ci: bump toolchains and upgrade mise-action to v5

.bun-version

@@ -1 +1 @@
-1.4.2
+1.4.4

.github/actions/setup/action.yml

@@ -126,11 +126,10 @@ runs:
         commit: ${{ steps.sticky.outputs.commit }}
 
     - name: Install toolchains
-      uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2
       with:
-        version: 2026.9.0
+        version: 2026.10.17
         install_args: ${{ inputs.tools }}
-        cache_key: ${{ inputs.tools != '' && format('mise-{0}-{1}-{2}-{3}', runner.os, runner.arch, inputs.tools, hashFiles('mise.toml', 'mise.lock', '.node-version', '.bun-version', 'package.json')) || '' }}
 
     - name: Resolve pnpm store path
       if: inputs.dependency-cache == 'true'

.github/workflows/apply-release-notes.yml

@@ -99,7 +99,7 @@ jobs:
             exit 1
           fi
           echo "==> Applying notes for $tag"
-          pnpm exec bun apps/cli/scripts/apply-release-notes.ts --tag "$tag"
+          bun apps/cli/scripts/apply-release-notes.ts --tag "$tag"
           release_url="https://github.com/${{ github.repository }}/releases/tag/${tag}"
           gh pr comment "$PR_NUMBER" --repo "${{ github.repository }}" --body \
             "Applied to [${tag}](${release_url}) after approval by @${APPROVER}."

.github/workflows/build-cli-artifacts.yml

@@ -104,11 +104,11 @@ jobs:
           rcodesign --version
 
       - name: Sync versions
-        run: pnpm exec bun apps/cli/scripts/sync-versions.ts --version "${VERSION}"
+        run: bun apps/cli/scripts/sync-versions.ts --version "${VERSION}"
 
       - name: Build CLI artifacts
         timeout-minutes: ${{ inputs.build_timeout_minutes }}
-        run: pnpm exec bun apps/cli/scripts/build.ts --version "${VERSION}"
+        run: bun apps/cli/scripts/build.ts --version "${VERSION}"
 
       - name: Verify build artifacts
         run: |

.github/workflows/cli-go-ci.yml

@@ -91,10 +91,9 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2
         with:
-          version: 2026.9.0
-          install: true
+          version: 2026.10.17
           install_args: >-
             go
             golangci-lint

.github/workflows/flaky-check.yml

@@ -76,12 +76,9 @@ jobs:
           persist-credentials: false
 
       - name: Install Bun
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          version: 2026.9.0
-          install: true
-          install_args: bun
-          working_directory: .flaky-tooling
+          bun-version-file: .flaky-tooling/.bun-version
 
       - name: Plan runs
         id: plan
@@ -204,12 +201,9 @@ jobs:
           persist-credentials: false
 
       - name: Install Bun
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          version: 2026.9.0
-          install: true
-          install_args: bun
-          working_directory: .flaky-tooling
+          bun-version-file: .flaky-tooling/.bun-version
 
       - name: Download results
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

.github/workflows/mirror-template-images.yml

@@ -66,7 +66,7 @@ jobs:
       # are skipped, so a re-run produces an empty list.
       - name: Detect images missing from the mirror
         id: detect
-        run: pnpm exec bun apps/cli/scripts/detect-unmirrored-images.ts
+        run: bun apps/cli/scripts/detect-unmirrored-images.ts
 
   mirror:
     name: Mirror image

.github/workflows/propose-release-notes.yml

@@ -82,4 +82,4 @@ jobs:
       - name: Propose release notes
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: pnpm exec bun apps/cli/scripts/propose-release-notes.ts --tag "${TAG}" --apply
+        run: bun apps/cli/scripts/propose-release-notes.ts --tag "${TAG}" --apply

