[Aymericr]

Description

Security bump of the Bun toolchain from 1.3.14 to 1.4.4. 1.4.4 is the first patched version for three High advisories in oven-sh/bun:

• GHSA-663w-cv8g-jj2p: out-of-bounds write in the bundled brotli decoder (CVE-2026-111497). Affects versions >= 1.0.21 and < 1.4.4.
• GHSA-26q8-h657-pf84: the bundled root store trusts compromised eMudhra (emSign) intermediate CAs, which lets an attacker impersonate servers during bun install. Affects versions < 1.4.4.
• GHSA-cf8x-9m69-3gg3: HTTP/3 QPACK amplification denial of service. Affects versions >= 1.3.14 and < 1.4.4.

This matters most for release.yml, which runs bun install before publishing @pascal-app/lingo to npm.

Changes (toolchain pins and docs only, no library or app code):

• package.json: packageManager is now bun@1.4.4. This is the only package.json that pins Bun.
• .github/workflows/ci.yml: bun-version: 1.4.4 in all 3 setup-bun steps (check, node-support, site).
• .github/workflows/release.yml: bun-version: 1.4.4.
• apps/site/vercel.json (new): Vercel picks Bun based on the lockfile format and ignores packageManager, so the dc07bbf preview still installed with Bun 1.3.14. The Vercel project's root directory is apps/site, and the file follows pascalorg/private-editor's pattern:
  • installCommand: cd ../.. && npx -y bun@1.4.4 install --frozen-lockfile
  • buildCommand: cd ../.. && npx -y bun@1.4.4 run build --filter=lingo-site. This replaces the previous bunx turbo run build --filter=lingo-site. The site build calls bun run typecheck, and nested bun calls inherit 1.4.4 from the outer bun run.
• AGENTS.md and CONTRIBUTING.md: the stated Bun version is now 1.4.4.

The repo has no Dockerfile, .bun-version, or .tool-versions. react-doctor.yml doesn't install Bun.

bun.lock is unchanged. Bun 1.4.4 accepts the existing lockfile (lockfileVersion: 1) with bun install --frozen-lockfile and doesn't rewrite it, so no other dependencies change.

The Vercel preview at a18f290 logs bun install v1.4.4 (38afee6c8).

This doesn't trigger a release: release.yml runs only on workflow_dispatch.

Checklist

Gates (run locally with Bun 1.4.4 and Node 22)

• bun run check green (typecheck, tests, build, size budgets, corpus gate, zero-deps gate)
• bun run lint green
• Corpus diff unchanged (no source changes)
• Site build green (CI site job and Vercel preview)

Knowledge layer

• No CHANGELOG entry: the published package and its runtime are unchanged. Only the contributor, CI, and Vercel toolchain moves.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
lingo	Ready	Preview	Oct 27, 2026 2:12pm UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T13:42:00.838083Z	dc07bbf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.