Skip to content

Update oven/bun Docker tag to v1.4.0 - #2927

Merged
claytono merged 1 commit into
mainfrom
renovate/oven-bun-1.x
Sep 8, 2026
Merged

Update oven/bun Docker tag to v1.4.0#2927
claytono merged 1 commit into
mainfrom
renovate/oven-bun-1.x

Conversation

@renovate

@renovate renovate Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change Pending
oven/bun minor 1.3.14-alpine → 1.4.0-alpine 1.4.2-alpine (+1)

Release Notes

oven-sh/bun (oven/bun)

v1.4.0: Bun v1.4

To install Bun v1.4

curl -fsSL https://bun.com/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.com/install.ps1|iex"

To upgrade to Bun v1.4.0:

bun upgrade

Read the blog post: image (1)

Thank you

Bun is free, open source, and MIT-licensed. We receive a lot of contributions from the community, and we'd like to thank everyone who fixed a bug or contributed since Bun v1.3.

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 through 7 and 15 through 21 of the month, and on Monday (* 0-3 1-7,15-21 * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the renovate label Sep 7, 2026
@renovate
renovate Bot requested a review from claytono as a code owner September 7, 2026 05:21
@renovate renovate Bot added the renovate label Sep 7, 2026
@github-actions

github-actions Bot commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

oven/bun (docker) 1.3.14-alpine -> 1.4.0-alpine

Risk: 🔴 Risk

The Deep Dive

Update Scope

The one-line image replacement changes Felix's restartable API sidecar from Bun 1.3.14-alpine (5acc90a…) to 1.4.0-alpine (0723557…), including the digest. Kustomize has no image override, so this changes the runtime. Hermes v2026.8.19, nginx-unprivileged 1.30-alpine, PostgreSQL 18.6, the entrypoint and proxy configuration remain unchanged (deployment; database). Both pinned images retain Linux amd64/arm64 support; their base advances Alpine 3.22.4→3.22.5. The inspected amd64 APK inventory changes OpenSSL 3.5.6→3.5.7, apk-tools/libapk2 2.14.9-r3→2.14.10-r0 and CA bundle 20260413→20260611; musl 1.2.5-r12 and libgcc/libstdc++ 14.2.0-r6 remain unchanged (image source, exact OCI evidence recorded). Bun's bundled JavaScriptCore/BoringSSL also change; bundled SQLite 3.53.0 was already in 1.3.14. The announcement is cumulative since 1.3.0; this evaluation distinguishes its version annotations from the actual delta (Bun 1.4).

Performance & Stability

  • Runtime and memory overhaul. 1.4.0 is the first stable Rust rewrite, with allocator/GC changes and native Web Streams. Benefits activate automatically when the API starts; upstream reports lower idle CPU/memory and faster startup, but most headline comparisons use a generic 1.3 baseline, not Felix on 1.3.14. The long-running watch-mode API could benefit; no local workload measurements are available. Later ownership-leak fixes are evaluated under Newer Versions and prevent treating the advertised savings as assured. Bun 1.4

  • Faster request and transformation primitives. URL parsing, RegExp, Buffer hex/base64url conversion, promises and source-map decoding improve without application changes. These can benefit a JavaScript API, but its actual hot paths are on the inaccessible workspace. Large code-split builds also improve; the committed entrypoint does not invoke a build. Performance numbers in the announcement are workload-specific microbenchmarks. Bun 1.4

  • Backpressure, reuse and process behavior. Native streams, fetch response backpressure and TLS session resumption can reduce buffering and connection work automatically. Linux subprocesses now inherit the system transparent-huge-page policy rather than Bun globally disabling it; lifecycle scripts executed by bun install are within that scope, although their contents are unknown. Bun 1.4 upstream change

Features & UX

The configured commands are bun install and bun run --watch server.js. Optional APIs below require application code or explicit commands; their use cannot be established from repository searches because the application lives on a PVC.

