[backnotprop]

Bun 1.4.4 was released Oct 22. The owner made a one-time exception to the 7-day release-age rule for this security fix.

Why

Eight eMudhra intermediate CA keys were compromised in Oct 2026. Bun 1.3.14 embeds "emSign ECC Root CA - G3", and bun build --compile copies Bun's root list into every release binary. Bun 1.4.4 moves to NSS 3.131.1, which drops that root. It also adds Node's blocked public keys check for the compromised keys (oven-sh/bun#46300).

Credit

• @iMacTia wrote the pin change in fix(ci): build with Bun 1.4.4 so release binaries drop the eMudhra root #2214. Commit 1 is that diff, with Co-authored-by.
• @FNDEVVE found the Bun 1.4 node:http listener change and the waitForFile race in chore: upgrade bun runtime to 1.4.2 #1489. Commit 2 folds those fixes in, with Co-authored-by.

Changes

1. Bun 1.3.14 → 1.4.4 in all 11 workflows: 20 setup-bun pins, plus the DAST BUN_VERSION and target image. Also the Renovate pin note and the build doc. I re-read the DAST digest from the registry: oven/bun:1.4.4-slim index sha256:1846adf22496bd711036aae8be147e57bdebbaea2e5264e3e0b5af1db187d9a4. docker buildx imagetools inspect and the Hub API agree, and docker run on that digest prints 1.4.4. There is no packageManager field, no .bun-version, and no Bun pin in scripts/install.*.

2. Tests (from chore: upgrade bun runtime to 1.4.2 #1489). In Bun 1.4, as in Node, every node:http Server gets its own "listening" listener when it is created. The Pi port tests now count listeners from that baseline instead of from 0. waitForFile now waits until the file has content, not only until it exists.

3. Pi: end open event streams before stop() destroys their sockets. Pi calls closeKeepingDraft() and then stop() right away.

   • closeAllConnections() dropped the session-closed write, so the open tab never learned that the review closed. This also happens on Node 24, Pi's real runtime.
   • Bun 1.3's closeAllConnections() left the stream open, so decision-listener-throw.test.ts passed only on Bun 1.3.
   • stop() now ends the streams first, in the plan, annotate and review servers. I checked this on Node 24, Bun 1.3.14 and Bun 1.4.4.

4. patches/@opencode-ai%2Fsdk@1.19.3.patch. The SDK's SSE abort handler calls void reader.cancel().

   • On Bun 1.4 that promise rejects with AbortError, nothing handles the rejection, and the process ends. In the compiled server that would happen on every OpenCode Ask AI answer or Stop.
   • Node 24 and Bun 1.3.14 resolve the promise. SDK 1.19.4 has the same code.
   • The patch catches the rejection in the v1 and v2 clients. It is applied in the compiled binary and in the OpenCode plugin's embedded.js.
   • bun.lock changes only by its patchedDependencies entry.

5. Two DOM checks that Bun 1.3 passed while they failed. On Bun 1.3.14, expect(el).toBeNull() passed for a React-attached element when the failure message was too long to format. Bun 1.4.4 reports "The error message exceeds the maximum string length".

   • DiagramViewer left the composer open when the host turned commenting off. It now closes it when canCreate becomes false.
   • compose.test.tsx expected the Drafts count to be 0, but the seeded world has an unsent reply. It now asserts the server's count.
   • The failing first test also made the 1.4 runner kill the beforeAll server ("killed 1 dangling process"). That cascaded into 13 ECONNREFUSED failures.
   • The guides.show viewer bundles DiagramViewer, so packages/core/guide-viewer-manifest.ts is re-pinned. Without this change, Bun 1.4.4 reproduces main's manifest byte for byte, so the bump itself does not move it.

6. Inbox: the stream watchdog is 5 minutes, not 30 s. Bun 1.4 reads a streamed body only as fast as the client takes it. Bun 1.3.14 read the whole range into memory at once.

   • So a player paused with a full buffer leaves a live answer unread, and the 30 s watchdog cut it short. Measured with a 2 s watchdog: a 200 KB/s client lost its 8 MiB answer at 14 s on 1.4.4, never on 1.3.14.
   • Bun 1.4.4 also fixed what the watchdog was for: it cancels clients that left before the answer started, and FileHandle.close() during a read closes the descriptor. The watchdog is now a backstop.
   • The 8 MiB cap per answer stays.

