[Deps] Bun 1.4.4 (security)

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
   "name": "Pascal Editor",
-  "image": "oven/bun:1.3.0",
+  "image": "oven/bun:1.4.4",
   "features": {
     "ghcr.io/devcontainers/features/git:1": {},
     "ghcr.io/devcontainers/features/github-cli:1": {}

.github/workflows/release.yml

@@ -27,7 +27,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.4
 
       - uses: actions/setup-node@v4
         with:
@@ -73,7 +73,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.4
 
       # No registry-url here: with it, actions/setup-node writes an .npmrc whose
       # auth token falls back to the placeholder XXXXX-XXXXX-XXXXX-XXXXX, npm

Dockerfile

@@ -2,7 +2,7 @@
 
 # Matches `packageManager` in package.json and the version CI installs — a skew
 # here is what makes `--frozen-lockfile` fail inside the image but not locally.
-FROM oven/bun:1.3.14-alpine AS build
+FROM oven/bun:1.4.4-alpine AS build
 WORKDIR /app
 
 # `next build` runs under `node`, and this image's `node` is a shim that re-execs

package.json

@@ -38,7 +38,7 @@
   "engines": {
     "node": ">=22.18"
   },
-  "packageManager": "bun@1.4.2",
+  "packageManager": "bun@1.4.4",
   "overrides": {
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",