  • Browser automation and rendering improvements. WebView was introduced in 1.3.12; 1.4 adds a Windows installed-Chrome backend and fixes cleanup/pending promises when Chrome dies. CDP, EventTarget and screenshot facilities are not assumed new to this PR. On Linux it needs an installed Chrome/Chromium/Edge; the inspected base image contains no browser package. Markdown was already available in 1.3.8 and receives linear-time parser hardening and reference-link lifetime/bounds fixes; adopting HTML output still requires handling untrusted markup safely because it is not sanitized. Bun.Image, JSONL and the initial JSON5 APIs are already in the baseline, not newly enabled by this PR. Bun 1.4

  • Serving and protocols. New directory routes can serve files without writing per-file handlers; compression of fetch request bodies is opt-in. Experimental HTTP/3 serving and HTTP/2/3 fetch already existed in 1.3.14 and receive reset/dead-peer/TLS robustness improvements; upstream still advises against production HTTP/3 serving. Felix still serves static files through nginx and exposes the API through HTTP/1.1, so these options do not replace the proxy or enable QUIC automatically. Static preconditions, sourcemaps and HTTP compatibility changes are covered under Hazards. Bun 1.4

  • Dependency review and maintenance commands. bun pm diff helps review package content, install-script and sensitive-import changes; bun pm licenses inventories licensing; bun audit fix, dedupe and prune offer repair/cleanup workflows. They require explicit invocation and can change package metadata; the startup script invokes none. audit fix may rewrite exact pins. Workspace filtering, catalogs and nested/version-scoped overrides expand dependency management; their format consequences are covered under Hazards. Bun 1.4

  • Install layout and migration capabilities. The isolated linker's shared global store existed in 1.3.14 and gains stale-link/peer-drift and store-name fixes in 1.4; it is not a new forced switch for existing hoisted projects. New install.hoist=false can enforce undeclared-dependency isolation. npm lockfile v1–4 and pnpm v9 migration coverage improves. Felix's /tmp install cache is ephemeral, while node_modules is on the persistent workspace; actual linker choice is unknown until its bunfig/lockfile is available. Bun 1.4 upstream change

  • Development and test workflows. Timing-based test balancing is new (--timings, --update-timings); existing parallel/isolate/shard/changed modes gain cleanup, fake-timer, preload, debugger and native-addon fixes. Playwright, Vitest coverage/workers, OpenTelemetry instrumentation and Datadog profiling compatibility improves. None is activated by the API entrypoint; the repository CI contains no explicit Felix/Bun test invocation. Bun 1.4 Bun 1.4

  • Bundling and compilation. Built-in React Compiler, embedded --asset files, import defer, improved barrel-import optimization, decorators, ESM bytecode and bundle profiling expand build options. Browser-field remaps for Node builtins and emitted metafile paths also change. Using these requires a build workflow absent from the committed entrypoint; workspace package scripts remain unobserved. Bun 1.4

  • Diagnostics and process control. Memory-pressure notifications, richer inspector/CPU/heap/bundle profiles, node:trace_events, native REPL, v8.GCProfiler, NODE_COMPILE_CACHE and Linux Bun.spawn({cgroup}) expand observability/control. They need listeners, flags or code; the container has no configured cgroup delegation. Existing parallel-script execution gains output/completion-race fixes, and no-orphans handling improves; these do not replace the shell supervisor automatically. Terminal writes now acknowledge the buffered input and POSIX drain events, so callers should not resend buffered bytes. Bun 1.4 Bun 1.4 upstream change

  • Parsers, streams and cryptography. New XML parse/stringify and TOML stringify APIs can replace parser dependencies; textStream() decodes streamed Request/Response bodies, and ML-DSA/ML-KEM are available through WebCrypto and node:crypto. YAML/JSON5/JSONC, ANSI utilities and compression streams receive improvements. These APIs require code adoption; parser/import behavior changes and FFI string compatibility are covered under Hazards. Bun 1.4

  • Database and object-storage APIs. Named parameters for SQLite sql.unsafe/sql.file are new. S3 fixes cancellation leaks and spurious close-response failures; list output now exposes checksumAlgorithm, while the old misspelling remains accessible but is no longer enumerable. Those corrections activate on existing S3 calls. Requester Pays and other earlier S3 additions in the cumulative announcement should not be assumed new to this version. Only PostgreSQL is evidenced in the deployment; the actual driver and any S3/SQLite clients are unknown. Bun 1.4 Bun 1.4

  • Additional platforms and Node APIs. Experimental Android support, improvements to FreeBSD/Windows ARM64, Windows timers/AppContainer, Node-API 10, worker SHARE_ENV/resource controls, node:quic, node:sqlite, node:test and stream/iter broaden compatibility. Non-Linux platform additions do not change the pinned Linux image; new API/flag use remains opt-in, and the automatic Node ABI change is covered under Hazards. Bun 1.4 Bun 1.4

