Repository navigation
fix: update Bun for CVE-2026-111497 - #19
Merged
Merged
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
ens-api | 11110ac | Commit Preview URL Branch Preview URL |
Oct 24 2026, 01:34 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Update both Bun's package-manager pin and the final image-service runtime from 1.3.6 to 1.4.4. This does not patch the separate imgproxy native image, Cloudflare managed worker runtime, or the workerd development dependency. Those require independent vendor/build verification. Dependency lockfiles are unchanged.
Bun's 1.4.4 release includes the Brotli 1.2.1 update for CVE-2026-111497.
Validation
Passed: image-service frozen install with Bun 1.4.4, lifecycle scripts disabled; image-service TypeScript typecheck; JSON/minimal-diff validation. The published 1.4.4-slim image tag and amd64/arm64 availability were verified through Docker Hub. Docker/image startup and a real screenshot transformation were not run; Docker is unavailable in the audit environment.
Rollout and limits
This is a draft for review, not a deployment or a claim that every dependency is patched. After merge, install the selected runtime, rebuild affected images/executables, restart all replicas/workers, and verify the actual running runtime version. Package-manager metadata alone does not enforce the host runtime. No exploit probes were run.