[Darksinian]

Upgrade the default Bun from 1.4.2 to 1.4.4, which includes the CA root refresh and compromised public-key rejection. Raise the minimum to 1.4.4 so existing managed Bun installations also upgrade.

Validation: 17 existing focused installer/runtime tests passed; changed-file Ruff/format and diff checks passed. Bun 1.4.4 completed the legitimate TLS control and rejected all 12 compromised test endpoints with CERT_REVOKED.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T19:26:40.186320Z	023b23c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 023b23cdf7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no outstanding issues were identified.

Summary

Raises the default and minimum supported Bun versions to 1.4.4.

• Reflex's managed Bun now uses version 1.4.4.
• Warnings for older custom Bun versions now give a short upgrade message.

_{Reviews (4) · Last reviewed commit: "Add changelog fragment for Bun version w..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[codspeed]

Merging this PR will not alter performance

1 warning

⚠️ 16 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 148 untouched benchmarks

---

_{Comparing codex/bun-security-1.4.4 (395d832) with main (aeaac72)}