7. Release gate: scripts/check-bun-runtime-trust.ts. In release.yml, before upload, every compiled binary must meet three conditions:

   • it embeds Bun >= 1.4.4;
   • it does not hold emSign ECC Root CA - G3 as PEM, DER or public key;
   • it has Bun's blocked-key check (marker addBlockedSPKIForTesting; the eight key hashes are compiled into code and cannot be searched).

   The gate reads bytes only, so the Linux builder also checks the darwin and Windows binaries. It requires at least 12 binaries. Locally, all 12 1.4.4 binaries (6 CLI, 6 paste) pass, and the 1.3.14 builds fail all three checks. Synthetic-buffer unit tests are included.

8. Older-CPU smoke control. In Bun 1.4.4, bun-linux-x64 and bun-linux-x64-baseline are byte-identical (sha256 10702245766b…ac235 in both signed release zips). So the default-target control binary no longer gets SIGILL under qemu -cpu Nehalem, and the "must SIGILL" control failed.

   • The control is now one AVX2 instruction built with gcc on the runner. It runs natively and must exit 132 under the same qemu command.
   • Checked in an amd64 container: it exits 132, the same as a Bun 1.3.14 default-target build. 1.3.14 and 1.4.4 baseline builds run there.
   • The control binary's build, upload and download steps are removed.

9. Host runtime floors. These only produce warnings; they never block an install.

   • OpenCode plugin: engines.bun >=1.4.4.
   • Pi extension: engines.node >=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1. These are the Oct 20–21 Node security releases with NSS 3.131.1 and tls: reject chains containing blocked public keys nodejs/node#66871.
   • @plannotator/server (private) drops its bun >=1.0.0 peer, so the 13 bun@1.4.0 / @oven/bun-* entries leave bun.lock.
   • Both READMEs state the floor.

10. No compile path builds on an older Bun. scripts/require-bun.ts fails on Bun < 1.4.4. The t3-code build and tests/manual/local/sandbox-codex.sh run it first. tests/manual/ssh/Dockerfile installs bun-v1.4.4. The build guide now says ">= 1.4.4" (it said ">= 1.3.14") and documents the gate.

11. Renovate. Minor and major bun-version bumps stay off. A Bun patch release now opens its own PR, which is never automerged and waits out the 7-day release age. The PR body lists the checks to run and the dast.yml bump.

12. Comments re-measured on 1.4.4. Each was probed on both versions:

    • bunfig [loader]: the Decision mode: the agent contract lines on the Queue card, and #2141's review follow-ups #2154 cache bug does not happen on 1.4.4. The loader stays.
    • gh-tripwire: Bun.spawn, Bun.spawnSync and Bun.which still use the environment the process started with, so the wrappers stay. Node's sync spawns and Bun Shell lookups now use the current environment.
    • diagram-engine: a type: "text" import now costs about 2 ms (2.6 s on 1.3.14).
    • IPv6 hostname brackets: unchanged.
    • Inbox byte-range facts: rewritten to say what each version does.

13. Two Inbox tests that a GC could break on 1.4.4. Bun 1.4.4 closes the connection of a streamed Response that is garbage-collected while nothing reads it; 1.3.14 keeps it open. inbox-notify-origin and inbox-shared-windows dropped their event-stream responses after one read, so a GC mid-test closed a tab. CI saw this once: windows: 1 where the test asserted 2. Both tests now hold their responses until they abort them. A reader that keeps a read pending (every production client loops or uses for await) survives continuous GC on both versions.

14. Main's new Inbox tests under Bun 1.4.4 (merged origin/main, no rebase):

    • boardPage.test.tsx, phone: toBeNull() on the folded Shipped card passed on 1.3.14 only because the failure was too long to format. On 1.4.4 the failure printed 2.77 GB of output, and CI's test job hit its 45-minute limit. A folded group keeps its body in the DOM, hidden, because aria-controls points at it. So the component is right and the test now asserts hidden, then shown, as plain words.
    • boardSend.test.tsx pressed Send before the window's live-sessions read was answered. On 1.4.4 the answer lands just after the click, so the picker never opened, the test timed out, and the runner killed the shared server (ECONNREFUSED for the rest). The test now waits for that answer.
    • tour.test.tsx (also notifyHook and firstRunNotifications) restored window.Notification = undefined, which 'Notification' in window reads as support. A read still in flight after the unmount then hit Notification.permission: an unhandled error between tests, 4 of 6 runs on 1.4.4. The tests now delete the property, and notify.ts treats only a Notification constructor as support.

15. @opencode-ai/sdk pinned to exactly 1.19.3, the version its patch is for. A ^ range would let a bump drop the patch silently.

