deps: bump oven/bun from 1.3.14-slim to 1.4.0-slim

.env.example

@@ -1027,6 +1027,16 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Used by: open-sse/services/compression/engines/rtk/filterLoader.ts.  Default: 0.
 #OMNIROUTE_RTK_TRUST_PROJECT_FILTERS=0
 
+# Maximum concurrent synchronous compression workers. Excess jobs wait FIFO.
+# Used by: open-sse/services/compression/compressionWorkerPool.ts. Default: 2.
+#OMNI_COMPRESSION_WORKERS=2
+# Per-job worker timeout (ms). A timed-out worker is terminated and the request fails open.
+# Used by: open-sse/services/compression/compressionWorkerPool.ts. Default: 120000.
+#OMNI_COMPRESSION_WORKER_TIMEOUT_MS=120000
+# Terminate idle compression workers after this many milliseconds.
+# Used by: open-sse/services/compression/compressionWorkerPool.ts. Default: 60000.
+#OMNI_COMPRESSION_WORKER_IDLE_MS=60000
+
 # T02 stacked-pipeline engine circuit-breaker (OPT-IN, default off). When enabled, a compression
 # engine that throws repeatedly across requests is skipped (fail-open) for a cooldown.
 # Used by: open-sse/services/compression/pipelineEngineBreaker.ts.
@@ -2011,6 +2021,9 @@ APP_LOG_TO_FILE=true
 # CLIPROXYAPI_HOST=127.0.0.1
 # CLIPROXYAPI_PORT=5544
 # CLIPROXYAPI_CONFIG_DIR=~/.cli-proxy-api
+# Management key for an externally managed instance. Embedded instances use
+# OmniRoute's encrypted service key.
+# CLIPROXYAPI_MANAGEMENT_KEY=
 
 # ── Mux embedded service ──
 # Override the port where the embedded Mux (coder/mux) agent-orchestration
@@ -2420,10 +2433,10 @@ APP_LOG_TO_FILE=true
 # test suite must NEVER mutate the OS trust store (a fake test PEM installed via
 # update-ca-certificates broke all system TLS on a persistent runner, 2026-07-05).
 # OMNIROUTE_SKIP_SYSTEM_TRUST=1
-# check-changelog-integrity.mjs (anti CHANGELOG-eat gate): explicit base ref
-# override, and the justified-removal escape hatch for intentional bullet removals.
+# check-changelog-integrity.mjs (anti CHANGELOG-eat gate): explicit base ref override.
+# Intentional transformations require an exact reviewed entry in
+# config/release/changelog-reconciliations.json; there is no runtime bypass.
 # CHANGELOG_BASE_REF=origin/release/v0.0.0
-# ALLOW_CHANGELOG_REMOVALS=1
 
 # ── Remote audio provider nodes ──
 # Used by: src/app/api/v1/_shared/audioProviderNodes.ts — lets the /v1/audio/*

CHANGELOG.md

@@ -180,6 +180,7 @@ _Living section — regenerated 2026-08-12 from all cycle commits (cycle open `e
 
 ### 🐛 Bug Fixes
 
+- **fix(build):** every route no longer answers HTTP 500 on artifacts built from the release tip ([#11343](https://github.com/diegosouzapw/OmniRoute/issues/11343)) — `next.config.mjs` aliased `better-sqlite3` to its build-time stub **unconditionally**, on the premise that `serverExternalPackages` still won at runtime. It does not: a Turbopack `resolveAlias` rewrites the request *before* the externals check, so the request stopped matching the `better-sqlite3` external entry and the stub was baked into the shipped bundle. The sync driver then failed with `r(...) is not a constructor`, fell through `node:sqlite` and sql.js, and the instrumentation hook aborted at boot. Same failure shape as [#6344](https://github.com/diegosouzapw/OmniRoute/issues/6344), so it gets the same treatment: the alias is opt-in via `OMNIROUTE_BETTER_SQLITE3_STUB=1` through the shared `scripts/build/better-sqlite3-stub-flag.mjs` helper — set it only on a build host that actually hits the SIGABRT build-worker teardown ([#10060](https://github.com/diegosouzapw/OmniRoute/issues/10060)); default builds externalize the real native addon. Regression guards: `tests/unit/better-sqlite3-stub-alias-11343.test.mjs` (5) and the env matrix in `tests/unit/next-config.test.ts`.
 - **security(search)**: block SSRF via `/v1/search` `provider_options.baseUrl` for the Firecrawl search provider — the client-controlled override is now validated as a public URL before it is used to build the server-side fetch target, so a caller with a valid API key can no longer redirect search requests at loopback, RFC1918, or cloud-metadata hosts — thanks @zmf963
 - **providers**: honor `PATCH /api/providers/[id]` so `omniroute providers rotate` stops 405ing (the OpenAPI spec and CLI already use PATCH) (PR #10366)
 - **cli**: route provider test commands through configured connection test endpoints (#10570)

Dockerfile.bun

@@ -1,5 +1,5 @@
 # ── Multi-stage Dockerfile for Native Bun Runtime (web-latest-bun) ───────────
-FROM oven/bun:1.3.14-slim AS base
+FROM oven/bun:1.4.0-slim AS base
 WORKDIR /app
 
 RUN apt-get update \
@@ -50,7 +50,7 @@ ENV NODE_ENV=production
 RUN bun run --quiet build
 
 # ── Runner Base stage (100% Bun Native Production Runtime) ──────────────────
-FROM oven/bun:1.3.14-slim AS runner-base
+FROM oven/bun:1.4.0-slim AS runner-base
 
 LABEL org.opencontainers.image.title="omniroute" \
   org.opencontainers.image.description="Unified AI proxy — route any LLM through one endpoint (Bun Native)" \