diff --git a/.github/docker/Dockerfile.ci b/.github/docker/Dockerfile.ci
index b0befb3a0..97b5b6b55 100644
--- a/.github/docker/Dockerfile.ci
+++ b/.github/docker/Dockerfile.ci
@@ -103,11 +103,11 @@ RUN curl --retry 5 --retry-delay 5 --retry-connrefused -fsSL "https://nodejs.org
 # Hashes come from the release's SHASUMS256.txt. The image builds linux/amd64
 # only (the Node.js tarball above is linux-x64); an architecture without a
 # verified archive fails here. test/ci-image-cli-pin.test.ts pins this shape.
-ARG BUN_VERSION=1.4.0
+ARG BUN_VERSION=1.4.2
 ARG TARGETARCH
 ENV BUN_INSTALL="/usr/local"
 RUN case "${TARGETARCH:-amd64}" in \
-      amd64) bun_target=linux-x64; bun_sha256=2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452 ;; \
+      amd64) bun_target=linux-x64; bun_sha256=36368faef7527875d5ffa52e53cd48021741f2a83eb6208a8dd64068d422a913 ;; \
       *) echo "Dockerfile.ci: no verified Bun ${BUN_VERSION} archive for ${TARGETARCH}" >&2; exit 1 ;; \
     esac \
     && curl --retry 5 --retry-delay 5 --retry-connrefused -fsSL \
diff --git a/.github/scripts/dia-launch-driver.mjs b/.github/scripts/dia-launch-driver.mjs
index 028076148..ef4538f3b 100644
--- a/.github/scripts/dia-launch-driver.mjs
+++ b/.github/scripts/dia-launch-driver.mjs
@@ -46,7 +46,7 @@ export function compareDiaLaunchReceipts(left, right) {
       || qualification.isolation?.sharedRegisteredHome !== true || qualification.artifact?.signatureVerified !== true
       || qualification.artifact?.gatekeeperNotarized !== true || qualification.artifact?.macosCompatibility?.compatible !== true
       || qualification.platform?.os !== 'darwin' || qualification.platform?.architecture !== 'arm64'
-      || qualification.platform?.bun !== '1.4.0' || qualification.platform?.playwright !== '1.62.1'
+      || qualification.platform?.bun !== '1.4.2' || qualification.platform?.playwright !== '1.62.1'
       || !/^\d+(?:\.\d+){1,2}$/.test(qualification.artifact.macosCompatibility.hostVersion)
       || qualification.artifact?.architectures?.includes('arm64') !== true
       || ['serviceStopped', 'userDomainStopped', 'userProcessesStopped', 'accountRemoved', 'groupRemoved', 'stagingRemoved'].some(key => receipt.launcherCleanup?.[key] !== true)
@@ -63,7 +63,7 @@ export function compareDiaLaunchReceipts(left, right) {
         || policy?.mockKeychainFlag !== false || policy?.passwordStoreFlag !== false || policy?.firstRunSuppressed !== false
         || policy?.headlessFlag !== true || policy?.expectedProfile !== true || policy?.detached !== true || policy?.shellDisabled !== true
         || policy?.stdioCount !== 5 || policy?.extraPipeDescriptors !== true || policy?.profileArgumentCount !== 1
-        || result.driver?.runtime !== runtime || result.driver?.version !== (runtime === 'bun' ? '1.4.0' : '24.18.0')
+        || result.driver?.runtime !== runtime || result.driver?.version !== (runtime === 'bun' ? '1.4.2' : '24.18.0')
         || result.driver?.os !== 'darwin' || result.driver?.architecture !== 'arm64' || result.driver?.playwright !== '1.62.1'
         || result.driver?.release !== qualification.platform.release
         || result.driver?.executableSha256 !== config.executableSha256 || result.driver?.driverSha256 !== config.driverSha256
@@ -176,7 +176,7 @@ async function main() {
   const account = readFreshAccountConfiguration(process.argv[2], 'comparison-driver');
   const config = account.launchComparison;
   const runtimeVersion = process.versions.bun ?? process.versions.node;
-  if ((config.runtime === 'bun' ? process.versions.bun !== '1.4.0' : Boolean(process.versions.bun) || runtimeVersion !== '24.18.0')
+  if ((config.runtime === 'bun' ? process.versions.bun !== '1.4.2' : Boolean(process.versions.bun) || runtimeVersion !== '24.18.0')
     || process.arch !== 'arm64' || require('playwright/package.json').version !== '1.62.1') throw new Error('invalid_driver_runtime');
   if (await sha256(process.execPath) !== config.executableSha256 || await sha256(import.meta.filename) !== config.driverSha256
