From 3deb25fa8ce0753014e26b97bbc594b608f4a1ac Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Wed, 21 Oct 2026 06:06:54 -0700
Subject: Bun 1.3.14 → 1.4.3, from ghcr.io/coinos/bun (oven/bun without the
 emSign ECC Root CA - G3, CVE-2026-111943)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

names, nwcpush, blossom, the vmedia image (and live with it) and the hook's
bun install.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'README.md')

diff --git a/README.md b/README.md
index 453593f..ddbcbe2 100644
--- a/README.md
+++ b/README.md
@@ -31,7 +31,7 @@ git add coinosv3 && git commit -m "coinosv3 → <commit>"
 
 ## Running
 
-You need [Bun](https://bun.sh) (the deployment pins `oven/bun:1.3.14`) and,
+You need [Bun](https://bun.sh) (the deployment pins `ghcr.io/coinos/bun:1.4.3`, oven/bun with the distrusted emSign G3 root swapped out of its built-in store; see coinos-server docker/bun.Dockerfile) and,
 for `names/`, a Core Lightning node's RPC socket and a Cloudflare zone.
 
 ```sh
-- 
cgit v1.2.3