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,7 +23,7 @@ jobs: - uses: oven-sh/setup-bun@v2 with: - bun-version: "1.3.11" + bun-version: "1.4.4" - name: Install dependencies run: bun install --frozen-lockfile diff --git a/.github/workflows/deploy-wmux-client.yml b/.github/workflows/deploy-wmux-client.yml index 7d2bdeb..18cf851 100644 --- a/.github/workflows/deploy-wmux-client.yml +++ b/.github/workflows/deploy-wmux-client.yml @@ -24,7 +24,7 @@ jobs: - uses: oven-sh/setup-bun@v2 with: - bun-version: "1.3.11" + bun-version: "1.4.4" - name: Install dependencies run: bun install --frozen-lockfile diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bfdd205..280c798 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,7 +23,7 @@ jobs: - uses: oven-sh/setup-bun@v2 with: - bun-version: "1.3.11" + bun-version: "1.4.4" - name: Install dependencies run: bun install diff --git a/bun.lock b/bun.lock index 886a297..2ab1997 100644 --- a/bun.lock +++ b/bun.lock @@ -942,7 +942,7 @@ "@types/babel__traverse": ["@types/babel__traverse@7.28.0", "", { "dependencies": { "@babel/types": "^7.28.2" } }, "sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q=="], - "@types/bun": ["@types/bun@1.3.14", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="], + "@types/bun": ["@types/bun@1.4.4", "", { "dependencies": { "bun-types": "1.4.4" } }, "sha512-9wkRDXUXK124pEnAutE6n/l18j+i9GC5IAHK8TmX/2nlySETmky0OU6yL5U8pW1AoKh++AN9auDCr647BfurjQ=="], "@types/cors": ["@types/cors@2.8.19", "", { "dependencies": { "@types/node": "*" } }, "sha512-mFNylyeyqN93lfe/9CSxOGREz8cpzAhH+E93xJ4xWQf62V8sQ/24reV2nyzUWM6H6Xji+GGHpkbLe7pVoUEskg=="], @@ -1016,7 +1016,7 @@ "bun-ffi-structs": ["bun-ffi-structs@0.2.3", "", { "peerDependencies": { "typescript": "^5" } }, "sha512-pgJiXP+hEgFo9qG51J6ItfY4ocs3vniwNzJ9WhoakB3QB2GdzQxX2EXssentPYlB2hOfJrTjO6iIQkWYzUodpg=="], - "bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="], + "bun-types": ["bun-types@1.4.4", "", { "dependencies": { "@types/node": "*", "undici-types": "*" } }, "sha512-yjrJh5oGX7mMPKGd19YXyIjmEuj4G4zNC30bs7PM9Az7NQ3ndF3j6hbeRdvJTRQEhJ/FYQwW0a2moweEi2hMxQ=="], "caniuse-lite": ["caniuse-lite@1.0.30001761", "", {}, "sha512-JF9ptu1vP2coz98+5051jZ4PwQgd2ni8A+gYSN7EA7dPKIMf0pDlSUxhdmVOaV3/fYK5uWBkgSXJaRLr4+3A6g=="], diff --git a/package.json b/package.json index 5906539..41fa657 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "@playfast/echoform-root", "private": true, - "packageManager": "bun@1.3.11", + "packageManager": "bun@1.4.4", "version": "1.0.0", "repository": "https://github.com/springdotnew/echoform.git", "author": "shmuelhizmi ",