fix(runtime): bump Bun to 1.4.0 to fix Stagehand/Browserbase WebSocket upgrades

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM oven/bun:1.3.14-alpine
+FROM oven/bun:1.4.0-alpine
 
 # Install necessary packages for development
 RUN apk add --no-cache \

.github/workflows/ci.yml

@@ -231,7 +231,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Cache Bun dependencies
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
@@ -657,7 +657,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Install dependencies
         run: bun install --frozen-lockfile --ignore-scripts

.github/workflows/desktop-e2e.yml

@@ -43,7 +43,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -76,7 +76,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -112,7 +112,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Setup Node
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4

.github/workflows/desktop-release.yml

@@ -128,7 +128,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Setup Node
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4

.github/workflows/docs-embeddings.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/helm.yml

@@ -35,7 +35,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       # Docker Compose and Kubernetes must run the same background jobs on the
       # same schedules; this fails the build if the two drift apart. The script

.github/workflows/migrations.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Cache Bun dependencies
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5

.github/workflows/publish-cli.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Setup Node.js for npm publishing
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/publish-sim-cli.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/publish-sim-setup.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/publish-ts-sdk.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Setup Node.js for npm publishing
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/test-build.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -231,7 +231,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

apps/desktop/package.json

@@ -9,7 +9,7 @@
   "type": "module",
   "main": "dist/main.cjs",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "scripts": {

apps/realtime/package.json

@@ -5,7 +5,7 @@
   "license": "Apache-2.0",
   "type": "module",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "scripts": {

apps/sim/lib/core/utils/fetch-deadline.ts

@@ -42,6 +42,10 @@ import { Agent, type Dispatcher } from 'undici'
  *   timeout: false -> RESOLVED 310031ms               <- disarmed
  *   timeout: 1000  -> RESOLVED 3008ms on a 3s request <- numeric ignored
  *
+ * Re-checked on Bun 1.4.0: `timeout: 1000` against a 3s-delayed response still
+ * resolves at ~3s rather than throwing at 1s — the numeric form is still
+ * ignored, so nothing below changed with that bump.
+ *
  * So a positive numeric `timeout` silently changes nothing on this version; the
  * numeric idle-deadline form and `BUN_CONFIG_HTTP_IDLE_TIMEOUT` both exist only
  * on Bun's `main`. Do not "improve" this into a numeric pass-through until the

apps/sim/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=22.19.0"
   },
   "scripts": {

apps/sim/scripts/pi-sandbox-packages.ts

@@ -14,7 +14,7 @@
  */
 
 /** Bun version mirrored from the root packageManager field. */
-export const PI_BUN_VERSION = '1.3.14'
+export const PI_BUN_VERSION = '1.4.0'
 
 /** Exact global package versions mirrored from package.json and bun.lock. */
 export const PI_GLOBAL_NPM_PACKAGES = [

docker/app.Dockerfile

@@ -1,7 +1,7 @@
 # ========================================
 # Base Stage: runtime-only dependencies (inherited by the final image)
 # ========================================
-FROM oven/bun:1.3.14-slim AS base
+FROM oven/bun:1.4.0-slim AS base
 
 # Install Node.js 24 (Active LTS) and the runtime dependencies once in base.
 # Node runs only the isolated-vm sandbox worker (the app itself runs under Bun);

docker/db.Dockerfile

@@ -1,7 +1,7 @@
 # ========================================
 # Base Stage: Alpine Linux with Bun
 # ========================================
-FROM oven/bun:1.3.14-alpine AS base
+FROM oven/bun:1.4.0-alpine AS base
 
 # ========================================
 # Dependencies Stage: Install Dependencies

docker/realtime.Dockerfile

@@ -1,7 +1,7 @@
 # ========================================
 # Base Stage: Alpine Linux with Bun
 # ========================================
-FROM oven/bun:1.3.14-alpine AS base
+FROM oven/bun:1.4.0-alpine AS base
 
 RUN apk add --no-cache libc6-compat curl
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "simstudio",
-  "packageManager": "bun@1.3.14",
+  "packageManager": "bun@1.4.0",
   "version": "0.0.0",
   "private": true,
   "license": "Apache-2.0",
@@ -58,6 +58,8 @@
     "check:icon-path-precision": "bun run scripts/check-icon-path-precision.ts",
     "check:migrations": "bun run scripts/check-migrations-safety.ts",
     "check:native-typecheck": "bun run scripts/check-native-typecheck.ts",
+    "check:bun-websocket-upgrade": "bun run scripts/check-bun-websocket-upgrade.ts",
+    "check:bun-version-pins": "bun run scripts/check-bun-version-pins.ts",
     "check:source-text": "bun run scripts/check-source-text.ts",
     "check:spec-example-ids": "bun run scripts/check-spec-example-ids.ts",
     "check:script-tests": "bun run scripts/check-script-test-coverage.ts",

packages/audit/package.json

@@ -6,7 +6,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/auth/package.json

@@ -6,7 +6,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/browser-protocol/package.json

@@ -6,7 +6,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/db/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/desktop-bridge/package.json

@@ -6,7 +6,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/emcn/package.json

@@ -9,7 +9,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/logger/package.json

@@ -6,7 +6,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/platform-authz/package.json

@@ -6,7 +6,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/realtime-protocol/package.json

@@ -6,7 +6,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/runtime-secrets/package.json

@@ -6,7 +6,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/security/package.json

@@ -6,7 +6,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/terminal-protocol/package.json

@@ -6,7 +6,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/testing/package.json

@@ -8,7 +8,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/workflow-persistence/package.json

@@ -6,7 +6,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/workflow-renderer/package.json

@@ -9,7 +9,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {

packages/workflow-types/package.json

@@ -6,7 +6,7 @@
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.0",
     "node": ">=20.0.0"
   },
   "exports": {