chore: upgrade to Bun 1.4.1

[jan-kubica]

Summary\n\n- pin Bun and bun-types to 1.4.1\n- refresh the lockfile\n- temporarily exempt bun-types from the dependency release-age quarantine

Summary by CodeRabbit

• Chores
  • Updated the project’s Bun version to 1.4.1.
  • Updated the accompanying Bun type definitions to 1.4.1.
  • Adjusted package installation handling so the updated type definitions are available without the standard release-age delay.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/bun-types	1.4.1	Unknown	Unknown

Scanned Files

• package.json

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T10:03:03.278630Z	897f4ed	PR opened
🔒 Security Review	✅ Completed 2026-09-04T10:05:23.162608Z	897f4ed	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: a5c2c1e0-b3a1-4009-929a-60e6397c9977

📥 Commits

Reviewing files that changed from the base of the PR and between d888c15 and 897f4ed.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• bunfig.toml
• package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: Bindings and packages
• GitHub Check: Oracle
• GitHub Check: Rust

🧰 Additional context used

📓 Path-based instructions (1)

After adding or changing a validator, use `bun run codegen` to generate npm entrypoints, TypeScript and Python registry types, package exports, and README tables; do not manually maintain generated outputs.

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Files:

• package.json

🔇 Additional comments (2)

package.json (1)

61-61: 🎯 Functional Correctness

No change needed: both 1.4.1 artefacts are available.

bun-types@1.4.1 is published, and Bun v1.4.1 has an official GitHub release. The pins are valid.

bunfig.toml (1)

6-6: 🔒 Security & Privacy

Security Misconfiguration (CWE-16)

Reachability: External · Exploitability: Difficult

Confirm that the expiry removal PR is merged.

The scheduled quarantine-prune workflow removes expired entries and opens a removal PR. The policy fails after its 24-hour notice window if the expired exclusion remains. Until that PR is merged, the bare package-name exclusion still bypasses quarantine for every bun-types version.

---

📝 Walkthrough

Walkthrough

The project updates Bun and bun-types from version 1.4.0 to 1.4.1. It also excludes bun-types from the five-day minimum release-age quarantine.

Changes

Bun tooling update

Layer / File(s)	Summary
Bun version and install configuration package.json, bunfig.toml	package.json uses Bun 1.4.1 and bun-types 1.4.1. bunfig.toml excludes bun-types from the minimum release-age quarantine.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: 🟡 Moderate · up to 897f4

This updates Bun tooling to 1.4.1 but temporarily bypasses the dependency-age safeguard for all bun-types releases. Merge readiness remains moderate until the planned expiry removal is confirmed.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: upgrading Bun and bun-types to version 1.4.1.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/bun-1.4.1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}