chore(release): bump version to 1.26.19 to rebuild binaries on Bun 1.4.4
Bun 1.4.4 drops emSign ECC Root CA - G3 from its bundled root store, after the eMudhra intermediate CA compromise (https://emudhra.we-have-a-problem.com/). The standalone binaries embed the Bun runtime, so they keep the old store until they are rebuilt.
This bumps the version to 1.26.19 so Release Binaries cuts a new release. oven-sh/setup-bun@v2 has no version pin there, so the build picks up Bun 1.4.4. There are no code changes.
Canary: Bun's fetch inside each binary (BUN_BE_BUN=1, debian:trixie-slim with the patched ca-certificates), against 6 hosts chaining to emSign ECC Root CA - G3, 6 chaining to Comodo AAA Services root, and 4 controls.
| binary | Bun | emSign trusted | AAA trusted |
|---|---|---|---|
| released v1.26.18 linux-x64 | 1.4.3 | 6/6 | 0/6 |
this branch, bun build --compile --target=bun-linux-x64 | 1.4.4 | 0/6 | 0/6 |
Controls (example.com, www.google.com, github.com, sectigo.com) pass on both.
Summary by cubic
Bumps the version to 1.26.19 so the release pipeline rebuilds the standalone binaries on Bun 1.4.4. Bun 1.4.4 drops the compromised emSign ECC Root CA - G3 from its root store, which previous binaries still trust because they embed the Bun runtime. No code changes.