[Addin]

Summary

Bun 1.4.0 → 1.4.4, to pick up the security fixes in 1.4.3 and 1.4.4. That includes the TLS hostname-matching fix (CVE-2026-48618), HTTP/2 stream-reset limits (CVE-2023-44487, CVE-2025-8671), and hardening in bun install against malformed registry and tarball URLs, bin fields and tar archives. Every place the runtime is declared is pinned to 1.4.4, @types/bun moves to the latest published version, and both lockfiles are regenerated by 1.4.4.

Closes

Closes #2920

Changes

• Runtime pins: package.json (packageManager, engines.bun), .github/actions/setup-js (version and cache keys), .github/workflows/status.yml, apps/web/vercel.json, apps/mobile/eas.json.
• Images: apps/media-server/Dockerfile, Dockerfile.standalone, apps/render-farm/Dockerfile, apps/web/Dockerfile (image tag and install cache id).
• Types: @types/bun 1.4.0 and latest → 1.4.3 in apps/render-farm and apps/media-server, and both workspaces now list "bun" in compilerOptions.types, matching Bun's documented entry for @types/bun instead of its transitive bun-types.
• Lockfiles: root bun.lock regenerated (482 lines: workspace-qualified resolutions; 173 stale entries pruned); apps/media-server/bun.lock regenerated (12 lines, still lockfileVersion: 1).
• Docs: README.md, CONTRIBUTING.md, AGENTS.md, apps/status/README.md, apps/web/public/llms-full.txt, capcodec/CAP_BASELINES.md.

Decisions

• @types/bun@1.4.4 is not published (npm latest is 1.4.3), so the types lag one patch behind the runtime.
• The root lockfile rewrite is Bun 1.4.4's per-workspace resolution, not a dependency change. Only @types/bun/bun-types change version. It also fixes a real mis-hoist: eslint-config-next was previously one hoisted 16.3.0, ignoring packages/config's exact 13.3.0; it is now recorded per workspace.
• Both Bun workspaces declared @types/bun but pointed compilerOptions.types at its transitive dependency, bun-types. Since @types/bun@1.4.3 is a one-line /// <reference types="bun-types" />, "types": ["bun"] resolves the same declarations and matches the package Bun's docs install.

Verification

Check	Result
bun install --frozen-lockfile	exit 0
bun run check:bun	505 workspace deps match; RN, FFmpeg and sharp pass
tsc-rs -b	0 errors
bun run --cwd apps/web build	exit 0, compiled in 2.1 min
bun run --filter=@cap/render-farm build	17 modules, exit 0
bun run --cwd apps/render-farm typecheck	exit 0
bun test scripts/bun-scripts.test.mjs	3/3 pass
turbo run build --concurrency=2	9 tasks pass; sdk-recorder fails (pre-existing, #2915)

Benchmarks

Same machine throughout: 8 cores, 15.7 GiB RAM, load average 7–11 (not idle). Install figures are medians of 3 alternating runs per version against a warm cache; other figures are single runs of the listed command.

Metric	Before (1.4.0)	After (1.4.4)	Command
No-op install	217 ms	157 ms	bun install --frozen-lockfile
Install, empty node_modules, 2,878 packages	47.4 s	47.7 s (flat)	rm -rf node_modules && bun install --frozen-lockfile

Tooling measurements that informed what is not changed here:

Metric	Result	Command
Typecheck, cold	12,195 ms	tsc-rs -b
Typecheck, warm (.tsbuildinfo present)	4,099 ms	tsc-rs -b
bun check -b	5,077 ms	bun check -b --no-pretty
Biome format gate	2,251 ms, 2,485 files	biome ci . --linter-enabled=false
Bun formatter	1,059 ms, 2,591 files differ	bun fmt --check
Web production build	exit 0, compiled in 2.1 min	NEXT_PUBLIC_WEB_URL=http://localhost:3000 bun run --cwd apps/web build
Full turbo build, --concurrency=2	14.7 s, 9 tasks pass	turbo run build --concurrency=2

The warm typecheck result (12.2 s → 4.1 s) is why caching *.tsbuildinfo in CI, rather than switching to bun check, is the proposed speed-up (#2913). bun fmt is rejected: it would reformat 2,591 files because it targets Prettier config, not biome.json.

No UI surface changes, so there are no before/after screenshots.

Out of scope

• Docker images were not built here; the media-server and web image builds and their in-image tests still need to run.
• @cap/sdk-recorder's DTS type error is pre-existing and tracked in build: bun run build fails on @cap/sdk-recorder DTS — package is outside the typecheck graph #2915.
• bun run build crashes at turbo's default concurrency on a 16 GiB machine, under Node as well; tracked in build: bun run build dies with SIGSEGV/SIGBUS at turbo's default concurrency on a 16 GiB machine #2916.
• Replacing tsc-rs with bun check is blocked on TypeScript 7.1 and the Effect language-service diagnostics; tracked in Tooling: bun check is not a drop-in typecheck gate yet (TS 7.0.2 vs tsc-rs 7.1.0-dev, no language-service plugins) #2913.
• Turbo cannot parse bun.lock v2 (upstream feature request, Unsupported bun lockfile version: 2 (Bun 1.4.0/canary) vercel/turborepo#13117).

Test plan

• bun install --frozen-lockfile → exit 0
• bun run check:bun → 505 deps match, native bindings pass
• tsc-rs -b → 0 errors
• bun run --cwd apps/web build → exit 0
• bun run --filter=@cap/render-farm build → exit 0
• bun test scripts/bun-scripts.test.mjs → 3/3
• docker build -f apps/media-server/Dockerfile . → Expected: in-image test suite passes
• docker build -f apps/web/Dockerfile . → Expected: Next build completes

[vercel]

@Addin is attempting to deploy a commit to the Cap Software Inc Team on Vercel.

A member of the Team first needs to authorize it.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​bun@​1.4.0 ⏵ 1.4.3				+2

View full report

[richiemcilroy]

Thanks @Addin, this is a really thorough upgrade. I checked every place we pin Bun (package.json packageManager/engines, .github/actions/setup-js, status.yml, apps/web/vercel.json, apps/mobile/eas.json, the media-server, render-farm and web Dockerfiles) and they are all covered, and the regenerated bun.lock passes bun install --frozen-lockfile on top of current main. The lockfile churn is only placement changes (eslint-config-next per workspace, @workflow/swc-plugin and @cloudflare/vitest-pool-workers nested) plus the @types/bun bump, which matches what you described. Since 1.4.4 only shipped today and the media server leans heavily on Bun.spawn for ffmpeg, we are going to approve the CI workflows (Docker Build Media Server, Recording Reliability, Typecheck) and a Vercel preview build first and let the release settle for a few days before merging. No changes needed from you right now, we will follow up here once those runs are green.