[motsc]

Summary

Bumps the release workflow's Bun pin to 1.4.4, the release carrying a patched Brotli decoder for CVE-2026-111497 / Node2Shell (Broccoli2Shell).

Bun bundles its own copy of the google/brotli C decoder affected by this CVE (an out-of-bounds write reachable when decompressing attacker-controlled Brotli data, rated 9.2 Critical). Bun 1.4.4 is the fixed release. The bun-version input in this workflow determines which Bun builds and ships release artifacts, so this pin decides whether released binaries embed the vulnerable decoder.

This closes the last unfixed Bun pin in the repo — the Dockerfiles and CI images were already remediated in #3456 (node 22.23.4 + bun 1.4.4 where applicable).

Changes

• .github/workflows/release.yml: bun-version: '1.3.11' → '1.4.4'

References

• GHSA-9v8h-qqgm-4m35 / CVE-2026-111497
• Upstream Brotli fix: google/brotli commit 0ed4268 (released as 1.2.1)

[vercel]

@motsc is attempting to deploy a commit to the HyperDX Team on Vercel.

A member of the Team first needs to authorize it.

[changeset-bot]

⚠️ No Changeset found

Latest commit: d0c8ea7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

PR Review

If you are a coding agent acting for the author, read this first.
Nothing below blocks merge automatically; a maintainer decides. What they will expect:

• 🔴 critical or 🟠 major in code this PR adds or changes: fix before asking for review.
• 🔵 minor in code this PR changes: your call. Fix if small, otherwise reply.
• Anything about surrounding code, or asking you to widen the change (hoist a helper,
  dedupe with another file, fix other call sites): never fix here, whatever the
  severity. Reply with one sentence; if it is critical, say so plainly so a human sees it.

One commit per review round. After two rounds, stop and ask a maintainer to review
scope rather than addressing more automated findings. Full rule: AGENTS.md.

1 finding(s): 🔴 0 critical · 🟠 0 major · 🔵 1 minor

None could be anchored to changed lines; they are listed below.

Findings outside the changed lines

1 minor

• 🔵 packages/cli/package.json:26 — engines.bun still pins exactly 1.3.11, so the CLI's declared Bun version no longer matches the 1.4.4 that release.yml now compiles with → Change engines.bun in packages/cli/package.json to "1.4.4" (or ">=1.4.4") in this PR. Right now the CLI package still advertises the vulnerable Bun as its supported version, and the release pin and the engines field are two sources of truth that have already drifted. Also, the PR says this is the last unfixed Bun pin, but this field is another one.

---

_{Severity is the reviewer's own estimate and is used for ordering, not filtering. No finding blocks merge automatically; a maintainer decides.}

[greptile-apps]

Confidence Score: 4/5

[Medium impact] The update affects binaries produced by the CLI release workflow.

The PR appears safe to merge, with a non-blocking Bun version mismatch to clean up.

Findings

1.  Bun versions no longer match ▶

Summary

Updates Bun from 1.3.11 to 1.4.4 for standalone CLI releases.

• CLI releases now build with Bun 1.4.4.

_{Reviews (1) · Last reviewed commit: "chore(release): bump release workflow Bu..." · Reviewed by Greptile}

[greptile-apps]

Bun versions no longer match

The release now builds with Bun 1.4.4, but packages/cli/package.json still declares an exact engines.bun requirement of 1.3.11. Contributors following that requirement use a different compiler from releases, making release-only problems harder to reproduce. Update the declared Bun version alongside this pin so local builds and releases use the same version.

[github-actions]

Deep Review

✅ No critical issues found.

This is a single-line security pin bump (bun-version: '1.3.11' → '1.4.4') in the release workflow's CLI build job. The change is well-scoped: setup-bun@v2 fails loudly at setup if the version is unresolvable (no silent-corruption path), exact pinning is correct for release reproducibility, and the changeset-bot "No Changeset found" notice is a false positive — AGENTS.md explicitly exempts CI-only changes from the changeset requirement.

🔵 P3 nitpicks (1)

• packages/cli/package.json:26 — engines.bun still declares 1.3.11 while the release workflow now builds the shipped hdx binaries with 1.4.4, so the declared supported toolchain no longer matches the one that produces release artifacts; this is advisory metadata only (Bun does not enforce engines during bun build), so there is no build break or security exposure from the drift.
  • Fix: Update engines.bun in packages/cli/package.json to 1.4.4 to match the release workflow pin, or centralize the Bun version in a single shared source referenced by both.
  • _{correctness, maintainability}

---

Reviewers (5): correctness, reliability, maintainability, project-standards, previous-comments.

Testing gaps: No check asserts the workflow bun-version pin and packages/cli/package.json engines.bun stay in sync, so this drift can recur on future bumps; no smoke test runs the compiled hdx binaries under the new Bun version.

_{No finding blocks merge automatically. A maintainer will expect P0/P1 findings in code this PR changes to be fixed; P2/P3 are your call -- fix or reply. Never fix findings about surrounding code here; reply instead. Do not widen the PR. How to respond}