chore: pin bun to an exact version above the known-bad range

Bun's node:http client occasionally drops the terminating chunk of an empty
chunked HTTP response. When that happens a ClickHouse read never completes,
and the client's request_timeout cannot rescue it: that timeout is implemented
with socket.setTimeout, which Bun's node:http client ignores. The call hangs
forever rather than failing.

Measured against a real clickhouse-server:24.8 with bursts of zero-row queries
through @clickhouse/client: about 1% of bursts hang on 1.3.9, and none on
1.3.12 or later (0 in 16000 queries on both 1.3.12 and 1.3.14). This is what
had been intermittently hanging the ClickHouse schema integration tests in CI
at bun's 5000ms per-test timeout.

CI already ran 1.3.12 and was therefore already unaffected, but nothing said
that the pin was load-bearing, and the other pins had drifted: publish.yml was
still on 1.3.9, the images used the floating oven/bun:1.3 tag, and the research
compose file ran the archive forwarder on bun 1.2. The runtime version of the
service that reads and writes ClickHouse continuously was consequently decided
by image build date.

Pin every workflow and image to 1.3.14 — the newest 1.3.x, which is what the
floating tag resolves to today, so no image is downgraded — and state the
constraint at each pin site, since it is invisible from the code.

Verified: 30 consecutive runs of the ClickHouse schema integration suite on
1.3.14 against a persistent instance, all green; oven/bun:1.3.14 pulls and
runs; every touched YAML parses; bun run check, check:server-lines and
typecheck:sidecar all pass.

Author: outerlook

.github/workflows/archive-live-smoke.yml

@@ -21,7 +21,13 @@ jobs:
       - name: Install Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: 1.3.12
+          # Pinned, not floating: bun <= 1.3.9 can drop the terminating chunk of
+          # an empty chunked HTTP response, which hangs a ClickHouse read
+          # forever. request_timeout cannot rescue it — the client implements
+          # that with socket.setTimeout, which Bun's node:http client ignores.
+          # Measured at ~1% of query bursts on 1.3.9 and zero on 1.3.12 and
+          # later, so keep this at 1.3.12 or above.
+          bun-version: 1.3.14
 
       - name: Install dependencies
         run: bun install

.github/workflows/ci.yml

@@ -35,7 +35,13 @@ jobs:
       - name: Install Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: 1.3.12
+          # Pinned, not floating: bun <= 1.3.9 can drop the terminating chunk of
+          # an empty chunked HTTP response, which hangs a ClickHouse read
+          # forever. request_timeout cannot rescue it — the client implements
+          # that with socket.setTimeout, which Bun's node:http client ignores.
+          # Measured at ~1% of query bursts on 1.3.9 and zero on 1.3.12 and
+          # later, so keep this at 1.3.12 or above.
+          bun-version: 1.3.14
 
       - name: Install dependencies
         run: bun install

.github/workflows/publish.yml

@@ -35,7 +35,13 @@ jobs:
       - name: Install Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: 1.3.9
+          # Pinned, not floating: bun <= 1.3.9 can drop the terminating chunk of
+          # an empty chunked HTTP response, which hangs a ClickHouse read
+          # forever. request_timeout cannot rescue it — the client implements
+          # that with socket.setTimeout, which Bun's node:http client ignores.
+          # Measured at ~1% of query bursts on 1.3.9 and zero on 1.3.12 and
+          # later, so keep this at 1.3.12 or above.
+          bun-version: 1.3.14
 
       - name: Setup Node.js for npm publishing
         uses: actions/setup-node@v4

.sandbox/Dockerfile

@@ -1,4 +1,10 @@
-FROM oven/bun:1.3
+# Pinned to an exact patch, not the floating 1.3 tag: bun <= 1.3.9 can drop the
+# terminating chunk of an empty chunked HTTP response, which hangs a ClickHouse
+# read forever. request_timeout cannot rescue it — the client implements that
+# with socket.setTimeout, which Bun's node:http client ignores. Measured at ~1%
+# of query bursts on 1.3.9 and zero on 1.3.12 and later, so keep this at 1.3.12
+# or above.
+FROM oven/bun:1.3.14
 
 WORKDIR /app
 

Dockerfile

@@ -1,4 +1,10 @@
-FROM oven/bun:1.3
+# Pinned to an exact patch, not the floating 1.3 tag: bun <= 1.3.9 can drop the
+# terminating chunk of an empty chunked HTTP response, which hangs a ClickHouse
+# read forever. request_timeout cannot rescue it — the client implements that
+# with socket.setTimeout, which Bun's node:http client ignores. Measured at ~1%
+# of query bursts on 1.3.9 and zero on 1.3.12 and later, so keep this at 1.3.12
+# or above.
+FROM oven/bun:1.3.14
 
 WORKDIR /app
 

docker/clickhouse-research.compose.yml

@@ -20,7 +20,10 @@ services:
   # host `bun install`. For a standalone prod image build
   # services/archive-forwarder/Dockerfile instead (self-contained, no mount).
   archive-forwarder:
-    image: oven/bun:1.2
+    # Same bun floor as the production images: bun <= 1.3.9 can drop the
+    # terminating chunk of an empty chunked HTTP response and hang a ClickHouse
+    # read forever, and this runs the real forwarder against ClickHouse.
+    image: oven/bun:1.3.14
     container_name: cex-broker-archive-forwarder
     working_dir: /app
     command: ["bun", "run", "services/archive-forwarder/index.ts"]

services/archive-forwarder/Dockerfile

@@ -5,7 +5,14 @@
 #
 # Build from the repository ROOT so the schema/ directory is in the build context:
 #   docker build -f services/archive-forwarder/Dockerfile -t cex-broker-archive-forwarder .
-FROM oven/bun:1.3
+# Pinned to an exact patch, not the floating 1.3 tag: bun <= 1.3.9 can drop the
+# terminating chunk of an empty chunked HTTP response, which hangs a ClickHouse
+# read forever. request_timeout cannot rescue it — the client implements that
+# with socket.setTimeout, which Bun's node:http client ignores. This service
+# reads and writes ClickHouse continuously, so it is the most exposed. Measured
+# at ~1% of query bursts on 1.3.9 and zero on 1.3.12 and later, so keep this at
+# 1.3.12 or above.
+FROM oven/bun:1.3.14
 
 WORKDIR /app
 

services/ohlcv-collector/Dockerfile

@@ -9,7 +9,13 @@
 # Set CEX_BROKER_URL=host:port and mount the canonical feed configuration named
 # by CEX_BROKER_MARKET_DATA_COLLECTOR_CONFIG. The legacy OHLCV array variable is
 # retained for compatibility.
-FROM oven/bun:1.3
+# Pinned to an exact patch, not the floating 1.3 tag: bun <= 1.3.9 can drop the
+# terminating chunk of an empty chunked HTTP response, which hangs a ClickHouse
+# read forever. request_timeout cannot rescue it — the client implements that
+# with socket.setTimeout, which Bun's node:http client ignores. Measured at ~1%
+# of query bursts on 1.3.9 and zero on 1.3.12 and later, so keep this at 1.3.12
+# or above.
+FROM oven/bun:1.3.14
 
 WORKDIR /app