From c01352b0e49497b40791b8135dba0d516e2507c1 Mon Sep 17 00:00:00 2001 From: Scott Werner Date: Fri, 23 Oct 2026 18:37:20 -0400 Subject: [PATCH 1/2] security: update Bun to 1.4.4 for compromised CA distrust --- .fabro/Dockerfile | 2 +- .fabro/project.toml.bak | 2 +- .github/workflows/nightly.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/typescript.yml | 6 +++--- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.fabro/Dockerfile b/.fabro/Dockerfile index 6268a5484..9797ddb7f 100644 --- a/.fabro/Dockerfile +++ b/.fabro/Dockerfile @@ -55,7 +55,7 @@ RUN cargo install cargo-nextest --locked ENV CARGO_INCREMENTAL=0 # Bun -RUN curl -fsSL https://bun.sh/install | bash +RUN curl -fsSL https://bun.sh/install | bash -s -- bun-v1.4.4 ENV PATH="/root/.bun/bin:${PATH}" WORKDIR /root diff --git a/.fabro/project.toml.bak b/.fabro/project.toml.bak index 24f0d8384..75fb36868 100644 --- a/.fabro/project.toml.bak +++ b/.fabro/project.toml.bak @@ -40,7 +40,7 @@ RUN cargo install cargo-nextest --locked ENV CARGO_INCREMENTAL=0 # Bun -RUN curl -fsSL https://bun.sh/install | bash +RUN curl -fsSL https://bun.sh/install | bash -s -- bun-v1.4.4 ENV PATH="/root/.bun/bin:${PATH}" WORKDIR /root diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index b80b429f6..756b2f1b3 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -45,7 +45,7 @@ jobs: - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 if: steps.skip.outputs.skip != 'true' with: - bun-version: 1.3.14 + bun-version: 1.4.4 no-cache: true - name: Install bun deps (for SPA verify) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f72e5c42c..a1e35eee2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -49,7 +49,7 @@ jobs: - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: - bun-version: 1.3.14 + bun-version: 1.4.4 no-cache: true - name: Install bun deps diff --git a/.github/workflows/typescript.yml b/.github/workflows/typescript.yml index f2086669e..1da01d53d 100644 --- a/.github/workflows/typescript.yml +++ b/.github/workflows/typescript.yml @@ -45,7 +45,7 @@ jobs: persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: - bun-version: 1.3.14 + bun-version: 1.4.4 - run: bun install --frozen-lockfile - run: cd apps/fabro-web && bun run typecheck - run: cd lib/packages/fabro-api-client && bun run typecheck @@ -61,7 +61,7 @@ jobs: persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: - bun-version: 1.3.14 + bun-version: 1.4.4 - run: bun install --frozen-lockfile - run: cd apps/fabro-web && bun run test @@ -76,7 +76,7 @@ jobs: persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: - bun-version: 1.3.14 + bun-version: 1.4.4 - run: bun install --frozen-lockfile - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable with: From 0910630fd3c7d45a95cba48cab3f9909c7f0f8c5 Mon Sep 17 00:00:00 2001 From: Scott Werner Date: Fri, 23 Oct 2026 18:39:36 -0400 Subject: [PATCH 2/2] test: isolate installer session caches between cases --- apps/fabro-web/app/install-app.test.tsx | 40 +++++++++++++++---------- 1 file changed, 25 insertions(+), 15 deletions(-) diff --git a/apps/fabro-web/app/install-app.test.tsx b/apps/fabro-web/app/install-app.test.tsx index 8d34bd31b..99356a25c 100644 --- a/apps/fabro-web/app/install-app.test.tsx +++ b/apps/fabro-web/app/install-app.test.tsx @@ -1,8 +1,9 @@ import { afterEach, describe, expect, mock, test } from "bun:test"; import type { AxiosAdapter } from "axios"; -import { StrictMode } from "react"; +import { StrictMode, type ReactNode } from "react"; import { MemoryRouter, Route, Routes } from "react-router"; import TestRenderer, { act } from "react-test-renderer"; +import { SWRConfig } from "swr"; import InstallApp from "./install-app"; import { generatedAxios } from "./lib/api-client"; @@ -25,6 +26,15 @@ const SESSION_RESPONSE = { const originalAdapter = generatedAxios.defaults.adapter; +function createInstallRenderer(children: ReactNode) { + // Each test gets its own session cache and in-flight request registry. + return TestRenderer.create( + new Map() }}> + {children} + , + ); +} + type TestWindow = { history: { state: unknown; @@ -209,7 +219,7 @@ describe("InstallApp", () => { let renderer: TestRenderer.ReactTestRenderer | null = null; await act(async () => { - renderer = TestRenderer.create( + renderer = createInstallRenderer( @@ -281,7 +291,7 @@ describe("InstallApp", () => { let renderer: TestRenderer.ReactTestRenderer | null = null; await act(async () => { - renderer = TestRenderer.create( + renderer = createInstallRenderer( } /> @@ -369,7 +379,7 @@ describe("InstallApp", () => { let renderer: TestRenderer.ReactTestRenderer | null = null; await act(async () => { - renderer = TestRenderer.create( + renderer = createInstallRenderer( } /> @@ -465,7 +475,7 @@ describe("InstallApp", () => { let renderer: TestRenderer.ReactTestRenderer | null = null; await act(async () => { - renderer = TestRenderer.create( + renderer = createInstallRenderer( } /> @@ -540,7 +550,7 @@ describe("InstallApp", () => { let renderer: TestRenderer.ReactTestRenderer | null = null; await act(async () => { - renderer = TestRenderer.create( + renderer = createInstallRenderer( } /> @@ -606,7 +616,7 @@ describe("InstallApp", () => { let renderer: TestRenderer.ReactTestRenderer | null = null; await act(async () => { - renderer = TestRenderer.create( + renderer = createInstallRenderer( } /> @@ -703,7 +713,7 @@ describe("InstallApp", () => { let renderer: TestRenderer.ReactTestRenderer | null = null; await act(async () => { - renderer = TestRenderer.create( + renderer = createInstallRenderer( } /> @@ -797,7 +807,7 @@ describe("InstallApp", () => { let renderer: TestRenderer.ReactTestRenderer | null = null; await act(async () => { - renderer = TestRenderer.create( + renderer = createInstallRenderer( } /> @@ -885,7 +895,7 @@ describe("InstallApp", () => { let renderer: TestRenderer.ReactTestRenderer | null = null; await act(async () => { - renderer = TestRenderer.create( + renderer = createInstallRenderer( } /> @@ -969,7 +979,7 @@ describe("InstallApp", () => { let renderer: TestRenderer.ReactTestRenderer | null = null; await act(async () => { - renderer = TestRenderer.create( + renderer = createInstallRenderer( } /> @@ -1047,7 +1057,7 @@ describe("InstallApp", () => { let renderer: TestRenderer.ReactTestRenderer | null = null; await act(async () => { - renderer = TestRenderer.create( + renderer = createInstallRenderer( } /> @@ -1117,7 +1127,7 @@ describe("InstallApp", () => { let renderer: TestRenderer.ReactTestRenderer | null = null; await act(async () => { - renderer = TestRenderer.create( + renderer = createInstallRenderer( } /> @@ -1178,7 +1188,7 @@ describe("InstallApp", () => { let renderer: TestRenderer.ReactTestRenderer | null = null; await act(async () => { - renderer = TestRenderer.create( + renderer = createInstallRenderer( } /> @@ -1247,7 +1257,7 @@ describe("InstallApp", () => { let renderer: TestRenderer.ReactTestRenderer | null = null; await act(async () => { - renderer = TestRenderer.create( + renderer = createInstallRenderer( } />