     || await sha256(path.join(import.meta.dirname, 'qualify-dia-macos.ts')) !== config.helpersSha256) throw new Error('driver_inputs_changed');
diff --git a/.github/scripts/qualify-dia-macos.ts b/.github/scripts/qualify-dia-macos.ts
index cdaaa3124..b5fc3b9e3 100644
--- a/.github/scripts/qualify-dia-macos.ts
+++ b/.github/scripts/qualify-dia-macos.ts
@@ -179,7 +179,7 @@ export async function runDiaLaunchComparison(account: FreshAccount, purpose: 'co
       'argvSha256', 'environmentSha256', 'rootCount', 'launchAttempts', 'rootsBeforeCleanup', 'stderrBeforeCleanup', 'stderrAfterCleanup', 'rootsAfterCleanup', 'driver'];
     if (!response || !safeDiaComparisonResponse(response) || Object.keys(response).some(key => !keys.includes(key)) || response.protocol !== 1 || response.purpose !== purpose
       || response.samplingEnabled !== false || response.driver?.runtime !== config.runtime
-      || response.driver?.version !== (config.runtime === 'bun' ? '1.4.0' : '24.18.0') || response.driver?.architecture !== 'arm64'
+      || response.driver?.version !== (config.runtime === 'bun' ? '1.4.2' : '24.18.0') || response.driver?.architecture !== 'arm64'
       || response.driver?.os !== 'darwin' || response.driver?.playwright !== '1.62.1'
       || response.driver?.executableSha256 !== config.executableSha256 || response.driver?.driverSha256 !== config.driverSha256
       || response.driver?.helpersSha256 !== config.helpersSha256 || typeof response.ready !== 'boolean'
@@ -931,7 +931,7 @@ export async function qualifyDia(isolation: { root: string; configFile: string }
   validateQualificationHost(process.env);
   const account = readFreshAccountConfiguration(isolation.configFile);
   if (account.guiReadiness || !account.destinationExecutable || !account.destinationSha256) throw new Error('browser_qualification_authority_required');
-  if (Bun.version !== '1.4.0' || require('playwright/package.json').version !== '1.62.1') throw new Error('pinned_runtimes_required');
+  if (Bun.version !== '1.4.2' || require('playwright/package.json').version !== '1.62.1') throw new Error('pinned_runtimes_required');
   const runnerTemp = realpathSync(process.env.RUNNER_TEMP!);
   const output = path.join(runnerTemp, 'dia-native-qualification.json');
   if (existsSync(output)) throw new Error('fresh_receipt_path_required');
@@ -1383,7 +1383,7 @@ if (import.meta.main) {
       if (process.argv[2] !== '--fresh-account' || !process.argv[3]) throw new Error('fresh_account_configuration_required');
       const account = readFreshAccountConfiguration(process.argv[3]);
       if (account.guiReadiness) throw new Error('browser_qualification_authority_required');
-      if (Bun.version !== '1.4.0' || require('playwright/package.json').version !== '1.62.1') throw new Error('pinned_runtimes_required');
+      if (Bun.version !== '1.4.2' || require('playwright/package.json').version !== '1.62.1') throw new Error('pinned_runtimes_required');
       const originalHome = account.home;
       const originalHomeEnvironment = process.env.HOME;
       const runnerTemp = realpathSync(process.env.RUNNER_TEMP!);
diff --git a/.github/scripts/run-dia-native-qualification.ts b/.github/scripts/run-dia-native-qualification.ts
index f93c76d62..95236b1f9 100644
--- a/.github/scripts/run-dia-native-qualification.ts
+++ b/.github/scripts/run-dia-native-qualification.ts
@@ -406,7 +406,7 @@ async function freshWorker(configFile: string) {
     if (await digest(account.bun) !== account.bunSha256 || await digest(account.destinationExecutable) !== account.destinationSha256) throw new Error('staged_executable_changed');
     receipt.reason = 'fresh_dependency_install';
     run(account.bun, ['install', '--frozen-lockfile', '--ignore-scripts'], 180_000);
-    if (Bun.version !== '1.4.0' || require(path.join(account.snapshot, 'node_modules/playwright/package.json')).version !== '1.62.1') throw new Error('pinned_runtime_mismatch');