Binary size

On Bun 1.4.4 the CLI grew 53% (darwin-arm64 158 → 243 MB). The three app pages (index.html, review.html, inbox.html, about 64 MB together) were imported with { type: "text" }. Bun 1.4 stores such an import, if it is not pure ASCII, as its own embedded file in UTF-16, which doubles it. Our pages have curly quotes and other non-ASCII text.

• Ruled out: sourcemaps, bytecode and duplicated assets. --minify saves 3 MB, --sourcemap=none saves nothing, and Bun has no flag for this.
• The rest of the growth is Bun's runtime itself (+26 MB on macOS).

Fix (chosen): import the pages with { type: "file" } (stored as built), and read each into the same string when a server first needs it (embeddedPage). Servers get exactly what they got before.

Alternative measured and rejected: escape the pages to pure ASCII and keep type: "text". It came to 180.1 MB with slightly faster first fetches, but:

• Latin-1 is not enough (it stays 243 MB);
• it needs about 110k escapes per page, correct in JS, CSS, regex and HTML contexts;
• the served bytes change.

Inventory of embedded assets:

• The 3 pages (changed).
• Diagram engine ×3 and Inbox tour ×15: already type: "file".
• The agent-terminal sidecar: a 5 KB ASCII type: "text", unchanged.
• 20 call-flow lockfiles: type: "json", unchanged.
• The paste service embeds nothing.

Sizes (MB)

	0.28.31 (Bun 1.3.14)	1.4.4 unfixed	1.4.4 fixed
CLI darwin-arm64	157.7	242.9	179.2
CLI darwin-x64	162.7	250.7	187.5
CLI linux-x64	187.1	261.6	198.4
CLI linux-arm64	187.1	261.7	198.5
CLI win32-x64	191.3	267.8	204.6
CLI win32-arm64	188.1	252.7	189.5
paste darwin-arm64	63.4	89.2	89.2
paste darwin-x64	69.2	98.2	98.2
paste linux-x64	93.6	109.1	109.1
paste linux-arm64	93.7	109.2	109.2
paste win32-x64	97.8	115.3	115.3
paste win32-arm64	94.6	100.2	100.2

What remains over 0.28.31 is Bun 1.4.4's own runtime; the paste rows grow by exactly that.

Performance (darwin-arm64, medians of 12 runs, round-robin, sandboxed; 0.28.31 is the verified release binary)

	0.28.31	1.4.4 unfixed	1.4.4 fixed
--version	427 ms	181 ms	174 ms
--version max RSS	563 MB	240 MB	112 MB
review: server ready	985 ms	727 ms	673 ms
annotate: server ready	536 ms	271 ms	275 ms
review GET /: first, TTFB/total	4.9/7.6 ms	4.8/8.3 ms	5.3/7.6 ms
review GET /: repeat	2.7/5.0 ms	2.3/4.8 ms	2.3/4.8 ms
annotate GET /: first	5.6/9.2 ms	5.6/8.8 ms	7.1/10.4 ms
annotate GET /: repeat	3.5/6.8 ms	3.1/6.3 ms	3.3/6.5 ms
review server RSS, idle → after serving	626 → 642 MB	267 → 277 MB	202 → 210 MB
annotate server RSS, idle → after serving	572 → 595 MB	245 → 256 MB	214 → 236 MB

The fixed build's first fetch of the 24 MB annotate page is about 1.8 ms slower than unfixed. That is statistically real over 20 extra rounds, and repeats are equal. In remote mode (first gzip request), fixed and unfixed are within noise.

Same bytes and headers. The fixed and unfixed builds send byte-identical status lines, headers and bodies in every mode:

• plan review (hook stdin);
• annotate: file, folder, URL, --static, last message;
• archive and setup-goal;
• code review, plus its diagram engine files;
• Inbox;
• guide export;
• the paste service.

Each mode was checked local and remote, with no Accept-Encoding, gzip, br, and gzip, deflate, br. Every decoded body equals the built file. Compared with 0.28.31, the header names and values are the same, except x-plannotator-server: 1, which main added after 0.28.31. Compression and caching are unchanged: the gzip prewarm, br on demand, local sessions never compressing, the diagram engine's immutable Cache-Control, and the Inbox's no-store. Pi and OpenCode serve their own copies of the built HTML and do not go through this code.

Self-update safety. Bun reads embedded files from what it loaded at startup, never from the binary's path. A first read after the binary was replaced returns the running binary's own bytes:

• macOS: when it was renamed over, deleted, or even overwritten in place;
• Linux: when renamed over or deleted (the kernel refuses an in-place write).

