2.5.0

What's Changed

New Features

• BUILD-13251: Add the config-bun action, which points Bun at the Repox registry selected by repox-url (SaaS on GitHub-hosted runners, production Edge on self-hosted runners), exports BUN_CONFIG_REGISTRY, BUN_CONFIG_TOKEN, ARTIFACTORY_USERNAME and ARTIFACTORY_ACCESS_TOKEN from the matching Vault reader, and caches ~/.bun/install/cache, by @hedinasr in #369

Dependency Updates

Package	Update	Change
Node.js (repository mise tooling)	patch	24.15.0 → 24.22.1 (#370)

• BUILD-13224: Use the Node.js release patched for CVE-2026-111497 in the repository's mise.toml by @SamirM-BE in #370

---

config-bun does not modify bun.lock. Bun downloads locked packages from the absolute tarball URLs written in bun.lock, so commit a lockfile resolved through the same Repox as repox-url. See the config-bun README section.

permissions:
  id-token: write
steps:
  - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
  - uses: step-security/mise-action@a225bbd7c202ddf57dd76dff22bb7992f6314173 # v5.1.2
  - uses: SonarSource/ci-github-actions/config-bun@v2
  - run: bun ci

Full Changelog: 2.4.2...2.5.0