Skip to content

build(nix): distrust compromised eMudhra CAs via Node 24.22.1 and Bun 1.4.4 #1218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
elucid merged 7 commits into from
Oct 23, 2026
Merged

build(nix): distrust compromised eMudhra CAs via Node 24.22.1 and Bun 1.4.4 #1218

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
ca3c552
build(nix): distrust compromised eMudhra CAs via Node 24.22.1 and Bun…
elucid Oct 22, 2026
6010ad9
fix(pager): read the controlling terminal without blocking so quittin…
elucid Oct 22, 2026
32a8214
build(nix): replace the dev shell's bun on Linux too
elucid Oct 22, 2026
ada3ce5
docs(ui): list the stdin members OpenTUI reads from the controlling t…
elucid Oct 22, 2026
bb185f5
refactor(ui): type the renderer stdin structurally instead of casting it
elucid Oct 22, 2026
e99f14c
docs(pager): document the controlling-terminal input's liveness and r…
elucid Oct 22, 2026
bd4c07d
docs(nix): correct the pinned nixpkgs node version in nodejs-bin.nix
elucid Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/emudhra-bun-1-4-4-runtime.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
"hunkdiff": patch
---

Upgrade the bundled Bun runtime to 1.4.4 so Hunk's own HTTPS requests (GitHub review via `hunk gh`, extension fetches) reject certificates issued by the compromised eMudhra intermediate CAs.
2 changes: 1 addition & 1 deletion .github/workflows/benchmarks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Install dependencies
run: bun install --frozen-lockfile
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Set up Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
Expand Down Expand Up @@ -101,7 +101,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Install dependencies
run: bun install --frozen-lockfile
Expand All @@ -126,7 +126,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Install dependencies
run: bun install --frozen-lockfile
Expand All @@ -151,7 +151,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Set up Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
Expand Down Expand Up @@ -204,7 +204,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Set up Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
Expand Down Expand Up @@ -240,7 +240,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Install dependencies
run: bun install --frozen-lockfile
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/install-vm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Install ordinary development dependencies
run: bun install --frozen-lockfile
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/pr-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Verify release-note changeset
env:
Expand All @@ -64,7 +64,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Set up Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
Expand Down Expand Up @@ -117,7 +117,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Install dependencies
run: bun install --frozen-lockfile
Expand All @@ -142,7 +142,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Set up Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
Expand Down Expand Up @@ -247,7 +247,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Install dependencies
run: bun install --frozen-lockfile
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/release-prebuilt-npm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Resolve npm dist-tag and GitHub latest status
id: resolve
Expand Down Expand Up @@ -87,7 +87,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Install dependencies
run: bun install --frozen-lockfile
Expand Down Expand Up @@ -155,7 +155,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Install dependencies
run: bun install --frozen-lockfile
Expand Down Expand Up @@ -195,7 +195,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Set up Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
Expand Down Expand Up @@ -255,7 +255,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Set up Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
Expand Down Expand Up @@ -302,7 +302,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Download platform artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/website.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: 1.4.2
bun-version: 1.4.4

- name: Install repository dependencies
run: bun install --frozen-lockfile
Expand Down
2 changes: 1 addition & 1 deletion CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ Keep the change focused on one user problem. Before adding another helper, state

Requirements:

- Bun 1.4.2+
- Bun 1.4.4+
- Node.js 22+ for npm package verification and release tasks
- Git
- macOS, Linux, or Windows
Expand Down
38 changes: 19 additions & 19 deletions bun.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions flake.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,9 @@
system: let
pkgs = import nixpkgs {
inherit system;
# TEMPORARY: eMudhra root-store workaround for the dev shell's bun (all
# systems) and node (macOS); self-retiring, see nix/emudhra-overlay.nix.
overlays = [(import ./nix/emudhra-overlay.nix)];
};
hunk = pkgs.callPackage ./nix/package.nix {
bun2nix = bun2nix.packages.${system}.default;
Expand Down
Loading
Loading