CI's smoke-binaries now checks this on macOS, Linux and Windows with scripts/smoke-pages.mjs. It runs annotate from an installed copy, replaces that copy the way the OS's installer does (install.sh: rename over; install.ps1/install.cmd: move the running exe to .old), and then fetches the page for the first time. A probe compiled on the runner shows the same for a first read of an embedded file. The script also compares every served page with the build job's digests, so a page that changes in the binary fails the release.

Verification (local, macOS arm64)

I downloaded Bun 1.4.4 into a temp dir from the GitHub release (bun-darwin-aarch64.zip). The system bun was not changed. SHASUMS256.txt.asc has a good signature from Robobun F3DCC08A8572C0749B3E18888EAB4D40A7B22B59, and the zip's SHA-256 (c240d7f0…bc510) matches the signed list. All tests ran with a temp HOME and PLANNOTATOR_DATA_DIR, NO_BROWSER, PLANNOTATOR_UPDATE_CHECK=0 and PLANNOTATOR_INBOX_CONNECT=0.

• bun install --frozen-lockfile, check:release-version, typecheck and VS Code lint pass.
• bun test at 054c826: 10518 pass, 2808 skip, 0 fail.
• Earlier bun test runs:
  • Before the fixes: 6 failures, all of which pass on Bun 1.3.14 (the 3 Pi listener counts, the Pi session-closed test, the 2 OpenCode real-client tests).
  • At the head: 10433 pass, 2768 skip, 1 fail. The failure is pi WSL configured browser launch timing out (2 s waitForFile) while other test runs were loading the machine. It passes 15/15 in isolation on both 1.3.14 and 1.4.4.
  • Under a preload that runs Bun.gc(true) every 25 ms, all 246 packages/server and Pi test files pass on 1.4.4 (see change 13).
• CI's DOM test steps, the whole test.yml list after merging main, on 1.4.4: file-browser 6 pass; diff-renderer 40 pass; --isolate set 2903 pass, 0 fail, 0 errors; allowlist guard passes. Before the fixes, the --isolate set had 14 failures from this branch, plus main's Board and tour tests.
• Build in order (review, hook, opencode, pi) passes. Playwright e2e on a dev binary: inbox, review-diagrams, annotate-html-links, annotate-bundle-back-scroll, image-region-comments and toolstrip-stacking, 30 passed (CI's Inbox window job runs the whole list). guides-show build:viewer gives the same manifest locally and in CI.
• Signed macOS builds (QA item 9).
  • I built plannotator-darwin-arm64 and plannotator-paste-darwin-arm64 two ways: cross-compiled from Linux in the pinned oven/bun:1.4.4-slim image, as release.yml does, and natively.
  • codesign --verify --strict --verbose reports "valid on disk" and "satisfies its Designated Requirement", with an ad-hoc, linker-signed signature (flags 0x20002).
  • Each binary ran from a cwd with a hostile bunfig.toml:
    • --version prints plannotator 0.0.0-dev, and --help works.
    • Headless plannotator review on a scratch git repo serves /api/diff with the change.
    • annotate serves /api/plan, and the paste service starts.
  • release.yml has no codesign or notarization step for these binaries. They ship with Bun's ad-hoc linker signature, and its smoke-binaries macOS leg runs them.
• The root is gone. tls.rootCertificates in a compiled probe:
  • Bun 1.3.14: 145 roots, including emSign ECC Root CA - G3 (fingerprint 86:A1:EC:BA…:6B:BE:6B), emSign Root CA - C1 and emSign ECC Root CA - C3.
  • Bun 1.4.4: 118 roots and none of those three. ISRG Root X1 is present in both.
  • A byte scan of the compiled CLI and paste binaries confirms this. On 1.3.14 the cert is 1 of the 146 embedded PEM roots (an exact DER match after decoding). On 1.4.4 it does not match as DER, SPKI, raw EC key or PEM. The control, ISRG Root X1, is found as DER in the same 1.4.4 binaries, so the scan works. The release gate above now runs this check on every release binary.
  • Bun 1.4.4 still trusts emSign Root CA - G1 (RSA), which is still in NSS 3.131.1.

CI

At the head, every check has passed, including:

• the 3 smoke-binaries jobs (macOS arm64, Linux x64 with the AVX2 control, Windows x64);
• install-script-smoke;
• build, with the trust gate: OK for all 12 binaries;
• test and the DOM steps;
• the guides.show manifest check.

Inbox window e2e also passed.

Binary size: fixed in this PR (see "Binary size" below).