chore: pin Bun to 1.4.2

.bun-version

@@ -1 +1 @@
-1.4.0
+1.4.2

.github/workflows/ci-bun.yml

@@ -95,7 +95,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       # Node 26 is the CeraLive CI baseline AND the runtime the standalone consumer
       # fixture asserts on: `scripts/verify-consumers.ts` refuses anything but 26.x, so

.github/workflows/release.yml

@@ -124,7 +124,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       - uses: actions/setup-node@v7
         with:
@@ -371,7 +371,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       - uses: actions/setup-node@v7
         with:

AGENTS.md

@@ -1609,7 +1609,7 @@ of the named revisit triggers fires. That record also carries the idea-attributi
 before proposing a rewrite or extending the telemetry surface:
 [`docs/adr/ADR-STAY-TYPESCRIPT.md`](docs/adr/ADR-STAY-TYPESCRIPT.md).
 
-- **Bun 1.4.0** (`.bun-version`, `packageManager` in `package.json`). `control/` + `cli/`
+- **Bun 1.4.2** (`.bun-version`, `packageManager` in `package.json`). `control/` + `cli/`
   are Bun workspace members.
 - **Strict TypeScript 7.0.2** incl. `exactOptionalPropertyTypes` — the repo-root
   `tsconfig.json` is the workspace checker (`bun run typecheck` → `tsc --noEmit`) for both

README.md

@@ -86,7 +86,7 @@ modem-stack/
 └── POLICY.md       no-fork gate + upstream-contribution-first policy
 ```
 
-`control/` and `cli/` form a single **Bun** workspace (Bun 1.4.0, strict TypeScript 7.0.2,
+`control/` and `cli/` form a single **Bun** workspace (Bun 1.4.2, strict TypeScript 7.0.2,
 Biome via `@ceralive/biome-config`). `packaging/` is built in a trixie container — the suite
 the device image runs.
 The two AST-backed source-shape guard tests use the test-only TypeScript 6 compiler-API

cli/smoke/build-binaries.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Cross-compile the bench CLI and the smoke harness for amd64 + arm64.
 #
-# Bun 1.4.0 cross-compiles with `--compile --target=bun-linux-<x64|arm64>` (verified:
+# Bun 1.4.2 cross-compiles with `--compile --target=bun-linux-<x64|arm64>` (verified:
 # the target flag downloads the matching bun runtime and emits a standalone ELF for that
 # architecture). Outputs land in cli/dist/ (gitignored).
 set -euo pipefail

control/src/transport/README.md

@@ -9,7 +9,7 @@ directly on this shape.
 ## Why this library
 
 `@httptoolkit/dbus-native` is a pure-JavaScript D-Bus client (no libdbus / native
-addon), which is the deciding factor: it imports and runs under **Bun 1.4.0** with
+addon), which is the deciding factor: it imports and runs under **Bun 1.4.2** with
 **EXTERNAL** auth on a session bus — session-verified during A2.4, and pinned exactly at
 `0.1.5`. A native-addon client (anything binding libdbus) is a portability and
 cross-compile liability for the arm64 + amd64 device image; a pure-JS client is not.

package.json

@@ -5,7 +5,7 @@
 	"type": "module",
 	"description": "Cellular modem control for CeraLive — @ceralive/modem-control library, bench CLI, and ModemManager-stack .deb packaging (Phase A, standalone).",
 	"license": "AGPL-3.0",
-	"packageManager": "bun@1.4.0",
+	"packageManager": "bun@1.4.2",
 	"workspaces": [
 		"control",
 		"cli"
@@ -20,7 +20,7 @@
 	"devDependencies": {
 		"@biomejs/biome": "2.5.9",
 		"@ceralive/biome-config": "2026.8.1",
-		"@types/bun": "1.4.0",
+		"@types/bun": "1.4.1",
 		"@typescript/typescript6": "6.0.2",
 		"typescript": "^7.0.2"
 	}