[mogery]

Bun 1.4.4 drops emSign ECC Root CA - G3 from its bundled root store, after the eMudhra intermediate CA compromise (https://emudhra.we-have-a-problem.com/). The standalone binaries embed the Bun runtime, so they keep the old store until they are rebuilt.

This bumps the version to 1.26.19 so Release Binaries cuts a new release. oven-sh/setup-bun@v2 has no version pin there, so the build picks up Bun 1.4.4. There are no code changes.

Canary: Bun's fetch inside each binary (BUN_BE_BUN=1, debian:trixie-slim with the patched ca-certificates), against 6 hosts chaining to emSign ECC Root CA - G3, 6 chaining to Comodo AAA Services root, and 4 controls.

binary	Bun	emSign trusted	AAA trusted
released v1.26.18 linux-x64	1.4.3	6/6	0/6
this branch, bun build --compile --target=bun-linux-x64	1.4.4	0/6	0/6

Controls (example.com, www.google.com, github.com, sectigo.com) pass on both.

---

Summary by cubic

Bumps the version to 1.26.19 so the release pipeline rebuilds the standalone binaries on Bun 1.4.4. Bun 1.4.4 drops the compromised emSign ECC Root CA - G3 from its root store, which previous binaries still trust because they embed the Bun runtime. No code changes.

^{Written for commit d638097. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would require human review. Version bump to 1.26.19 cuts a new release of the standalone binaries rebuilt on Bun 1.4.4, which drops the compromised emSign root CA from the trust store. Releasing this security/trust-store change to all users needs human sign-off.
Tip: Get a Slack DM when cubic finishes reviewing your PRs. Connect Slack

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[capy-ai]

Closing as superseded by v1.26.20. #342 bumped main to 1.26.20, and Release Binaries built that release with oven-sh/setup-bun@v2, which installed Bun 1.4.4. Bun 1.4.4 is the release whose bundled root store drops the compromised emSign roots.

Canary on the released firecrawl-linux-x64 binary, run with BUN_BE_BUN=1 against 6 test hosts chained to the emSign roots and 6 chained to Comodo AAA, once with the system store disabled and once with it enabled:

Binary	Embedded Bun	emSign trusted	AAA trusted	Controls
v1.26.18	1.4.3	6/6	0/6	4/4 OK
v1.26.20	1.4.4	0/6 (CERT_REVOKED)	0/6	4/4 OK

The tarball tested matches the release asset digest sha256:f9af2223f718b6cf37f09e8e9623e79d3a35d37770c6bbd97889888a16fb199a. No further CLI release is needed for this fix.