Repository navigation
fix(deps): ship Bun 1.4.4 runtime to drop the compromised eMudhra root - #7606
Conversation
Bun 1.4.2's bundled root store still trusts emSign ECC Root CA - G3, which signed the eight eMudhra intermediates whose keys are recoverable (October 2026). Bun 1.4.4 ships NSS 3.131.1 roots without it. NODE_USE_SYSTEM_CA does not help: bundled roots stay trusted alongside. Runtime pin only; testRunnerBun stays 1.4.3.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
⛔ Files ignored due to path filters: 1
📒 Files selected for processing: 9
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
the
intake: hygiene-blocked
|
lidge-jun
removed
the
intake: hygiene-blocked
⏳ DRAFT
What to do
Review readiness checklist
0/4 boxes ticked. Automatic draft conversion failed. Please convert this pull request to a draft manually until every box above is ticked. |
github-actions
Bot
added
the
intake: hygiene-blocked
lidge-jun
added
dependency-change-approved
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c720313916
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| recovery, the launcher can use an executable Bun from an absolute PATH directory if its | ||
| stable version has the pinned major and a minor at least the pinned minor. With the current | ||
| 1.4.2 dependency, that means 1.4.0 or newer within major 1. Bounded version-policy and identity | ||
| 1.4.4 dependency, that means 1.4.0 or newer within major 1. Bounded version-policy and identity |
There was a problem hiding this comment.
When the bundled binary is unavailable after a blocked or failed postinstall, bin/ocx.mjs:1069 sends this 1.4.4 pin to findPathBun, but src/lib/bun-path-runtime.mjs:128 only compares major and minor, so a PATH Bun 1.4.2 is still accepted. That runtime retains the compromised CA this update is meant to remove, so affected npm/pnpm installs can still accept forged provider TLS certificates while sending credentials; enforce a 1.4.4 patch floor in the fallback and adjust the acceptance tests/docs.
AGENTS.md reference: AGENTS.md:L446-L452
Useful? React with 👍 / 👎.
| "@modelcontextprotocol/sdk": "^1.32.1", | ||
| "@napi-rs/keyring": "1.3.0", | ||
| "bun": "1.4.2", | ||
| "bun": "1.4.4", |
There was a problem hiding this comment.
In the scheduled cleanup job, .github/workflows/cleanup-orphaned-workflows.yml:37-45 still installs Bun 1.4.2 and then runs scripts/ci/cleanup-orphaned-workflows.mjs with an actions:write GITHUB_TOKEN; that script sends the token as a Bearer header via Bun fetch to api.github.com. Because 1.4.2 retains the compromised root, this credential-bearing path remains vulnerable despite the runtime bump; resolve the shared 1.4.4 runtime pin or update this hardcoded setup.
AGENTS.md reference: AGENTS.md:L446-L452
Useful? React with 👍 / 👎.
| recovery, the launcher can use an executable Bun from an absolute PATH directory if its | ||
| stable version has the pinned major and a minor at least the pinned minor. With the current | ||
| 1.4.2 dependency, that means 1.4.0 or newer within major 1. Bounded version-policy and identity | ||
| 1.4.4 dependency, that means 1.4.0 or newer within major 1. Bounded version-policy and identity |
There was a problem hiding this comment.
The published Korean installation page at docs-site/src/content/docs/ko/getting-started/installation.md:29-30 still tells readers that the current dependency is 1.4.2, while this English canonical page and package.json now say 1.4.4. Update that locale in the same change so users are not told the package still ships the vulnerable runtime.
AGENTS.md reference: docs-site/AGENTS.md:L9-L10
Useful? React with 👍 / 👎.
|
Additional Windows verification supports the shipped 1.4.4 update. Compared official Bun
TLS verification stayed enabled. These are isolated fixture measurements; the environment-propagation mocks are not counted as TLS evidence. Two 1.4.3 WSS negative cases returned only a generic TLS error, so their specific certificate failure reason remains unproven. This does not qualify a test-runner pin change: full multi-file/ |
Summary
Bumps the shipped Bun runtime (
dependencies.bun) from 1.4.2 to 1.4.4. The test-runner pin (testRunnerBun1.4.3) is unchanged.Why: Bun ships its own root certificate store. 1.4.2 still trusts
emSign ECC Root CA - G3, which signed the eight eMudhra intermediate CAs whose private keys turned out to be recoverable from the public certificates (October 2026: Chrome, details). Bun doesn't check Certificate Transparency or revocation, so anyone holding those keys can forge a certificate that the proxy accepts for any upstream, including provider APIs that carry user credentials. Bun 1.4.4 updates its bundled roots to NSS 3.131.1, which drops that root.NODE_USE_SYSTEM_CA/--use-system-cadon't help on 1.4.2, because the bundled roots stay trusted alongside the system store.Live check against the researchers' test hosts, using
fetchfrom the bundled runtime:dv-g3b-emudhra.we-have-a-problem.comNODE_USE_SYSTEM_CA=1CERT_REVOKED)Changes:
package.json/bun.lock:bun1.4.2 → 1.4.4 (only thebunand@oven/bun-*entries move)Dockerfile:oven/bun:1.4.4pinned by its multi-platform index digestsha256:1d22548f…548f1d(resolved from Docker Hub; the same lookup returns the existing 1.4.2 digest exactly)tests/ci-workflows/install-scripts.test.ts: the runtime pin assertion now expects 1.4.4structure/runtime.md,structure/ops/docs-and-release.md), edited in place, so thestructure/files stay at their 600-line budgetNot changed:
.github/workflow and action comments, which describe the 1.4.2 history, and the testRunnerBun split. Rejoining the two pins is still yourlane=alldecision, but see the 1.4.4-runner result below.This touches a dependency-installation surface, so it needs
maintainer-sponsored.Verification
Linux x64 (Ubuntu 24.04), branch based on
dev@ 26415a9:bun run typecheck: passbun run structure:check: passbun run privacy:scan: passbun run test tests/ci-workflows/install-scripts.test.ts tests/ci-workflows/ci-scope-gaps.test.ts tests/ci-workflows/test-runner-bun.test.ts tests/ci-workflows/structure-ssot.test.ts tests/service/container-bootstrap.test.ts tests/ci-workflows/ci-review-lanes.test.ts: 223 pass, 0 failbun run test(runner 1.4.3): 51,261 pass / 141 skip / 27 fail on unmodifieddev, and the same 27 failures on this branch (none new, none fixed). They are host-environment failures on my machine, mostly PATH-Bun and service-runtime-deferral tests, including the 5 s timeout tracked in [Bug]: ocx-launcher-runtime "missing bundle reaches validated PATH Bun" times out at 5 s under host load #7578.testRunnerBunflipped only for that run, not committed): 51,259 pass, the same 27 host failures, plus the 2 tests that asserttestRunnerBunis 1.4.3. No segfaults or panics. Not alane=allproof, but the fix(ci,runtime): stop hiding the Bun runtime crash and pin back to 1.4.0 #4821 multi-file--isolatepreload crash that kept the runner off 1.4.2 didn't reproduce on Linux.src/cli/index.ts start --port 10199under the bundled 1.4.4 in a throwawayHOMEstarts, serves/v1/models, and shuts down cleanly.Not covered locally: macOS and Windows. The 1.4.2 pin exists for #6684's Windows
Bun.fetchstreaming fix, which 1.4.4 still contains, but alane=alldispatch would confirm it.Checklist
Summary by CodeRabbit
Review readiness checklist
This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:
Required local validation passed; commands, results, and any full-suite exception are documented.
I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
I resolved all correct Codex and CodeRabbit findings.
My PR is ready for review.