+    if (Bun.version !== '1.4.2' || require(path.join(account.snapshot, 'node_modules/playwright/package.json')).version !== '1.62.1') throw new Error('pinned_runtime_mismatch');
     mkdirSync(probe, { mode: 0o700 });
     receipt.reason = 'background_keychain_preflight';
     snapshot = captureUserKeychains(env, [account.home, account.temporary]);
@@ -538,7 +538,7 @@ export async function runFreshAccountQualification(comparisonRuntime?: 'bun' | '
   validateQualificationHost(process.env);
   if (comparisonRuntime !== undefined && !['bun', 'node'].includes(comparisonRuntime)) throw new Error('invalid_comparison_runtime');
   if (guiReadinessOnly && comparisonRuntime !== undefined) throw new Error('conflicting_diagnostic_modes');
-  if (process.getuid?.() === 0 || Bun.version !== '1.4.0') throw new Error('run_as_unprivileged_pinned_ci_runner');
+  if (process.getuid?.() === 0 || Bun.version !== '1.4.2') throw new Error('run_as_unprivileged_pinned_ci_runner');
   const outputRoot = realpathSync(process.env.RUNNER_TEMP!);
   const output = path.join(outputRoot, 'dia-native-qualification.json');
   if (existsSync(output)) throw new Error('fresh_output_required');
diff --git a/.github/workflows/arm-setup-smoke.yml b/.github/workflows/arm-setup-smoke.yml
index 0c5ec0284..014e9c513 100644
--- a/.github/workflows/arm-setup-smoke.yml
+++ b/.github/workflows/arm-setup-smoke.yml
@@ -30,13 +30,13 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Seal the checked-out source and native toolchain
         shell: bash
         run: |
           set -euo pipefail
           test "$(uname -m)" = aarch64
-          test "$(bun --version)" = 1.4.0
+          test "$(bun --version)" = 1.4.2
           test "$(bun -p 'process.arch')" = arm64
           test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
           mkdir -p "$RUNNER_TEMP/arm-input" "$RUNNER_TEMP/arm-evidence"
@@ -76,8 +76,8 @@ jobs:
           apt-get install -y --no-install-recommends ca-certificates git nodejs npm fonts-noto-color-emoji
           install -m 0755 /input/bun /usr/local/bin/bun
           ln -s bun /usr/local/bin/bunx
-          test "$(bun --version)" = 1.4.0
-          test "$(bunx --version)" = 1.4.0
+          test "$(bun --version)" = 1.4.2
+          test "$(bunx --version)" = 1.4.2
           test "$(bun -p 'process.arch')" = arm64
           test "$(node -p 'process.arch')" = arm64
           node --version
diff --git a/.github/workflows/cso-runtime-images.yml b/.github/workflows/cso-runtime-images.yml
index 6505a1910..306050b74 100644
--- a/.github/workflows/cso-runtime-images.yml
+++ b/.github/workflows/cso-runtime-images.yml
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Validate committed image digests and complete platform matrix
         id: inputs
         run: |
@@ -69,7 +69,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e
       - name: Require native Docker and verify reviewed source manifests
         env:
@@ -144,7 +144,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Require the declared native architecture and Docker daemon
         env:
           CSO_ARCH: ${{ matrix.arch }}
@@ -307,7 +307,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: cso-staged-${{ matrix.stack }}-${{ matrix.arch }}
diff --git a/.github/workflows/cso-runtime-promote.yml b/.github/workflows/cso-runtime-promote.yml
index 5a012ec19..63972ccdd 100644
--- a/.github/workflows/cso-runtime-promote.yml
+++ b/.github/workflows/cso-runtime-promote.yml
@@ -41,7 +41,7 @@ jobs:
           persist-credentials: true
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Authenticate the completed qualification run
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/cso-runtime-qualification.yml b/.github/workflows/cso-runtime-qualification.yml
index 3f90d4ee8..d86c22b23 100644
--- a/.github/workflows/cso-runtime-qualification.yml
+++ b/.github/workflows/cso-runtime-qualification.yml
@@ -67,7 +67,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Require the configured private-evaluator actor
         env:
           CSO_QUALIFICATION_ACTOR: ${{ vars.CSO_QUALIFICATION_ACTOR }}
