chore(deps): upgrade Bun to 1.4.4 (#9338)

Bun 1.4.4 ships the updated root certificate store (oven-sh/bun#46159),
so Bun's native fetch stops trusting the distrusted emSign ECC Root CA - G3.
Moves the packageManager pin, engines floors, CI setup-bun versions, the
oven/bun base images, and the Pi sandbox Bun pin together.

Author: waleedlatif1

.github/actions/setup/action.yml

@@ -35,7 +35,7 @@ runs:
     - name: Setup Bun
       uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       with:
-        bun-version: 1.4.2
+        bun-version: 1.4.4
 
     - name: Setup Node
       if: inputs.node-version != ''

.github/workflows/checks.yml

@@ -45,7 +45,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
       - name: Install only the pinned task planner
         continue-on-error: true
         run: bun install --global "turbo@$(jq -r .devDependencies.turbo package.json)"

.github/workflows/desktop-e2e.yml

@@ -79,7 +79,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       # Electron, electron-builder and Playwright download their binaries on every cold install. All
       # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
@@ -151,7 +151,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       # Electron, electron-builder and Playwright download their binaries on every cold install. All
       # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
@@ -213,7 +213,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       - name: Setup Node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6

.github/workflows/desktop-release.yml

@@ -143,7 +143,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       - name: Setup Node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6

.github/workflows/helm.yml

@@ -62,7 +62,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       # Docker Compose and Kubernetes must run the same background jobs on the
       # same schedules; this fails the build if the two drift apart. The script
@@ -286,7 +286,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       # Derives appVersion rather than checking it, so the published chart cannot
       # be pinned to an older Sim than the release it ships with. The committed
@@ -481,7 +481,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       # Derives appVersion rather than checking it, so the published chart cannot
       # be pinned to an older Sim than the release it ships with. The committed

apps/desktop/package.json

@@ -9,7 +9,7 @@
   "type": "module",
   "main": "dist/main.cjs",
   "engines": {
-    "bun": ">=1.4.2",
+    "bun": ">=1.4.4",
     "node": ">=20.0.0"
   },
   "scripts": {

apps/realtime/package.json

@@ -5,7 +5,7 @@
   "license": "Apache-2.0",
   "type": "module",
   "engines": {
-    "bun": ">=1.4.2",
+    "bun": ">=1.4.4",
     "node": ">=20.0.0"
   },
   "scripts": {

apps/sim/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.4.2",
+    "bun": ">=1.4.4",
     "node": ">=24.0.0 <25.0.0"
   },
   "scripts": {

apps/sim/scripts/pi-sandbox-packages.ts

@@ -14,7 +14,7 @@
  */
 
 /** Bun version mirrored from the root packageManager field. */
-export const PI_BUN_VERSION = '1.4.2'
+export const PI_BUN_VERSION = '1.4.4'
 
 /** Exact Pi version mirrored from the app dependencies and lockfile. */
 export const PI_PACKAGE_VERSION = '1.0.0'

docker/app.Dockerfile

@@ -1,7 +1,7 @@
 # ========================================
 # Base Stage: runtime-only dependencies (inherited by the final image)
 # ========================================
-FROM oven/bun:1.4.2-slim AS base
+FROM oven/bun:1.4.4-slim AS base
 
 # Install Node.js 24 (Active LTS) and the runtime dependencies once in base.
 # Node runs the isolated-vm sandbox worker and the Oracle Database worker (the