build: enforce minimum release age for dependencies

.github/workflows/ci.yml

@@ -34,6 +34,6 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.8
+          bun-version: 1.4.3
       - run: bun install --frozen-lockfile
       - run: bun run verify

.github/workflows/deploy.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.8
+          bun-version: 1.4.3
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

Dockerfile

@@ -13,12 +13,12 @@
 # limitations under the License.
 
 # Stage 1: Build the Nextra app with secrets injection
-FROM oven/bun:1.2.8 AS builder
+FROM oven/bun:1.4.3 AS builder
 WORKDIR /app
 
 # Copy dependency files
-COPY package*.json bun.lock* ./
-RUN bun install
+COPY package*.json bun.lock* bunfig.toml ./
+RUN bun install --frozen-lockfile
 
 COPY . .
 

bunfig.toml

@@ -0,0 +1,5 @@
+[install]
+# Seconds. Only resolve package versions published at least 3 days ago.
+minimumReleaseAge = 259200
+# Package names exempt from the delay, e.g. for an urgent security fix.
+minimumReleaseAgeExcludes = []

package.json

@@ -111,7 +111,7 @@
       "prettier --write"
     ]
   },
-  "packageManager": "bun@1.2.8",
+  "packageManager": "bun@1.4.3",
   "overrides": {
     "postcss": "^8.5.31",
     "@xmldom/xmldom": "^0.9.12"