Upgrade default Bun to 1.4.4 (#7639)

* Upgrade default Bun to 1.4.4

* Require Bun 1.4.4 for managed runtime upgrades

* Clarify the unsupported Bun version warning

* Add changelog fragment for Bun version warning

Author: Darksinian

news/+bun-version-warning.bugfix.md

@@ -0,0 +1 @@
+Clarify the warning shown when Bun is below the minimum supported version.

packages/reflex-base/news/+bun-ca-removal.bugfix.md

@@ -0,0 +1 @@
+Upgrade the default Bun version to 1.4.4, which removes compromised emSign certificate authorities from its bundled trust store.

packages/reflex-base/src/reflex_base/constants/installer.py

@@ -17,15 +17,15 @@ class Bun(SimpleNamespace):
     """Bun constants."""
 
     # The Bun version.
-    VERSION = "1.4.2"
+    VERSION = "1.4.4"
 
     # Min Bun Version. Bun 1.4 creates new lockfiles at `lockfileVersion: 2`,
     # which 1.3.x cannot parse at all, so a `reflex.lock/bun.lock` generated
     # under 1.4 is unusable on 1.3.x. (An existing v1 lockfile is kept at v1
     # even across dependency changes, so already-initialized projects survive.)
     # Keep this in step with VERSION across the 1.4 boundary so a system bun
     # old enough to choke on a v2 lockfile is never preferred over the pinned one.
-    MIN_VERSION = "1.4.0"
+    MIN_VERSION = "1.4.4"
 
     # URL to bun install script.
     INSTALL_URL = "https://raw.githubusercontent.com/reflex-dev/reflex/main/scripts/bun_install.sh"

reflex/utils/js_runtimes.py

@@ -363,12 +363,8 @@ def validate_bun(bun_path: Path | None = None):
             raise SystemExit(1)
         if bun_version < version.parse(constants.Bun.MIN_VERSION):
             logger.warning(
-                f"Reflex requires bun version {constants.Bun.MIN_VERSION} or higher to run, but the detected version is "
-                f"{bun_version}. If you have specified a custom bun path in your config, make sure to provide one "
-                f"that satisfies the minimum version requirement. You can upgrade bun by running [bold]bun upgrade[/bold]. "
-                f"Bun 1.4 creates new lockfiles at `lockfileVersion: 2`, which bun 1.3.x cannot parse, so a "
-                f"[bold]reflex.lock/bun.lock[/bold] generated by bun 1.4 will fail to install with this bun. "
-                f"An existing v1 lockfile is kept at v1, so already-initialized projects are unaffected.",
+                f"Bun {bun_version} is below the minimum supported version "
+                f"{constants.Bun.MIN_VERSION}. Please upgrade Bun by running [bold]bun upgrade[/bold].",
                 extra={"rich": True},
             )