Repository navigation
8cd58bb0 - Pin Bun to 1.4.4 (Brotli CVE-2026-111497) - #526
Conversation
oven/bun:1.3-alpine was last rebuilt on 2026-05-13 and is frozen on Bun 1.3.14, which bundles a Brotli decoder affected by CVE-2026-111497. Bun 1.4.4 updates Brotli to 1.2.1. All three Docker stages now use the exact oven/bun:1.4.4-alpine tag, setup-bun installs 1.4.4 instead of latest, and engines plus the README and CONTRIBUTING tables require Bun >= 1.4.4.
|
EN: DE: |
|
EN: DE: Details
|
|
EN: DE: DetailsHead:
Durations and timeouts rounded up to whole seconds / Laufzeiten und Zeitlimits auf ganze Sekunden aufgerundet. Original report / Originalbericht{
"base": "bafc82de513107c14e282f4bf83b5e622da5fde0",
"changed_paths": {
"all_markdown": false,
"count": 6
},
"head": "c1a15d4c1b906e195dd52bfa62aa91bae9943221",
"omitted": null,
"policy": {
"path": ".github/a38.json",
"sha": "bafc82de513107c14e282f4bf83b5e622da5fde0"
},
"private": false,
"recorded_at": "2026-10-28T15:01:12Z",
"repo": "21gifts/api",
"required": [
"lint"
],
"runs": [
{
"command": "agent a38 job commands --config '{\"env\":{\"CI\":\"true\"},\"steps\":[[\"bun\",\"install\",\"--frozen-lockfile\"],[\"bun\",\"run\",\"lint\"]]}'",
"duration_s": 16.367883916944265,
"exit_code": 0,
"id": "lint",
"name": "Lint",
"result": "pass",
"timeout_s": 600.0
}
],
"schema": "dfx-local-ci/v2"
} |
The stack table in the canonical concept document still named Bun 1.3, while the image, CI, engines and the other docs now require 1.4.4.
|
EN: DE: DetailsHead:
Durations and timeouts rounded up to whole seconds / Laufzeiten und Zeitlimits auf ganze Sekunden aufgerundet. Original report / Originalbericht{
"base": "bafc82de513107c14e282f4bf83b5e622da5fde0",
"changed_paths": {
"all_markdown": false,
"count": 7
},
"head": "ff3d1d64c4db69121256c49c5a2647557788a28b",
"omitted": null,
"policy": {
"path": ".github/a38.json",
"sha": "bafc82de513107c14e282f4bf83b5e622da5fde0"
},
"private": false,
"recorded_at": "2026-10-28T15:05:14Z",
"repo": "21gifts/api",
"required": [
"lint"
],
"runs": [
{
"command": "agent a38 job commands --config '{\"env\":{\"CI\":\"true\"},\"steps\":[[\"bun\",\"install\",\"--frozen-lockfile\"],[\"bun\",\"run\",\"lint\"]]}'",
"duration_s": 15.907667457999196,
"exit_code": 0,
"id": "lint",
"name": "Lint",
"result": "pass",
"timeout_s": 600.0
}
],
"schema": "dfx-local-ci/v2"
} |
|
EN: DE: DetailsHead: Lane Final result: {"schema":"a38-review/v2","head":"ff3d1d64c4db69121256c49c5a2647557788a28b","passes":2,"defects":0,"set_aside":"none","lanes":[{"id":"conformity-a","result":"pass","status":"complete","provider":"xAI","model":"Grok 4.6","model_number":"grok-4.6","prompt":"Read CONTRIBUTING.md and REVIEW.md at the base revision. Review this pull request against those files and against the linked issue. Do not change any files. Review the complete PR diff for conformity with CONTRIBUTING.md."},{"id":"logic-a","result":"pass","status":"complete","provider":"xAI","model":"Grok 4.6","model_number":"grok-4.6","prompt":"Read CONTRIBUTING.md and REVIEW.md at the base revision. Review this pull request against those files and against the linked issue. Do not change any files. Review the complete PR diff for logical correctness."}]}Fixed during review:
|
|
EN: DE: DetailsPins the Docker image and CI to Bun 1.4.4, whose bundled Brotli fixes CVE-2026-111497. Pinnt Docker-Image und CI auf Bun 1.4.4, dessen gebündeltes Brotli CVE-2026-111497 behebt. Head: Lane Final result: {"schema":"a38-review/v2","head":"ff3d1d64c4db69121256c49c5a2647557788a28b","passes":1,"defects":3,"set_aside":"none","blocks_merge":false,"lanes":[{"id":"conformity-b","result":"pass","status":"complete","provider":"OpenAI","model":"GPT-5.6 Sol","model_number":"gpt-5.6-sol","prompt":"Read CONTRIBUTING.md and REVIEW.md at the base revision. Review this pull request against those files and against the linked issue. Do not change any files. Review the complete PR diff for conformity with CONTRIBUTING.md."},{"id":"logic-b","result":"pass","status":"complete","provider":"OpenAI","model":"GPT-5.6 Sol","model_number":"gpt-5.6-sol","prompt":"Read CONTRIBUTING.md and REVIEW.md at the base revision. Review this pull request against those files and against the linked issue. Do not change any files. Review the complete PR diff for logical correctness."}]}Defects, none of which blocks the merge:
