pin Bun 1.4.4, which fixes the Brotli decoder's out-of-bounds write (CVE-2026-111497)

Dockerfile

@@ -1,18 +1,22 @@
 # One image for all of Personal Agent Proxy: the api, serving the web app's build on the same
 # origin, and the database migrations it runs before starting. See
 # packages/docs/content/self-hosting.
+#
+# Bun is pinned, never `1-slim`, so a build can't reuse an older one from the cache: before 1.4.4
+# its Brotli decoder writes out of bounds on a crafted answer to `fetch` (CVE-2026-111497), which a
+# custom MCP server could send. A new version goes here and in render.yaml's BUN_VERSION.
 
 # Builds the web app, with only its own dependencies. Static files are the same on every platform,
 # so this runs on the builder's own, not emulated.
-FROM --platform=$BUILDPLATFORM oven/bun:1-slim AS build
+FROM --platform=$BUILDPLATFORM oven/bun:1.4.4-slim AS build
 WORKDIR /app
 COPY . .
 RUN bun install --frozen-lockfile --filter web
 RUN bun run --cwd packages/web build
 
 # Only the api's production dependencies, which include the Prisma CLI for the migrations. Every
 # workspace's package.json is copied so the lockfile still matches.
-FROM oven/bun:1-slim AS runtime
+FROM oven/bun:1.4.4-slim AS runtime
 WORKDIR /app
 
 # Prisma's engines need OpenSSL.

render.yaml

@@ -110,7 +110,7 @@ services:
     envVars:
       # The version the repo is developed and the image built with.
       - key: BUN_VERSION
-        value: 1.4.2
+        value: 1.4.4
 
   # The website, exported as plain files like the docs (packages/website/next.config.ts).
   - type: web
@@ -133,7 +133,7 @@ services:
         value: public, max-age=31536000, immutable
     envVars:
       - key: BUN_VERSION
-        value: 1.4.2
+        value: 1.4.4
 
 databases:
   - name: proxy-db