Security

  • TLS verification and trust changes. Bun now runs fetch checkServerIdentity before sending bytes and on redirect hops; native connect/listen/upgradeTLS enforce certificate rejection defaults. node:tls options are interpreted literally, requestCert defaults fail closed, per-SNI/QUIC certificate policies are enforced, wildcard matching tightens and certificate serial/modulus output becomes uppercase. Bundled BoringSSL updates and NSS3.124 removes expired/distrusted roots. These harden actual network boundaries, but application/private-CA/mTLS/pinning use is unavailable in CI; valid CA configuration may be required rather than disabling verification. Direct Bun/SQL outbound traffic is not proven to share ingress authentication. Bun 1.4 Bun 1.4

  • Package-manager and input hardening. Exact-name lifecycle trust, registry-host/token scoping/redaction, tarball integrity/path/bin-link checks and owner-only artifacts reduce supply-chain risk automatically. The baseline already restricted default auto-trust to npm packages; 1.4 further hardens matching and extraction. Startup runs the installer, so unusual aliases, registries, off-registry tarballs or scripts may need adjustment; their configuration is unavailable. HTTP framing/padding/CRLF checks and crypto validation also tighten. Argon2 now requires memoryCost≥8 for new hashes; older hashes still verify. Bun.CSRF gains optional session binding, which requires explicit adoption. Bun 1.4 upstream change upstream change

  • Bun advisory search limits. The repository advisory API returned no published entries; SECURITY.md supports 1.x. CVE-2024-21548, CVSS 3.1 7.5 was fixed in 1.1.30, so neither image is affected. CVE-2025-8022, withdrawn advisory (published CVSS 3.1 8.8) is not treated as a Bun vulnerability. Upstream says additional 1.4 hardening advisories will follow; unassigned issues have no verified CVE/CVSS. No introduced Bun CVE was established, which is not a claim of complete vulnerability absence.

  • Bundled OpenSSL fixes; application reachability unknown. The inspected amd64 image moves libssl3/libcrypto3 from 3.5.6 to 3.5.7. OpenSSL's advisory fixes the following CVEs, all affecting 3.5.0..<3.5.7. These are risk reductions. Bun itself uses BoringSSL; exposure to Alpine OpenSSL would require native addons, FFI or subprocess libraries, which cannot be inspected on the PVC. Scores are CISA ADP CVSS3.1 in the linked official CVE records, not OpenSSL's qualitative ratings.

Resolved CVE / score Affected path
CVE-2026-45447, CVSS 3.1 8.8 PKCS7_verify use-after-free / possible code execution
CVE-2026-34182, CVSS 3.1 9.1 CMS forged-message acceptance
CVE-2026-34181, CVSS 3.1 7.4 PKCS12 short-HMAC-key acceptance
CVE-2026-45445, CVSS 3.1 7.5 AES-OCB IV/nonce handling
CVE-2026-45446, CVSS 3.1 4.8 empty-message SIV authentication
CVE-2026-42768, CVSS 3.1 3.7 CMS/PKCS7 decryption oracle
CVE-2026-42769, CVSS 3.1 5.3 CMP trust-anchor substitution
CVE-2026-42770, CVSS 3.1 3.7 DH peer validation
CVE-2026-34183, CVSS 3.1 7.5 QUIC memory exhaustion
CVE-2026-42764, CVSS 3.1 7.5 QUIC server NULL dereference
CVE-2026-34180, CVSS 3.1 7.5 ASN1 over-read
CVE-2026-42766, CVSS 3.1 5.9 CMS NULL dereference
CVE-2026-42767, CVSS 3.1 5.9 CRMF NULL dereference
CVE-2026-7383, CVSS 3.1 8.1 ASN1 heap overflow
CVE-2026-9076, CVSS 3.1 7.5 CMS out-of-bounds read

Key Fixes

  • PostgreSQL connection and result handling. 1.4 improves startup-handshake retries and fixes SQL queue/array/error handling, including wrong-result risks in concurrent query paths. These apply automatically if Felix uses native Bun.SQL; DATABASE_URL alone does not identify its driver. No PgBouncer is declared in the read database manifest, so transaction-pool-specific benefits are not established. The newly introduced leak belongs in Newer Versions. Bun 1.4 Bun 1.4

  • Install and workspace reliability. Registry connections gain Happy Eyeballs, hardlink permission failures can fall back to copies, and git/tarball/cold-cache and registry-credential handling improve. Startup executes bun install on a writable NFS workspace, making installer reliability relevant; the package graph and registry settings cannot be inspected in CI. These are benefits, not proof that the later installer regressions are absent. Bun 1.4 upstream change

