[Aymericr]

What does this PR do?

Bumps every pinned Bun version to 1.4.4, which ships security fixes for TLS, HTTP/1–3, WebSocket and Brotli (release notes). It also lines up pins that had drifted apart:

File	Before	After
package.json packageManager (read by ci.yml and mcp-ci.yml via bun-version-file)	bun@1.4.2	bun@1.4.4
.github/workflows/release.yml (2 jobs)	1.3.14	1.4.4
Dockerfile	oven/bun:1.3.14-alpine	oven/bun:1.4.4-alpine
.devcontainer/devcontainer.json	oven/bun:1.3.0	oven/bun:1.4.4

The @types/bun ranges (^1.4.3) are unchanged because npm has no 1.4.4 release of that package. No engines field pins Bun, and the repo has no .bun-version or .tool-versions file. bun install on 1.4.4 left bun.lock unchanged. No app code was changed.

How to test

1. Install Bun 1.4.4 and run bun install --frozen-lockfile. It should succeed with no lockfile diff.
2. Run bun run ci. All 9 turbo tasks should pass (I ran this locally on 1.4.4).

Screenshots / screen recording

N/A — non-visual change

Checklist

• I've tested this locally with bun dev
• My code follows the existing code style (run bun check to verify)
• I've updated relevant documentation (if applicable)
• This PR targets the main branch

  

---

Note

Low Risk
Infrastructure-only version alignment with no runtime code changes; main risk is CI/Docker/devcontainer behavior on the new Bun release.

^{Reviewed by Cursor Bugbot for commit ebbe0ac. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-22T10:30:48.829705Z	ebbe0ac	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.