[RobertoVillegas]

The v1 self-host image (ghcr.io/usefulsoftwareco/executor-selfhost:latest, last published 2026-09-18) runs Bun 1.3.11. Every Bun release before 1.4.4 ships the Brotli decoder without the fix for CVE-2026-111497, the out-of-bounds write Node.js patched in its 2026-10-21 security release (oven-sh/bun#46352, fixed in oven-sh/bun#46392). Bun reaches that decoder by default from fetch() on any Content-Encoding: br response, so the self-host server is exposed whenever an upstream it calls (an OpenAPI source, an MCP server) returns attacker-controlled Brotli data. Bun 1.4.4 also drops the distrusted emSign ECC Root CA – G3 from its bundled roots.

This bumps both Bun stages in apps/host-selfhost/Dockerfile to oven/bun:1.4.4, pinned by digest like before. The runtime stage copies bun from prod-deps, so the shipped binary moves to 1.4.4. Toolchain pins (packageManager, workflow bun-version) are left alone to keep this to the image.

v2's self-host image isn't affected: Bun only runs at build time there and the runtime is workerd plus the Go host.

Verification

• docker build -f apps/host-selfhost/Dockerfile . succeeds; bun install --frozen-lockfile accepts the existing lockfile under 1.4.4.
• The container reaches healthy, GET / returns 200, /api/health returns {"status":"ok"}, and bun --version inside it reports 1.4.4 (38afee6c8).
• apps/host-selfhost tests: 26 files, 158 tests pass locally (vitest runs on Node, so this checks the app rather than the Bun bump).

CI skips fork PRs, so none of this has run in CI. Shipping it also needs a manual publish-selfhost-docker run, which hasn't happened since 2026-09-18.