Bump CI Bun to 1.4.4 for CVE-2026-111497 (Node2Shell)

Merged
MI
2d ago
+2-2

Summary

CVE-2026-111497 ("Node2Shell", GHSA-663w-cv8g-jj2p) is an out-of-bounds write in the Brotli decoder. It affects Bun 1.4.3 and earlier, and 1.4.4 fixes it.

  • .github/workflows/linter_biome.yaml, .github/workflows/knip.yaml: bun-version: 1.4.3 -> 1.4.4

CI

All make ci targets pass locally except audit. That one also fails on main: bun audit flags existing dev-dependency advisories (js-yaml, picomatch, smol-toml, zod via knip/dependency-cruiser), and this PR does not change them.

Generated by Claude Code

Summary by cubic

Bumps the Bun version used by the CI lint workflows from 1.4.3 to 1.4.4 to fix CVE-2026-111497 (Node2Shell), an out-of-bounds write in the Brotli decoder affecting Bun 1.4.3 and earlier.

  • Updates bun-version in both .github/workflows/knip.yaml and .github/workflows/linter_biome.yaml.
  • The audit CI target still fails on existing dev-dependency advisories; that failure also occurs on main and is not introduced by this change.