fix: forward security pins and fixes from main to next (HACK-1758)

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "bun"
+    directories:
+      - "/"
+      - "/examples/next-app"
+    schedule:
+      interval: "weekly"

.github/workflows/bun-crash-experiment.yml

@@ -8,7 +8,7 @@ name: Bun crash experiment
 # go-ahead.
 #
 # A labeled pull request runs the matched pair on the pull request's head: the
-# 1.3.9 baseline and the 1.4.2 candidate pinned on next, with the same job,
+# 1.3.9 baseline and the 1.4.4 candidate pinned on next, with the same job,
 # budget and the default `focused` mode. A dispatch runs one Bun version at a
 # chosen source revision and mode.
 #
@@ -89,7 +89,7 @@ jobs:
             budget="$INPUT_BUDGET_MINUTES"
             mode="$INPUT_MODE"
           else
-            runs='[{"bun_version":"1.3.9","role":"baseline"},{"bun_version":"1.4.2","role":"candidate"}]'
+            runs='[{"bun_version":"1.3.9","role":"baseline"},{"bun_version":"1.4.4","role":"candidate"}]'
             revision="$PR_HEAD_SHA"
             budget=30
             mode=focused

.github/workflows/ci.yml

@@ -36,7 +36,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.4.2"
+          bun-version: "1.4.4"
       - uses: dtolnay/rust-toolchain@1.97.1
         with:
           components: rustfmt, clippy
@@ -111,7 +111,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.4.2"
+          bun-version: "1.4.4"
       - uses: actions/setup-java@v4
         with:
           distribution: temurin
@@ -212,7 +212,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: useblacksmith/checkout@v1
         with:
           fetch-depth: 0
       - name: Install Gitleaks
@@ -239,11 +239,11 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: useblacksmith/checkout@v1
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.4.2"
+          bun-version: "1.4.4"
       - name: Setup Blacksmith Builder
         uses: useblacksmith/setup-docker-builder@v1
       - name: Install dependencies
@@ -286,11 +286,11 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: useblacksmith/checkout@v1
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.4.2"
+          bun-version: "1.4.4"
       - name: Install tmux
         run: sudo apt-get update && sudo apt-get install --yes tmux
       - name: Install dependencies
@@ -301,7 +301,10 @@ jobs:
         run: |
           docker pull alpine:3.20
           docker pull alpine:3.22
-          docker pull node:24.11.0-bookworm-slim
+          docker pull node:24.22.1-bookworm-slim
+          docker pull oven/bun:1.4.4-slim
+          # The qualified native file and storage helper artifact stays on this image
+          # until its catalog pins are requalified (src/lib/native-compose-vm-file-protocol.ts).
           docker pull oven/bun:1.4.2-slim
           docker pull postgres:17.6-alpine
           docker pull lucaslorentz/caddy-docker-proxy:2.10.0-alpine
@@ -399,7 +402,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.4.2"
+          bun-version: "1.4.4"
       - name: Install dependencies
         run: bun install --frozen-lockfile
       # The one-off checks and builds run once, on shard 1.
@@ -462,11 +465,11 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: useblacksmith/checkout@v1
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.4.2"
+          bun-version: "1.4.4"
       - name: Require native regression tools
         run: |
           command -v python3

.github/workflows/prerelease.yml

@@ -47,7 +47,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.4.2"
+          bun-version: "1.4.4"
       - name: Validate immutable plan
         id: plan
         run: bun scripts/prerelease-plan.ts plan
@@ -74,7 +74,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.4.2"
+          bun-version: "1.4.4"
       - uses: dtolnay/rust-toolchain@1.97.1
         with:
           targets: aarch64-unknown-linux-musl
@@ -122,7 +122,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.4.2"
+          bun-version: "1.4.4"
       - uses: actions/download-artifact@v4
         with:
           name: v5-prerelease-${{ needs.plan.outputs.version }}

.github/workflows/release-node-runtime-image.yml

@@ -22,12 +22,12 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: useblacksmith/checkout@v1
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.4.2"
+          bun-version: "1.4.4"
 
       - name: Setup QEMU
         uses: docker/setup-qemu-action@v3

.github/workflows/release-prepare.yml

@@ -28,12 +28,12 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: "24.11.0"
+          node-version: "24.22.1"
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.4.2"
+          bun-version: "1.4.4"
 
       - name: Install dependencies
         run: bun install

.github/workflows/release.yml

@@ -57,13 +57,13 @@ jobs:
       tag: ${{ steps.version.outputs.tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: useblacksmith/checkout@v1
         with:
           fetch-depth: 0
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.4.2"
+          bun-version: "1.4.4"
       - name: Resolve version
         id: version
         env:
@@ -108,7 +108,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.4.2"
+          bun-version: "1.4.4"
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - uses: dtolnay/rust-toolchain@1.97.1
@@ -198,7 +198,7 @@ jobs:
             exit 1
           fi
       - name: Checkout hack
-        uses: actions/checkout@v4
+        uses: useblacksmith/checkout@v1
       - name: Checkout tap repo
         uses: actions/checkout@v4
         with:
@@ -209,7 +209,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.4.2"
+          bun-version: "1.4.4"
       - name: Render formula
         env:
           GH_TOKEN: ${{ github.token }}

.hack/docs/Dockerfile

@@ -1,5 +1,5 @@
-FROM oven/bun:1.4.2 AS bun
-FROM node:24.11.0-bookworm-slim
+FROM oven/bun:1.4.4 AS bun
+FROM node:24.22.1-bookworm-slim
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 COPY --from=bun /usr/local/bin/bun /usr/local/bin/bun

.hack/tasks.json

@@ -42,7 +42,7 @@
           },
           {
             "path": "mise.toml",
-            "sha256": "e43a4542f0c4a466219402a1f5b9ad993bf4a6b109cadfba9281149de9a2f205"
+            "sha256": "e5f44e5efc9072c0beaf92277227e9729b65a12366173dfdb01557ee078670b1"
           },
           {
             "path": "package.json",
@@ -105,7 +105,7 @@
           },
           {
             "path": "mise.toml",
-            "sha256": "e43a4542f0c4a466219402a1f5b9ad993bf4a6b109cadfba9281149de9a2f205"
+            "sha256": "e5f44e5efc9072c0beaf92277227e9729b65a12366173dfdb01557ee078670b1"
           },
           {
             "path": "package.json",
@@ -162,7 +162,7 @@
           },
           {
             "path": "mise.toml",
-            "sha256": "e43a4542f0c4a466219402a1f5b9ad993bf4a6b109cadfba9281149de9a2f205"
+            "sha256": "e5f44e5efc9072c0beaf92277227e9729b65a12366173dfdb01557ee078670b1"
           }
         ],
         "review": "HACK-1157"

.tool-versions

@@ -1,3 +1,3 @@
-bun  1.4.2
-nodejs 24.11.0
+bun  1.4.4
+nodejs 24.22.1
 zig  0.15.2