From 0cd9f55f8a72171160b7d708f0da46083613ab1c Mon Sep 17 00:00:00 2001 From: Christian Bager Bach Houmann Date: Mon, 26 Oct 2026 23:29:27 +0100 Subject: [PATCH] Pin CI Bun to 1.4.4 for CVE-2026-111497 Bun 1.0.21 through 1.4.3 bundle a Brotli decoder with an out-of-bounds write (CVE-2026-111497, high), and fetch decodes br responses by default. Bun 1.4.4 fixes it, along with two other high advisories against 1.3.14. CI only, so no release. --- .github/workflows/ci.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 593fbc0e..9f9a7ee2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: - bun-version: "1.3.14" + bun-version: "1.4.4" - name: Install dependencies run: bun install --frozen-lockfile - name: Check generated files and plugin invariants @@ -39,7 +39,7 @@ jobs: persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: - bun-version: "1.3.14" + bun-version: "1.4.4" - name: Install dependencies run: bun install --frozen-lockfile - name: Test Windows session hooks @@ -58,7 +58,7 @@ jobs: persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: - bun-version: "1.3.14" + bun-version: "1.4.4" - name: Install dependencies run: bun install --frozen-lockfile # A dry-run sync to the SHA already pinned compares the port with @@ -114,7 +114,7 @@ jobs: persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: - bun-version: "1.3.14" + bun-version: "1.4.4" - name: Install dependencies run: bun install --frozen-lockfile - name: Typecheck