chore(deps): upgrade bun to 1.4.1 - #720
Conversation
Bumps every pin that names a runtime version: the packageManager field in the root and the three apps that carry their own, bun-version across ten workflow steps, and the oven/bun base images in all eight Dockerfiles. @types/bun stays on 1.4.0 because 1.4.1 is not published; the types trail the runtime release. Two changes in 1.4.1 touch this repo and are worth watching on the first CI run. localhost now bypasses the system resolver, and the health check talks to services on localhost. TLS verification now reads the URL hostname rather than the Host header, and the links and basket producers reach redpanda over TLS.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: ASSERTIVE Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
The latest updates on your projects. Learn more about Unkey Deploy
|
Greptile SummaryThis PR consistently upgrades the repository’s Bun runtime from 1.4.0 to 1.4.1.
Confidence Score: 5/5The PR appears safe to merge; the runtime pins are consistent and no concrete regression was identified. The change is limited to synchronized Bun version pins, and the investigated resolver, TLS, container-image, and deployment-consistency paths did not establish an actionable failure. Important Files Changed
Reviews (1): Last reviewed commit: "chore(deps): upgrade bun to 1.4.1" | Re-trigger Greptile |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 19 files
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Architecture diagram
sequenceDiagram
participant GH as GitHub Actions Runner
participant SB as Setup Bun Action
participant BU as Bun 1.4.1
participant DC as Docker Compose
participant RP as Redpanda
participant LS as Links Service
participant BS as Basket Service
Note over GH,BS: CI/CD Runtime Upgrade Flow (1.4.0 → 1.4.1)
GH->>SB: checkout repo + fetch workflow
SB->>SB: Read bun-version: "1.4.1"
SB->>GH: Install Bun 1.4.1
GH->>BU: bun install --frozen-lockfile
BU->>BU: Resolve 2188 packages (lockfile unchanged)
BU-->>GH: Install complete (1902 installs)
GH->>BU: turbo run check-types --force
BU->>BU: Compile all 33 targets
BU-->>GH: 33/33 types pass
GH->>BU: turbo run test --force
BU->>BU: Execute test suites (no cache hit)
BU-->>GH: 27/27 tests pass
Note over GH,DC: Health Check Flow - Localhost DNS (Bun 1.4.1 behavior change)
GH->>DC: Start services on localhost
DC->>RP: Initialize on localhost:9092
GH->>BU: bun run health-check
BU->>BU: Resolve "localhost" - bypasses system resolver
BU->>RP: Connect to localhost:9092
alt DNS resolution succeeds
RP-->>BU: Connection established
else DNS resolution fails
RP-->>BU: Connection refused (LOCALHOST DNS CHANGE)
end
Note over BU,BS: TLS Verification - URL Hostname vs Host Header (Bun 1.4.1 behavior change)
LS->>BU: Produce message with TLS (ssl: true)
BU->>BU: CHANGED: Verify TLS against URL hostname
BU->>RP: Connect with TLS
alt Hostname matches URL
RP-->>BU: TLS handshake OK
else Hostname mismatch
RP-->>BU: TLS handshake fails (URL HOSTNAME TLS CHECK)
end
Note over BU,BS: Basket Service Memory Profile
BS->>BU: Start basket service (Bun 1.4.1)
BU->>BU: Reduced idle memory + memory leak fixes
BU-->>BS: Runtime ready
Note over GH,BU: Docker Image Builds (oven/bun:1.4.1-*)
GH->>BU: Pull oven/bun:1.4.1-slim
BU->>BU: Multi-stage build (pruner → builder → runtime)
GH->>BU: Pull oven/bun:1.4.1-distroless
BU-->>GH: Images ready for deployment
Note over GH,BS: TypeScript Types (@types/bun stays at 1.4.0 - npm 404)
GH->>BU: bun install (no @types/bun 1.4.1 exists)
BU-->>GH: Resolution falls back to 1.4.0
Shadow auto-approve: would require human review. Upgrades Bun from 1.4.0 to 1.4.1 across all packageManager pins, workflow steps, and Docker base images; the runtime behavior changes in this release make the production rollout a decision needing human sign-off.
Re-trigger cubic
|
Closing as a duplicate: |
1 participant
Bun 1.4.1 was released 2026-09-04T08:33Z, about an hour before this repo's 1.4.0 reached production.
What changed
Every pin that names a runtime version, 35 lines across 19 files:
packageManagerin the root plusapps/basket,apps/insights,apps/uptimebun-versionacross 10 workflow steps (cix4,dashboard-e2e,dependency-review,docker-publish,health-check,release,sdk-e2e)oven/bun:1.4.0-slimand-distrolessbase images in all 8 Dockerfiles@types/bundeliberately stays at 1.4.0 — 1.4.1 is not published to npm (404), the types trail the runtime.Both
oven/bun:1.4.1-slimandoven/bun:1.4.1-distrolesswere confirmed present on Docker Hub before pinning, since the release is only hours old.Two changes to watch on the first CI run
localhostDNS now bypasses the system resolver.health-check.ymlstands up services onlocalhost(Redpanda onlocalhost:9092, among others). If resolution behaviour differs in the runner, that is where it shows.apps/links/src/lib/producer.tsand the basket producer both reach Redpanda over TLS withssl: true. A hostname mismatch would surface as a connect failure.Neither is expected to break, but they are the two places this release intersects this codebase, so they are worth a look if anything goes red.
1.4.1 also lists reduced idle memory usage, a fix for memory leaks in test isolation and module loading, and faster Buffer operations. Those are relevant to the Basket memory profile but not something this PR tries to measure.
Verification
Local Bun upgraded to 1.4.1 first, then everything re-run against it:
bun install→ lockfile unchanged, 1902 installs across 2188 packagesturbo run check-types --force→ 33/33, 0 cachedturbo run test --force→ 27/27, 0 cachedbun run lint→ clean, 14/14 policy testsBoth turbo runs used
--forcedeliberately: the cache key does not include the Bun version, so a normal run would have replayed results computed under 1.4.0 and verified nothing.Summary by cubic
Upgrades the Bun runtime from 1.4.0 to 1.4.1 across all 35 version pins in
packageManagerfields, workflowbun-versionsteps, and Docker base images. Bun 1.4.1 fixes memory leaks and reduces idle memory usage, which matters for the Basket service's memory profile;@types/bunstays on 1.4.0 because 1.4.1 isn't published to npm.Watch on first CI run
localhostDNS resolution now bypasses the system resolver; the health check talks to services onlocalhost.Verification
bun installleft the lockfile unchanged.--forcesince the cache key excludes the Bun version.Written for commit 375a3b2. Summary will update on new commits.