From 023b23cdf714534d90211c08c3a99fed73482d16 Mon Sep 17 00:00:00 2001 From: Mohamed Otefi Date: Thu, 22 Oct 2026 12:24:43 -0700 Subject: [PATCH 1/4] Upgrade default Bun to 1.4.4 --- packages/reflex-base/news/+bun-ca-removal.bugfix.md | 1 + packages/reflex-base/src/reflex_base/constants/installer.py | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 packages/reflex-base/news/+bun-ca-removal.bugfix.md diff --git a/packages/reflex-base/news/+bun-ca-removal.bugfix.md b/packages/reflex-base/news/+bun-ca-removal.bugfix.md new file mode 100644 index 00000000000..2d2c7656601 --- /dev/null +++ b/packages/reflex-base/news/+bun-ca-removal.bugfix.md @@ -0,0 +1 @@ +Upgrade the default Bun version to 1.4.4, which removes compromised emSign certificate authorities from its bundled trust store. diff --git a/packages/reflex-base/src/reflex_base/constants/installer.py b/packages/reflex-base/src/reflex_base/constants/installer.py index 39a6b621afb..1fdccdc6b9c 100644 --- a/packages/reflex-base/src/reflex_base/constants/installer.py +++ b/packages/reflex-base/src/reflex_base/constants/installer.py @@ -17,7 +17,7 @@ class Bun(SimpleNamespace): """Bun constants.""" # The Bun version. - VERSION = "1.4.2" + VERSION = "1.4.4" # Min Bun Version. Bun 1.4 creates new lockfiles at `lockfileVersion: 2`, # which 1.3.x cannot parse at all, so a `reflex.lock/bun.lock` generated From caa122f35569faf6c6d4cc61aad305957ac19965 Mon Sep 17 00:00:00 2001 From: Mohamed Otefi Date: Thu, 22 Oct 2026 13:20:30 -0700 Subject: [PATCH 2/4] Require Bun 1.4.4 for managed runtime upgrades --- packages/reflex-base/src/reflex_base/constants/installer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/reflex-base/src/reflex_base/constants/installer.py b/packages/reflex-base/src/reflex_base/constants/installer.py index 1fdccdc6b9c..2c0d9daf8ab 100644 --- a/packages/reflex-base/src/reflex_base/constants/installer.py +++ b/packages/reflex-base/src/reflex_base/constants/installer.py @@ -25,7 +25,7 @@ class Bun(SimpleNamespace): # even across dependency changes, so already-initialized projects survive.) # Keep this in step with VERSION across the 1.4 boundary so a system bun # old enough to choke on a v2 lockfile is never preferred over the pinned one. - MIN_VERSION = "1.4.0" + MIN_VERSION = "1.4.4" # URL to bun install script. INSTALL_URL = "https://raw.githubusercontent.com/reflex-dev/reflex/main/scripts/bun_install.sh" From 448372b29e7a6551c25f90810842131eaa20479c Mon Sep 17 00:00:00 2001 From: Mohamed Otefi Date: Thu, 22 Oct 2026 13:32:25 -0700 Subject: [PATCH 3/4] Clarify the unsupported Bun version warning --- reflex/utils/js_runtimes.py | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/reflex/utils/js_runtimes.py b/reflex/utils/js_runtimes.py index 741a48c30ee..ee407414536 100644 --- a/reflex/utils/js_runtimes.py +++ b/reflex/utils/js_runtimes.py @@ -363,12 +363,8 @@ def validate_bun(bun_path: Path | None = None): raise SystemExit(1) if bun_version < version.parse(constants.Bun.MIN_VERSION): logger.warning( - f"Reflex requires bun version {constants.Bun.MIN_VERSION} or higher to run, but the detected version is " - f"{bun_version}. If you have specified a custom bun path in your config, make sure to provide one " - f"that satisfies the minimum version requirement. You can upgrade bun by running [bold]bun upgrade[/bold]. " - f"Bun 1.4 creates new lockfiles at `lockfileVersion: 2`, which bun 1.3.x cannot parse, so a " - f"[bold]reflex.lock/bun.lock[/bold] generated by bun 1.4 will fail to install with this bun. " - f"An existing v1 lockfile is kept at v1, so already-initialized projects are unaffected.", + f"Bun {bun_version} is below the minimum supported version " + f"{constants.Bun.MIN_VERSION}. Please upgrade Bun by running [bold]bun upgrade[/bold].", extra={"rich": True}, ) From 395d832c8e25d17c6732b829d64868bb8b1a12a8 Mon Sep 17 00:00:00 2001 From: Mohamed Otefi Date: Thu, 22 Oct 2026 13:43:44 -0700 Subject: [PATCH 4/4] Add changelog fragment for Bun version warning --- news/+bun-version-warning.bugfix.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 news/+bun-version-warning.bugfix.md diff --git a/news/+bun-version-warning.bugfix.md b/news/+bun-version-warning.bugfix.md new file mode 100644 index 00000000000..8de6329f2f6 --- /dev/null +++ b/news/+bun-version-warning.bugfix.md @@ -0,0 +1 @@ +Clarify the warning shown when Bun is below the minimum supported version.