chore: upgrade Bun to 1.4.1

[jgoux]

Summary

• pin Bun 1.4.1 through mise and refresh the locked runtime artifacts
• replace the Istanbul Vitest coverage provider with the V8 provider across coverage-enabled workspaces
• remove the unused coverage provider from the CLI e2e workspace and preserve pnpm global-store peer resolution

Bun 1.4.1 fixes the Vitest/c8 V8 coverage merge failure that previously blocked this migration.

Binary size impact

Compared locally built Bun 1.4.1 executables with the checksum-verified v2.117.0-beta.18 production artifacts, which embed Bun 1.4.0.

Platform	Production 1.4.0	Local 1.4.1	Change
macOS arm64	69.52 MiB	67.53 MiB	-2.86%
macOS x64	76.00 MiB	74.20 MiB	-2.37%
Linux arm64	91.92 MiB	90.36 MiB	-1.70%
Linux x64	92.58 MiB	91.01 MiB	-1.69%
Windows arm64	84.50 MiB	83.17 MiB	-1.57%
Windows x64	94.52 MiB	91.54 MiB	-3.16%

The compressed release archives are also 0.37%-1.54% smaller.

The comparison is not fully runtime-isolated: the current source is one commit beyond the production tag, and the local macOS binaries lack CI release signing. Linux and Windows provide the cleanest indication of the Bun upgrade size impact.

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@1a5676cabda3649302d94194deb0bad447e6df34

Preview package for commit 1a5676c.

[github-actions]

🤖 AI Review

All three Claude findings were verified; Codex reported none. The CI coverage-validation gap is confirmed, the root Vite dependency concern remains uncertain, and the lockfile-variant concern is refuted as normal optional-peer resolution.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	package.json:43	dependencies	claude	The root vite dependency is unreferenced by root source and undocumented as peer-resolution plumbing, making it vulnerable to unused-dependency cleanup that could break Vitest consumers.
🟡 MINOR	apps/cli/vitest.config.ts:40	test-coverage	claude	CI does not validate that the new V8 provider produces nonempty or adequate coverage, so a silent coverage regression can pass.

Refuted findings (kept for transparency, not posted as review comments)

• pnpm-lock.yaml:465 (dependencies): The regenerated lockfile introduces an anomalous third Vitest/coverage peer variant without @<!---->types/node, suggesting duplicate installation or incremental lockfile drift.
  Refuted: pnpm-lock.yaml:6434-6463 declares both @<!---->types/node and coverage providers as optional Vitest peers. The variant at :12707 still resolves Vite and coverage at :12727-12730, and Vite itself resolves its available optional peers at :12637-12649. The trusted base lockfile already uses shortened peer suffixes whose dependency edges resolve fuller Vite snapshots, so this is normal pnpm peer-context encoding rather than evidence of corruption.

Stats

Claude findings: 3 · Codex findings: 0 · Confirmed: 1 · Refuted: 1 · Uncertain: 1

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.