.github/workflows/publish-preview-cli-packages.yml

@@ -82,7 +82,7 @@ jobs:
       - name: Prepare package files
         run: |
           set -euo pipefail
-          pnpm exec bun apps/cli/scripts/sync-versions.ts --version "${PREVIEW_VERSION}"
+          bun apps/cli/scripts/sync-versions.ts --version "${PREVIEW_VERSION}"
           pnpm --dir apps/cli build:shim
           find packages -path '*/bin/supabase*' -type f -exec chmod +x {} +
 

.github/workflows/release-config.yml

@@ -91,7 +91,7 @@ jobs:
           resume_token="$(openssl rand -hex 16)"
           echo "::stop-commands::${resume_token}"
           trap 'echo "::${resume_token}::"' EXIT
-          pnpm exec bun packages/config/scripts/release-plan.ts --notes-out "$RUNNER_TEMP/config-release-notes.md"
+          bun packages/config/scripts/release-plan.ts --notes-out "$RUNNER_TEMP/config-release-notes.md"
 
       # Build/gate/pack also run on private-blocked pushes (should_release=false, version set):
       # if `private` is ever flipped back on, the plan half of the release train is already
@@ -127,7 +127,7 @@ jobs:
           mkdir -p "$RUNNER_TEMP/config-release-gate-local"
           tar -xzf "$RUNNER_TEMP/config-release-artifact/supabase-config-${VERSION}.tgz" \
             -C "$RUNNER_TEMP/config-release-gate-local" --no-same-owner --no-same-permissions
-          pnpm exec bun tools/config-release-gate.ts --version "$VERSION" \
+          bun tools/config-release-gate.ts --version "$VERSION" \
             --local-dist "$RUNNER_TEMP/config-release-gate-local/package/dist"
 
       - name: Upload release artifact

.github/workflows/release-shared.yml

@@ -318,10 +318,10 @@ jobs:
           fail-on-cache-miss: true
 
       - name: Sync versions
-        run: pnpm exec bun apps/cli/scripts/sync-versions.ts --version "${VERSION}"
+        run: bun apps/cli/scripts/sync-versions.ts --version "${VERSION}"
 
       - name: Publish to npm
-        run: pnpm exec bun apps/cli/scripts/publish.ts --tag "${NPM_TAG}"
+        run: bun apps/cli/scripts/publish.ts --tag "${NPM_TAG}"
 
       - name: Configure git for release pushes
         run: |
@@ -389,13 +389,13 @@ jobs:
       - name: Upload release assets
         env:
           GH_TOKEN: ${{ github.token }}
-        run: pnpm exec bun apps/cli/scripts/upload-release-assets.ts upload --version "${VERSION}"
+        run: bun apps/cli/scripts/upload-release-assets.ts upload --version "${VERSION}"
 
       # Publishing makes the release immutable, so require every expected asset to be uploaded first.
       - name: Verify release assets
         env:
           GH_TOKEN: ${{ github.token }}
-        run: pnpm exec bun apps/cli/scripts/upload-release-assets.ts verify --version "${VERSION}"
+        run: bun apps/cli/scripts/upload-release-assets.ts verify --version "${VERSION}"
 
       - name: Publish GitHub Release (immutable)
         env:
@@ -514,7 +514,7 @@ jobs:
           git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
       - name: Update Homebrew formula
-        run: pnpm exec bun apps/cli/scripts/update-homebrew.ts --version "${VERSION}" --name "${BREW_NAME}"
+        run: bun apps/cli/scripts/update-homebrew.ts --version "${VERSION}" --name "${BREW_NAME}"
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
@@ -575,7 +575,7 @@ jobs:
           git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
       - name: Update Scoop manifest
-        run: pnpm exec bun apps/cli/scripts/update-scoop.ts --version "${VERSION}" --name "${SCOOP_NAME}"
+        run: bun apps/cli/scripts/update-scoop.ts --version "${VERSION}" --name "${SCOOP_NAME}"
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/sync-branches.yml

