Bun 1.3.14 → 1.4.3, from ghcr.io/coinos/bun (oven/bun without the emSign ECC Root CA - G3, CVE-2026-111943)

names, nwcpush, blossom, the vmedia image (and live with it) and the hook's
bun install.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

4 files changed, 6 insertions, 6 deletions

diff --git a/README.md b/README.md
index 453593f..ddbcbe2 100644
--- a/README.md
+++ b/README.md
@@ -31,7 +31,7 @@ git add coinosv3 && git commit -m "coinosv3 → <commit>"
 
 ## Running
 
-You need [Bun](https://bun.sh) (the deployment pins `oven/bun:1.3.14`) and,
+You need [Bun](https://bun.sh) (the deployment pins `ghcr.io/coinos/bun:1.4.3`, oven/bun with the distrusted emSign G3 root swapped out of its built-in store; see coinos-server docker/bun.Dockerfile) and,
 for `names/`, a Core Lightning node's RPC socket and a Cloudflare zone.
 
 ```sh
diff --git a/compose.yml b/compose.yml
index 3cdf4a3..123a02b 100644
--- a/compose.yml
+++ b/compose.yml
@@ -8,7 +8,7 @@
 #   $STATE/live/config.json       $STATE/live/data/       (TURN key; streams and their recordings)
 services:
   names:
-    image: oven/bun:1.3.14
+    image: ghcr.io/coinos/bun:1.4.3
     container_name: names
     working_dir: /app
     command: bun names/server.js
@@ -26,7 +26,7 @@ services:
     restart: unless-stopped
 
   nwcpush:
-    image: oven/bun:1.3.14
+    image: ghcr.io/coinos/bun:1.4.3
     container_name: nwcpush
     working_dir: /app
     command: bun nwcpush/server.js
@@ -42,7 +42,7 @@ services:
     restart: unless-stopped
 
   blossom:
-    image: oven/bun:1.3.14
+    image: ghcr.io/coinos/bun:1.4.3
     container_name: blossom
     working_dir: /app
     command: bun blossom/server.js
diff --git a/deploy/post-receive b/deploy/post-receive
index 8334b4b..4bd4f7e 100755
--- a/deploy/post-receive
+++ b/deploy/post-receive
@@ -27,7 +27,7 @@ while read -r oldrev newrev ref; do
     git -C "$CHECKOUT" -c protocol.file.allow=always submodule update --init --force -q \
       || { echo "submodule update failed"; exit 1; }
     cd "$CHECKOUT" || exit 1
-    docker run --rm -v "$CHECKOUT":/app -w /app oven/bun:1.3.14 bun install --frozen-lockfile --production \
+    docker run --rm -v "$CHECKOUT":/app -w /app ghcr.io/coinos/bun:1.4.3 bun install --frozen-lockfile --production \
       || { echo "bun install failed"; exit 1; }
 
     # which services to restart: their own directory changed, or something
diff --git a/vmedia/Dockerfile b/vmedia/Dockerfile
index 3552f5f..95d9413 100644
--- a/vmedia/Dockerfile
+++ b/vmedia/Dockerfile
@@ -2,7 +2,7 @@
 #   docker build -t vmedia vmedia/
 #   docker run -d --name vmedia --network net --restart unless-stopped --cpus 6 --memory 3g \
 #     -v ~/vmedia/server.js:/app/server.js:ro -v ~/vmedia/data:/data vmedia
-FROM oven/bun:1
+FROM ghcr.io/coinos/bun:1.4.3
 RUN apt-get update && apt-get install -y --no-install-recommends ffmpeg libvips-tools ca-certificates && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 CMD ["bun", "server.js"]