  • Streams, workers and locked-down environments. The release fixes HTTP/body handling, worker shutdown and filesystem errors, including environment visibility when cwd lacks read permission. The API's non-root/read-only-root configuration makes compatibility fixes useful, although that particular cwd failure is not demonstrated. Routine micro-fixes are grouped rather than treated as separate deployment reasons. Bun 1.4 upstream change

Newer Versions

  • 1.4.1 fixes regressions introduced by this proposal. 1.4.1, released September 4, fixes the PostgreSQL JSON/JSONB native-memory regression: upstream reproduced flat RSS on 1.3.14 versus unbounded growth on 1.4.0. The merged string-ownership fix also covers module loading, HMR and other native APIs. It is in 1.4.1. Felix is a long-running PostgreSQL-backed JavaScript process, but its SQL API/column use is unknown; this is a relevant unresolved regression, not a confirmed local leak.

  • Network and startup regressions have later fixes. 1.4.1 release notes explicitly fix 1.4.0 regressions in ws.handleUpgrade() after await, short fetch timeouts, streamed-response tails on connection reset, custom TLS callback pooling and socket lifetime handling. They also improve recovery from truncated registry/tarball downloads and fix watch-related crashes; their introduction version is unproven, so those latter fixes do not drive this PR label. Felix performs installs and serves HTTP behind nginx; specific fetch, ws and package usage is hidden in the PVC. Do not deploy 1.4.0 on the assumption all these paths are unused.

  • Filesystem and prototype-equality regressions. Bun 1.4.0 makes fs.rmdir(path, { recursive: true }) throw instead of removing the directory and makes assert.deepStrictEqual() throw for objects with different prototypes. Bun 1.4.1 release notes identify both as 1.4.0 regressions and fix them, specifically noting packages such as @prisma/client for the filesystem case. These behaviors activate when affected calls run; Felix’s PVC-hosted application and dependency scripts are unavailable in CI, so neither Prisma nor affected equality checks are confirmed or excluded.

  • 1.4.2 is the current follow-on, not an automatic approval. 1.4.2, released September 5, fixes Elysia bundling and AsyncLocalStorage regressions introduced in 1.4.1, so those two do not count against this 1.4.0 PR. It also fixes a bun install/add panic involving mismatched lockb or cached-manifest package-name hashes; the introduction version is unknown and does not drive this label. Its Alpine/musl GC crash fix is especially useful on this image, but upstream links it to old 1.2.x reports: it is pre-existing risk, not a demonstrated regression introduced here. Refresh to 1.4.2 or a later reviewed release before reconsideration; the open HTTP concern below still needs application-specific resolution.

Hazards & Risks

Compatibility cannot be established from the PVC-backed startup path: server.js, dependencies, locks, bunfig and runtime environment files are outside the checkout. The following are actual 1.4 changes, with their activation and deployment limits.

  • Node 26 and native-addon boundary. The runtime reports Node 26.3.0 and module ABI 147; addons chosen by ABI need a matching build. res.writeHeader() is removed, and paused readable.read() without a size returns one chunk (except the setEncoding path). These changes activate on upgrade and can affect transitive HTTP/database packages. Felix's dependency/source absence prevents ruling them out; no incompatible addon or call is confirmed. upstream change

  • Persistent lockfile conversion and rollback. Fresh Bun lockfiles use v2, which an exact 1.3.14 probe rejects. An isolated 1.4.0 probe preserved an existing v1 lock, even after a dependency change; ordinary install must not be described as forcing v1→v2. Nested/version-scoped overrides select v3, which older Bun and some ecosystem tools cannot read. Optional-peer/catalog/override/patch-hash changes can also rewrite the lock. Felix installs automatically into the writable workspace, so this is a real persistent-format boundary, not a proposed manual maintenance command. Current lock existence/format and external-tool compatibility are unavailable in CI. Recovery is a prerequisite if startup creates/recreates a v2/v3 file; an unchanged compatible v1 lock does not establish such a migration. See Further Follow-up. Bun 1.4 upstream change

  • Startup configuration and dotenv. TOML/bunfig becomes strict and rejects formerly accepted values with SyntaxError; project bunfig wins over .npmrc for duplicate settings. Bun invoked through a node shim stops implicitly loading .env files. The top-level command calls Bun directly, so that dotenv change does not automatically remove its env; however the image supplies a node→Bun fallback and package lifecycle/child scripts may use it. No bunfig or package scripts can be inspected here. upstream change upstream change upstream change

  • Nested local-package install regression. Issue 40314 reports nested local file: dependencies resolving on 1.3.14 and failing on 1.4.0. It remains open with no verified fixed-release bound. Felix installs on each restart, so an affected graph could prevent startup; the absent package/lock metadata prevents exclusion. No NFS-specific watcher regression was verified.