@@ -198,9 +198,9 @@ jobs:
           bun-version-file: trusted/.bun-version
 
       # Installs mise only; the script installs the merged tree's own toolchain.
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2
         with:
-          version: 2026.9.0
+          version: 2026.10.17
           install: false
           working_directory: work
 

apps/cli/docs/release-process.md

@@ -497,8 +497,8 @@ Keep two to three stable majors supported at the same time, roughly six to twelv
 
 `**build` (ubuntu-latest):\*\*
 
-1. `[pnpm exec bun apps/cli/scripts/sync-versions.ts --version X.Y.Z](../scripts/sync-versions.ts)` — writes the release version into every `package.json` (umbrella + eight platform packages) and resolves the umbrella's `workspace:`\* `optionalDependencies` to `X.Y.Z`.
-2. `[pnpm exec bun apps/cli/scripts/build.ts --version X.Y.Z](../scripts/build.ts)` — cross-compiles the Bun SFE for all eight targets (including windows-arm64), cross-compiles the Go sidecar, **ad-hoc signs the macOS binaries** (see [Code signing (macOS)](#code-signing-macos)), builds the six Linux packages via `nfpm`, produces the tar/zip archives, and writes `dist/checksums.txt`.
+1. `[bun apps/cli/scripts/sync-versions.ts --version X.Y.Z](../scripts/sync-versions.ts)` — writes the release version into every `package.json` (umbrella + eight platform packages) and resolves the umbrella's `workspace:`\* `optionalDependencies` to `X.Y.Z`.
+2. `[bun apps/cli/scripts/build.ts --version X.Y.Z](../scripts/build.ts)` — cross-compiles the Bun SFE for all eight targets (including windows-arm64), cross-compiles the Go sidecar, **ad-hoc signs the macOS binaries** (see [Code signing (macOS)](#code-signing-macos)), builds the six Linux packages via `nfpm`, produces the tar/zip archives, and writes `dist/checksums.txt`.
 3. `actions/upload-artifact` preserves `packages/cli-*/bin/` and `dist/` for the downstream jobs.
 
 `**smoke-test` (matrix: `ubuntu-latest`, `macos-latest`, `macos-15-intel`, `windows-latest`):\*\*
@@ -510,7 +510,7 @@ The matrix does not yet include `windows-11-arm` (gate 6) or an Alpine musl runn
 `**publish` (ubuntu-latest, `if: !inputs.dry_run`):\*\*
 
 1. Re-runs `sync-versions.ts` (download-artifact restores file modes but not JSON mutations).
-2. `[pnpm exec bun apps/cli/scripts/publish.ts --tag <latest|beta|next|v<N>.stable>](../scripts/publish.ts)` — publishes the eight platform packages in parallel via OIDC trusted publishing (`bun publish --provenance`, no `NPM_TOKEN`), then the umbrella package last so `optionalDependencies` resolve cleanly at install time.
+2. `[bun apps/cli/scripts/publish.ts --tag <latest|beta|next|v<N>.stable>](../scripts/publish.ts)` — publishes the eight platform packages in parallel via OIDC trusted publishing (`bun publish --provenance`, no `NPM_TOKEN`), then the umbrella package last so `optionalDependencies` resolve cleanly at install time.
 3. `softprops/action-gh-release` creates an **empty draft** Release `v<version>` on `supabase/cli`.
 4. `[upload-release-assets.ts upload](../scripts/upload-release-assets.ts)` uploads the archives, packages, `checksums.txt`, unversioned aliases, and `install` script **one asset at a time** with `gh release upload --clobber`, up to three attempts each with a five-minute timeout. `gh` itself retries 5xx responses and dropped connections three times within a second; the outer loop covers longer stalls and the `--clobber` delete, which `gh` does not retry. `uploads.github.com` fails single uploads often enough that this is routine: in September 2026 one beta release hit a multi-hour backend degradation and another lost one connection on a healthy backend. The asset list, retry policy, and timeout handling are covered by the unit and integration tests next to the script.
 5. `upload-release-assets.ts verify` compares `gh release view --json assets` with the expected asset names. The job fails if any asset is missing or not `uploaded`, so a partial set is never published.

