BugPin v1.2.6

BugPin v1.2.6 updates vulnerable dependencies across Community and Enterprise Editions, pins Bun to 1.4.4, and introduces a 72-hour minimum age for npm dependency releases with per-run admin-approved exceptions. It also improves the appearance of Reports and Projects sidebar counts.

Changed

• Style the Reports and Projects sidebar counts with muted color, normal font weight, and tabular digits.

Security

• Require npm dependency releases to be at least 72 hours old when resolving new versions locally, checking pull requests, and publishing Docker images. CI verifies exact locked CE and EE versions, including transitive dependencies, and rejects missing lockfiles, unavailable EE access, missing publication timestamps, and unverified external URLs. The existing pinned SheetJS tarball is excluded because it is hosted outside npm.
• Allow repository admins to approve a release-age exception for an individual CE/EE workflow run through a protected GitHub environment. PR checks and Docker publishing share the same validation and approval policy; invalid metadata, missing access, and all other checks remain blocking.
• Pin the runtime, Docker image, and CI to Bun 1.4.4. That release fixes CVE-2026-111497 (HTTP2Shell), an out-of-bounds write in Bun's bundled Brotli decoder. On earlier Bun 1.4.x releases, untrusted Brotli input decompressed by the runtime (including fetch responses with Content-Encoding: br, node:zlib, and DecompressionStream) can crash the process or lead to remote code execution.
• Bun 1.4.4 stops trusting compromised eMudhra (emSign) intermediate certificate authorities (GHSA-26q8-h657-pf84). Bun 1.4.3 and earlier accept TLS certificates issued by those intermediates, so an on-path attacker can impersonate any TLS server to the runtime, including fetch and package installs.
• Bun 1.4.4 also fixes HTTP/3 QPACK amplification that can exhaust memory and stall the process (GHSA-cf8x-9m69-3gg3).
• Update Hono to 4.13.11 in CE and EE, Sharp to 0.35.5, Zod to 4.6.6, and Nodemailer to 10.1.4 to address static-path middleware bypass, image-processing vulnerabilities, validation memory exhaustion, and recipient address parsing vulnerabilities.
• Update Axios to 1.20.0 and follow-redirects to 1.16.1 to address request handling vulnerabilities and credential leakage across redirects.
• Update DOMPurify to 3.4.17 and consolidate nested ProseMirror View dependencies on 1.42.6 to address cross-site scripting vulnerabilities in HTML sanitization and rich-text paste handling.
• Update Vite to 8.2.4, Vitest and its coverage package to 4.1.12, Undici to 8.12.2, smol-toml to 1.9.0, and source-map-js to 1.2.2 to address development and test dependency vulnerabilities.

How to Upgrade

Docker

docker compose pull && docker compose up -d

Bun

Use Bun 1.4.4 for source installations.

git pull
bun install
bun run build
bun run start

Related

• Docker Update
• Bun Update