  • Open HTTP compression/pipelining regression. Issue 40350 reports a server-terminating write-after-end regression from 1.3.14 to 1.4.0 when node:http pipelining re-enters compression middleware. Fix PR 40351 remains open; reproduction evidence varies across builds, and no 1.4.2 reproduction was checked, and the fix PR remained open after its release. nginx's configured HTTP/1.1 proxy does not establish that Felix uses the vulnerable node:http/middleware path, nor exclude it. This remains a material unknown.

  • HTTP and Fetch observable behavior. Duplicate custom headers are comma-joined, empty response headers are retained, consumed/locked bodies cannot be cloned, and failed reads set bodyUsed. Network errors become TypeError; option-getter failures reject asynchronously; aborted buffered responses error. Redirect/status handling, Latin-1 headers, transfer-coding token lists, keep-alive rules and the whole-header deadline change. Bun.serve validates port/status/framing more strictly, supports GET fallback for HEAD and file preconditions, and stops exposing production HTML sourcemaps unless enabled. These changes apply to affected handlers automatically; PORT=3001 is valid and nginx serves static content, but server.js and custom clients remain unknown. Bun 1.4

  • WebSocket and server lifecycle. Bun enforces upgrade headers/key/version, masking, requested subprotocol negotiation and close/ping/pong argument limits. Close events become asynchronous; publish returns 0/-1 for no delivery/backpressure; closed subscribe/unsubscribe returns false; Blob sends carry binary data and file blobs must be read first. server.stop closes idle connections and waits for active work. nginx forwards Upgrade headers, but actual WebSocket use and graceful-stop handlers are unknown. These are automatic API semantics, not a newly enabled service. Bun 1.4

  • Networking, DNS and TLS. Linux dns.lookup/net.connect uses system getaddrinfo; dns.setServers no longer controls those lookups. Accepted net/tls sockets wait for readers, Bun.Socket keepalive delay uses milliseconds, and TLS handshake timeout/event behavior changes. PostgreSQL hostname resolution and any outbound clients may traverse these paths. Authentication/trust tightening is owned by Security below; configured ingress TLS does not establish outbound TLS settings inside the application. upstream change upstream change upstream change

  • Database values and connection policy. Native SQL now bounds the complete handshake, rejects unexpected repeated PostgreSQL auth messages, honors PGSSLMODE (URL wins) and returns numeric ±Infinity for PostgreSQL infinite dates. MySQL timestamps become UTC; MariaDB JSON becomes parsed data. SQLite close/finalize behavior and empty-column aliases change. PostgreSQL is configured, while all driver choices, query shapes, environment overrides and other databases in code remain unknown. These effects activate only on the corresponding SQL API path. Bun 1.4

  • Module loading, parsers and transpilation. XML imports return parsed objects rather than paths; runtime CSS imports export an empty object; dot/dot-dot imports resolve directory entries. JSONC empty/invalid input throws SyntaxError; YAML rejects NUL. react-jsx uses production helpers unless explicitly overridden, and useDefineForClassFields=false is honored. Lazy builtin exports, wildcard package resolution and imported-binding error timing change. server.js may import transformed modules even without a build step; the import graph and tsconfig are unavailable. Bun 1.4

  • FFI and native memory ownership. The faster engine-native FFI changes cstring/CString to plain strings (NULL→null), removing pointer/buffer properties; callers must retain pointers they own. N-API value/env arguments outside cc(), invalid FFI callbacks, or FFI with JIT disabled now throw. This matters only if the app or dependencies use FFI; it cannot be inferred absent from the deployment YAML. upstream change

  • Time, locale and equality. Temporal is enabled by default with value-based equality (BUN_JSC_useTemporal=0 opts out); bundled ICU 78.3 changes locale data/Intl/IDNA results. In-process cron and cron.parse use local time, with explicit tz=UTC retaining UTC schedules. Boxed-value comparisons also change. See Newer Versions for prototype-equality compatibility. No schedule or TZ is configured in the read API manifest; that does not prove no in-code schedule, dotenv timezone or format-sensitive client exists. Bun 1.4

