From fbc6b5528c1c99892d20e788d5ee6de0003179c9 Mon Sep 17 00:00:00 2001
From: vigneshrajsb <vignesh.raj47@gmail.com>
Date: Sun, 18 Oct 2026 17:11:55 -0700
Subject: [PATCH] build: enforce minimum release age for dependencies

Resolve only package versions published at least 3 days ago. Bump Bun to 1.4.3, which supports install.minimumReleaseAge, and use a frozen lockfile in the Docker build.
---
 .github/workflows/ci.yml     | 2 +-
 .github/workflows/deploy.yml | 2 +-
 Dockerfile                   | 6 +++---
 bunfig.toml                  | 5 +++++
 package.json                 | 2 +-
 5 files changed, 11 insertions(+), 6 deletions(-)
 create mode 100644 bunfig.toml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2695a1b..635bc46 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,6 +34,6 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.8
+          bun-version: 1.4.3
       - run: bun install --frozen-lockfile
       - run: bun run verify
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 625b91d..f6de8ef 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -31,7 +31,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.8
+          bun-version: 1.4.3
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/Dockerfile b/Dockerfile
index abc4ea0..2609b5d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,12 +13,12 @@
 # limitations under the License.
 
 # Stage 1: Build the Nextra app with secrets injection
-FROM oven/bun:1.2.8 AS builder
+FROM oven/bun:1.4.3 AS builder
 WORKDIR /app
 
 # Copy dependency files
-COPY package*.json bun.lock* ./
-RUN bun install
+COPY package*.json bun.lock* bunfig.toml ./
+RUN bun install --frozen-lockfile
 
 COPY . .
 
diff --git a/bunfig.toml b/bunfig.toml
new file mode 100644
index 0000000..f37b4df
--- /dev/null
+++ b/bunfig.toml
@@ -0,0 +1,5 @@
+[install]
+# Seconds. Only resolve package versions published at least 3 days ago.
+minimumReleaseAge = 259200
+# Package names exempt from the delay, e.g. for an urgent security fix.
+minimumReleaseAgeExcludes = []
diff --git a/package.json b/package.json
index 7c70d9b..967fe33 100644
--- a/package.json
+++ b/package.json
@@ -111,7 +111,7 @@
       "prettier --write"
     ]
   },
-  "packageManager": "bun@1.2.8",
+  "packageManager": "bun@1.4.3",
   "overrides": {
     "postcss": "^8.5.31",
     "@xmldom/xmldom": "^0.9.12"