mirror of
https://github.com/can1357/oh-my-pi.git
synced 2026-10-28 08:25:38 +08:00
fix(build): bump bundled Bun to 1.4.4 for CVE-2026-111497 and CVE-2026-91403
Pin Bun 1.4.4 in the Dockerfiles, runner image docs, the Nix flake (nix-bun input bumped to the commit adding versions/1.4.4.json), and every oven-sh/setup-bun step in CI so release binaries embed the patched runtime. engines.bun is intentionally unchanged. Fixes #16822 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WFAZozpWAYXDd3KDLK6SaT
This commit is contained in:
Brendan Smith-ElionandClaude Opus 5.5 committed
1 parent
0b5c27ab24
commit
f725d0c17c
7 files changed
+22
-8
No files matched your search
@@ -210,6 +210,8 @@ jobs:
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
|
||||
with:
|
||||
bun-version: 1.4.4
|
||||
- name: Check crate_universe entry
|
||||
run: bun scripts/gen-bazel-lock.ts --check
|
||||
- name: Refresh MODULE.bazel.lock
|
||||
@@ -840,6 +842,8 @@ jobs:
|
||||
steps:
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
|
||||
with:
|
||||
bun-version: 1.4.4
|
||||
- name: Restore bun store
|
||||
id: bun-cache
|
||||
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
|
||||
@@ -1003,6 +1007,8 @@ jobs:
|
||||
steps:
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
|
||||
with:
|
||||
bun-version: 1.4.4
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version: "24"
|
||||
@@ -1087,6 +1093,8 @@ jobs:
|
||||
steps:
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
|
||||
with:
|
||||
bun-version: 1.4.4
|
||||
- name: Generate release notes from CHANGELOGs
|
||||
env:
|
||||
# `gh release list` (used to find the latest published GitHub
|
||||
@@ -1152,6 +1160,8 @@ jobs:
|
||||
steps:
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
|
||||
with:
|
||||
bun-version: 1.4.4
|
||||
- name: Download release binaries
|
||||
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
||||
with:
|
||||
@@ -1187,6 +1197,8 @@ jobs:
|
||||
steps:
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
|
||||
with:
|
||||
bun-version: 1.4.4
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version: "24"
|
||||
@@ -1244,6 +1256,8 @@ jobs:
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
if: env.HAS_TAP_KEY == 'true'
|
||||
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
|
||||
with:
|
||||
bun-version: 1.4.4
|
||||
if: env.HAS_TAP_KEY == 'true'
|
||||
- name: Check out the Homebrew tap
|
||||
if: env.HAS_TAP_KEY == 'true'
|
||||
|
||||
+1
-1
@@ -22,7 +22,7 @@
|
||||
# FROM ${PI_BASE} AS pi-base
|
||||
###############################################################################
|
||||
|
||||
ARG BUN_VERSION=1.4.3
|
||||
ARG BUN_VERSION=1.4.4
|
||||
|
||||
############################
|
||||
# 1) natives-builder — Rust + Bun → pi_natives.linux-<arch>.node (local cargo)
|
||||
|
||||
+1
-1
@@ -17,7 +17,7 @@
|
||||
###############################################################################
|
||||
|
||||
ARG PI_BASE=oh-my-pi/pi:dev
|
||||
ARG BUN_VERSION=1.4.3
|
||||
ARG BUN_VERSION=1.4.4
|
||||
|
||||
############################
|
||||
# 1) web-builder — Bun + Vite, builds the SolidJS dashboard bundle.
|
||||
|
||||
Generated
+3
-3
@@ -95,11 +95,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1789370898,
|
||||
"narHash": "sha256-QBlvSGth1NfAWw7iePOzFlrz0/pX6CfkFCcPALdySNI=",
|
||||
"lastModified": 1792664215,
|
||||
"narHash": "sha256-89U++Pnz9kb8a5Vdx8xAq9z3V172S7A9Surz8mgjGrM=",
|
||||
"owner": "ryoppippi",
|
||||
"repo": "nix-bun",
|
||||
"rev": "48e887d7955c1c05b8d4627ed39bafe4bf2455a7",
|
||||
"rev": "0db08e3d1db83272822209ab82f34b399080494e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
in
|
||||
{
|
||||
bun = pkgs.callPackage (nix-bun.outPath + "/package.nix") {
|
||||
sourcesFile = nix-bun.outPath + "/versions/1.4.2.json";
|
||||
sourcesFile = nix-bun.outPath + "/versions/1.4.4.json";
|
||||
};
|
||||
bun2nix = bun2nixFor system;
|
||||
rustToolchain = rustToolchainFor system;
|
||||
|
||||
@@ -84,7 +84,7 @@ reproduced verbatim (it contains no secrets or redactable host identifiers; the
|
||||
FROM ghcr.io/actions/actions-runner:latest
|
||||
|
||||
ARG RUST_NIGHTLY=nightly-2026-10-06
|
||||
ARG BUN_VERSION=1.4.3
|
||||
ARG BUN_VERSION=1.4.4
|
||||
ARG SCCACHE_VERSION=0.18.0
|
||||
ARG ZIG_VERSION=0.16.0
|
||||
|
||||
|
||||
@@ -20,7 +20,7 @@
|
||||
FROM ghcr.io/actions/actions-runner:latest
|
||||
|
||||
ARG RUST_NIGHTLY=nightly-2026-10-06
|
||||
ARG BUN_VERSION=1.4.3
|
||||
ARG BUN_VERSION=1.4.4
|
||||
ARG SCCACHE_VERSION=0.18.0
|
||||
ARG ZIG_VERSION=0.16.0
|
||||
ARG CMAKE_VERSION=4.4.3
|
||||
|
||||
Reference in new issue
Block a user