apps/cli/package.json

@@ -29,7 +29,7 @@
     "build:binary": "bun scripts/build-binary.ts",
     "build:shim": "bun build src/shared/cli/bin.ts --outfile dist/supabase.js --target node",
     "docs:spec": "bun scripts/generate-docs-spec.ts",
-    "dev": "pnpm exec bun src/main.ts",
+    "dev": "bun src/main.ts",
     "gen:feedback-types": "pnpm dev -- gen types typescript --project-id xguihxuzqibwxjnimxev --schema public > src/shared/feedback/database.types.ts",
     "test": "pnpm run test:unit --coverage.enabled && pnpm run test:integration --coverage.enabled && pnpm run test:e2e",
     "test:unit": "pnpm exec turbo run supabase#test:unit:run --",

apps/cli/scripts/build.ts

@@ -35,7 +35,7 @@ const packageJsonPath = path.join(root, "apps/cli/package.json");
 const packageVersion = JSON.parse(await readFile(packageJsonPath, "utf8")) as { version?: string };
 const version = values.version ?? packageVersion.version;
 if (!version) {
-  console.error("Usage: pnpm exec bun apps/cli/scripts/build.ts [--version <npm-version>]");
+  console.error("Usage: bun apps/cli/scripts/build.ts [--version <npm-version>]");
   process.exit(1);
 }
 if (values.version === undefined) {

apps/cli/scripts/refresh-e2e-timings.ts

@@ -109,7 +109,7 @@ function readResultsCaches(dir: string): VitestResultsCache[] {
     });
 }
 
-const usage = `Usage: pnpm exec bun apps/cli/scripts/refresh-e2e-timings.ts --run <run-id> [--repo supabase/cli]
+const usage = `Usage: bun apps/cli/scripts/refresh-e2e-timings.ts --run <run-id> [--repo supabase/cli]
 
   Downloads the e2e-timings-* artifacts of a test workflow run and rewrites
   apps/cli/tests/e2e-timings.json from them.`;

apps/cli/scripts/sync-versions.ts

@@ -24,7 +24,7 @@ const { values } = parseArgs({
 
 const version = values.version;
 if (!version) {
-  console.error("Usage: pnpm exec bun apps/cli/scripts/sync-versions.ts --version <version>");
+  console.error("Usage: bun apps/cli/scripts/sync-versions.ts --version <version>");
   process.exit(1);
 }
 

apps/cli/scripts/upload-release-assets.ts

@@ -153,7 +153,7 @@ export function missingAssets(expected: string[], uploaded: string[]): string[]
   return expected.filter((name) => !present.has(name)).sort();
 }
 
-const usage = `Usage: pnpm exec bun apps/cli/scripts/upload-release-assets.ts <upload|verify> --version <version>
+const usage = `Usage: bun apps/cli/scripts/upload-release-assets.ts <upload|verify> --version <version>
 
   upload  Upload every release asset to the draft release v<version>, one at a time with retries.
   verify  Fail unless every expected asset is present on v<version> and reported as uploaded.`;

docs/adr/0011-cli-release-and-distribution-strategy.md

@@ -208,8 +208,8 @@ Draft, upload, verify, and finalize by the shared workflow:
     tag_name: v${{ inputs.version }}
     draft: true
     prerelease: ${{ inputs.prerelease }}
-- run: pnpm exec bun apps/cli/scripts/upload-release-assets.ts upload --version "${VERSION}"
-- run: pnpm exec bun apps/cli/scripts/upload-release-assets.ts verify --version "${VERSION}"
+- run: bun apps/cli/scripts/upload-release-assets.ts upload --version "${VERSION}"
+- run: bun apps/cli/scripts/upload-release-assets.ts verify --version "${VERSION}"
 - run: gh release edit v${VERSION} --draft=false
 ```