  • Filesystem, shell, subprocess and error semantics. See Newer Versions for recursive fs.rmdir compatibility. fs.appendFile with flag=w truncates; mmap offsets are exact. File option/range validation tightens, recursive fs.watch emits previously silent subdirectory errors, and callback exceptions route to uncaughtException. Bun shell only expands literal template globs and rejects ambiguous redirects. Spawn pre-abort/timeout/signal/invalid-input behavior, worker environment timing, child output encoding, exec/exit events, process.title and warning/inspection formatting change. These may affect workspace code/lifecycle scripts; the shell supervisor itself is unchanged and does not use Bun.$. Bun 1.4

  • Maintenance and tests are opt-in boundaries. bun update now updates transitives, errors for unused names and applies new production/filter/catalog semantics; add/install filters target selected workspaces, new init templates use TypeScript 7, non-TTY init auto-accepts while interactive update errors, and bun feedback is removed. Mock reset drops implementations, toContain uses ===, and skipped node:test suites do not execute their bodies. Those commands are absent from the startup script, so these are adoption information rather than demonstrated runtime incompatibility. New-monorepo isolation and YAML1.2 booleans predate 1.3.14 and are not hazards introduced here. Bun 1.4

Further Follow-up

  • Resolve the actual API and dependency boundary before reconsideration. CI read the deployment, entrypoint, nginx, database, Kustomize and all repository app references; it cannot access /opt/workspace/www/games/api. In an authorized local evaluation, obtain a read-only inventory with kubectl -n felix exec deployment/felix -c api -- sh -c 'cd /opt/workspace/www/games/api && ls -la && cat package.json', then read the referenced lockfile, bunfig, tsconfig and source/import graph without disclosing credentials. Specifically establish native ABI147 availability, removed writeHeader/paused-read use, Bun.SQL JSON/JSONB binds, fetch/ws paths, compression/pipelining, TLS/PGSSLMODE and registry/lifecycle settings. Exercise the identified HTTP/database/WebSocket paths on an isolated workspace/database copy under the old and candidate digest, including repeated JSON binds/RSS and middleware request pipelining where present. Known affected calls/addons without remediation → breaking; missing evidence or unresolved regression → risk; compatible code with only bounded behavior changes needing focused validation → caution; proven unaffected or remediated and validated → safe. This follow-up is blocked by CI's explicit private-access prohibition, not a deferred repository search. upstream change SQL regression HTTP regression

  • Establish lockfile recovery before automatic install rewrites persistent metadata. The startup installer writes to the shared workspace. Fresh v2/v3 metadata creates a rollback boundary, while our probe preserved existing v1; the actual workspace format is unknown. If a candidate install creates/recreates incompatible metadata, a recoverable pre-upgrade copy and restore test are a prerequisite and are not evidenced here. In local mode, preserve the exact package manifests, lockfiles, bunfig and relevant workspace dependency state; run candidate bun install only in a disposable copy, record the format/dependency diff, restore the preserved copy, and establish that the 1.3.14 image can install and start from the restored metadata without silently re-resolving dependencies. If the real v1 lock remains compatible with no consequential conversion, this recovery concern is cleared. Otherwise recovery unavailable or rollback format unknown → risk; incompatible rewritten metadata without a restorable copy → breaking; verified restoration plus resolved app concerns permits caution/safe under the criteria above. This prerequisite concerns dependency metadata, not an asserted PostgreSQL schema migration. Bun 1.4 upstream change

Sources

🔴 Verdict: Risk

Defer this exact 1.4.0 image: later fixes address introduced runtime/network leaks and regressions, while Felix's PVC-hosted application prevents resolving the Node/API and persistent-lockfile compatibility boundaries in CI. Prefer a refreshed 1.4.2-or-later proposal, then resolve the targeted application and rollback questions below; passing infrastructure CI alone does not establish them.

@renovate
renovate Bot force-pushed the renovate/oven-bun-1.x branch 20 times, most recently from 43cbb51 to ae98976 Compare September 8, 2026 02:27
@renovate
renovate Bot force-pushed the renovate/oven-bun-1.x branch from ae98976 to c0ffa01 Compare September 8, 2026 02:41
@claytono
claytono merged commit a4966d6 into main Sep 8, 2026
20 checks passed
@claytono
claytono deleted the renovate/oven-bun-1.x branch September 8, 2026 14:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@claytono claytono Awaiting requested review from claytono claytono is a code owner

Assignees

No one assigned

Labels

renovate:evaluated renovate:risk renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@claytono