|
EN:
Pins every Docker stage to the exact
oven/bun:1.4.4-alpinetag, becauseoven/bun:1.3-alpineis frozen on Bun 1.3.14 and a rebuild cannot pick up a fix.Bun 1.4.4 updates its bundled Brotli from 1.2.0 to 1.2.1, which fixes CVE-2026-111497 (Brotli decoder out-of-bounds write); this service reaches that decoder through
fetchto LNURL-pay hosts, which auto-inflatesbrresponses.CI
setup-bun,engines.bunand the README, CONTRIBUTING and CONCEPT tables now say 1.4.4 as well.DE:
Pinnt jede Docker-Stage auf den exakten Tag
oven/bun:1.4.4-alpine, weiloven/bun:1.3-alpineauf Bun 1.3.14 eingefroren ist und ein Rebuild keinen Fix mehr bringt.Bun 1.4.4 hebt das gebündelte Brotli von 1.2.0 auf 1.2.1 und behebt damit CVE-2026-111497 (Out-of-bounds-Write im Brotli-Decoder); dieser Service erreicht den Decoder über
fetchzu LNURL-pay-Hosts, dasbr-Antworten automatisch entpackt.CI-
setup-bun,engines.bunund die Tabellen in README, CONTRIBUTING und CONCEPT nennen jetzt ebenfalls 1.4.4.Details
Changes
Dockerfile:deps,builderand runtime stages useoven/bun:1.4.4-alpine(exact patch tag, so the image cannot silently stay on a vulnerable patch again)..github/workflows/ci.yaml(both jobs) and.github/workflows/loan-e2e.yml:bun-version: 1.4.4instead oflatest, so CI tests the same runtime the image ships.package.json:engines.bun>=1.3→>=1.4.4. There is nopackageManagerfield and no.bun-versionfile.README.md,CONTRIBUTING.md,CONCEPT.md: Bun requirement≥ 1.4.4.Reused and added
Reused (only the version value changes):
Dockerfile:12,Dockerfile:19,Dockerfile:25: the existing threeFROMstages..github/workflows/ci.yaml:26,.github/workflows/ci.yaml:59,.github/workflows/loan-e2e.yml:64: the existingoven-sh/setup-bun@v2steps.package.json:53: the existingengines.bunfield.README.md:63,CONTRIBUTING.md:18,CONCEPT.md:676: the existing version tables.Added: nothing. No endpoint, control, error text, clock or permission check is added; no
packageManagerfield or.bun-versionfile is introduced.Verification (local, Bun 1.4.4 container + Postgres 16)
bun install --frozen-lockfilebun.lockunchanged (stayslockfileVersion: 1)bun run lintbun run typecheckbun run handbook:check/e2e:checkbun run test:coveragechmod-denial tests cannot fail a read)bun run test:postgresbun run buildbun run e2edocker build .thendocker run … bun --version1.4.4(revision38afee6c84fcf48c0edb2466aa4b27d287a59c30)Bun 1.4.0–1.4.4 release notes vs. this service
portmust now be an integer in range (1.4.0, elseRangeError);index.tspasses the parsedBIND_ADDRport. StricterTransfer-Encodinghandling (400) and RFC 9112Connection: closehandling.idleTimeout: 0semantics changed in 1.4.4; this service does not setidleTimeout.connectionTimeoutnow bounds the whole handshake;PGSSLMODE=requireagainst a non-TLS server now fails (1.4.0), so check that the deployedDATABASE_URL/PGSSLMODEmatches the server. A swallowed error insidesql.begin()now rejects withERR_POSTGRES_COMMIT_ROLLED_BACK(1.4.3); the twosql.begincall sites inindex.tsdo not swallow errors. Invalidbyteabinds now throwTypeError(1.4.3). libpq URL parameters are no longer forwarded to the server (1.4.4).integration/sql-driver.test.tsalready accepts both the 1.3 and 1.4text[]binding behaviour and passes.crypto.subtlebecame a prototype getter, HKDFkeylen0 now fails, andwrite()afterdigest()no longer throws. The service usescreateHash().update().digest(),timingSafeEqualfromnode:crypto,crypto.subtle.importKey/AES-GCM,crypto.randomUUID()andcrypto.getRandomValues(); none of these is affected by the listed changes, and the tests pass.TypeError(1.4.0); aContent-Lengthmismatch now rejects, and chunked bodies are validated more strictly (1.4.3); non-ASCII header values are sent as Latin-1 (1.4.4). The LNURL-pay, price-candle and push fetches only send ASCII headers.bun.lockis read with--frozen-lockfileunchanged.Left out of scope
bun.lockstill resolves the dev dependency@types/bun(andbun-types) to 1.3.14, sotscchecks against Bun 1.3 declarations. This is types only and does not affect the image or CI runtime; refreshing it is a separate lockfile change.CONTRIBUTING.md(thepostgres-text-array.tstree entry and the Postgres test paragraph) says a JavaScript array cannot be bound by Bun SQL. Under Bun 1.4 it binds (seeintegration/sql-driver.test.ts:80-81); the literal form stays the project convention. This text predates this pull request.