chore(deps): refresh Next React and patch dependency security fixes

.changeset/bun-1-4-4-toolchain.md

@@ -0,0 +1,4 @@
+---
+---
+
+Bump the Bun toolchain to 1.4.4 (CVE-2026-111497). No package release.

.devcontainer/Dockerfile

@@ -1,8 +1,8 @@
-FROM oven/bun:1.3.14 AS bun-runtime
+FROM oven/bun:1.4.4 AS bun-runtime
 
 FROM node:24.18.0-bookworm-slim
 
-ARG BUN_VERSION=1.3.14
+ARG BUN_VERSION=1.4.4
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 

.devcontainer/README.md

@@ -1,6 +1,6 @@
 # Schema Stream development container
 
-This container pins Node.js 24.18.0 and Bun 1.3.14, installs the lockfile with
+This container pins Node.js 24.18.0 and Bun 1.4.4, installs the lockfile with
 `bun install --frozen-lockfile`, and forwards the WebSocket example on port 3400. It works with
 GitHub Codespaces or a local editor that supports the Development Container specification.
 

.devcontainer/devcontainer.json

@@ -4,7 +4,7 @@
     "context": "..",
     "dockerfile": "Dockerfile",
     "args": {
-      "BUN_VERSION": "1.3.14"
+      "BUN_VERSION": "1.4.4"
     }
   },
   "containerEnv": {

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.4
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -78,7 +78,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.4
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/live-e2e.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.4
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/publish.yml

@@ -37,7 +37,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.4
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/release-pr.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.4
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

AGENTS.md

@@ -13,7 +13,7 @@ Schema Stream is a small, public, standalone TypeScript library for progressivel
 
 Use the versions declared by the repository:
 
-- `mise install` provisions Bun 1.3.14 and Node.js 24.
+- `mise install` provisions Bun 1.4.4 and Node.js 24.
 - `bun install` installs dependencies from `bun.lock`.
 - TypeScript 7 is the authoritative development compiler.
 - Published declarations must remain consumable by supported TypeScript 5.x projects; `bun run test:packed` verifies this with TypeScript 5.9.

CONTRIBUTING.md

@@ -12,7 +12,7 @@ mise install
 bun install
 ```
 
-The repository develops with Bun 1.3.14, Node.js 24, and TypeScript 7. Consumers do not need
+The repository develops with Bun 1.4.4, Node.js 24, and TypeScript 7. Consumers do not need
 TypeScript 7; the packed-package test verifies the published declarations with TypeScript 5.9.
 
 ## Development checks

README.md

@@ -250,9 +250,9 @@ Some pinned Mastra/provider combinations currently expose direct structured JSON
 `textStream` because the schema is forwarded as the model's response format. That behavior is not
 Mastra's public cross-provider contract. The repository's [executable Mastra compatibility
 example](./examples/mastra.ts) guards the stream before passing it to SchemaStream, and the weekly
-live test verifies `@mastra/core@1.50.1` with `openai/gpt-5.6-luna`. This optional lane provides
-SchemaStream's incomplete-string updates, completion events, and snapshot policies, while failing
-closed if an upstream version begins emitting prose.
+live test verifies the installed `@mastra/core` version with `openai/gpt-5.6-luna`. This optional
+lane provides SchemaStream's incomplete-string updates, completion events, and snapshot policies,
+while failing closed if an upstream version begins emitting prose.
 
 The repository runs credential-free runtime integrations against all three surfaces and provides
 an opt-in live-provider matrix for the OpenAI Agents SDK, Mastra, and Vercel AI SDK with varied
@@ -333,7 +333,7 @@ bun run docs:build
 bun run check
 ```
 
-`mise.toml` pins Bun 1.3.14 and the current Node 24 release. Maintainers type-check and emit
+`mise.toml` pins Bun 1.4.4 and the current Node 24 release. Maintainers type-check and emit
 declarations with TypeScript 7.0.2. TypeScript is a development-only dependency, so installing
 `schema-stream` does not install or require TypeScript 7.