diff --git a/.github/workflows/cso-scanner-images.yml b/.github/workflows/cso-scanner-images.yml
index 2d7a172e2..ab305e5fa 100644
--- a/.github/workflows/cso-scanner-images.yml
+++ b/.github/workflows/cso-scanner-images.yml
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Prove scanner normalization and fail-closed behavior
         run: |
           set -eu
@@ -64,7 +64,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Require native Docker and the declared architecture
         env:
           CSO_ARCH: ${{ matrix.arch }}
@@ -288,7 +288,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: cso-scanner-profile-*
@@ -328,7 +328,7 @@ jobs:
           persist-credentials: true
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: cso-scanner-catalog-proposal
diff --git a/.github/workflows/evals-marathon.yml b/.github/workflows/evals-marathon.yml
index e746f18de..565c32d77 100644
--- a/.github/workflows/evals-marathon.yml
+++ b/.github/workflows/evals-marathon.yml
@@ -94,7 +94,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       # One marathon file per runner: a 1-second budget never packs two
       # recorded files together.
@@ -268,7 +268,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
diff --git a/.github/workflows/evals-periodic.yml b/.github/workflows/evals-periodic.yml
index 845d9411c..af95cb699 100644
--- a/.github/workflows/evals-periodic.yml
+++ b/.github/workflows/evals-periodic.yml
@@ -135,7 +135,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       - name: Emit run manifest (ALL periodic tests minus reasoned excludes)
         env:
@@ -587,7 +587,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
diff --git a/.github/workflows/evals.yml b/.github/workflows/evals.yml
index 6f196636b..9263e39ab 100644
--- a/.github/workflows/evals.yml
+++ b/.github/workflows/evals.yml
@@ -191,7 +191,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       - name: Restore this PR's verified judge and E2E results
         id: store
@@ -267,7 +267,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       # DX-1: a dispatch from scripts/eval-bg.ts names the revision it means
       # to test; a different checkout fails here before any paid work.
@@ -526,7 +526,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
diff --git a/.github/workflows/free-tests.yml b/.github/workflows/free-tests.yml
index 66bd911b6..33e04fae5 100644
--- a/.github/workflows/free-tests.yml
+++ b/.github/workflows/free-tests.yml
@@ -52,7 +52,7 @@ jobs:
           fetch-depth: 0
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - id: plan
         name: Inventory and balance the complete free suite
         # Warns in the job summary when more than 5 files are unseeded.
@@ -77,7 +77,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Install helper dependencies
         run: bun install --frozen-lockfile --ignore-scripts
       - name: Build and sign the native macOS startup boundary
@@ -112,7 +112,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Install dependencies
         run: bun install --frozen-lockfile --ignore-scripts
       - name: Build browser prerequisites
@@ -144,7 +144,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Install helper dependencies
         run: bun install --frozen-lockfile --ignore-scripts
       - name: Build the native Windows startup boundary from Git Bash
@@ -172,7 +172,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Require local Docker containment prerequisites
         # A missing daemon is a failed gate, never a skipped integration test.
         run: |
@@ -202,7 +202,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Install dependencies
         run: bun install --frozen-lockfile --ignore-scripts
       - name: Typecheck product code (zero errors)
@@ -227,7 +227,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
@@ -406,7 +406,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: free-plan
diff --git a/.github/workflows/make-pdf-gate.yml b/.github/workflows/make-pdf-gate.yml
index 75c5992f1..23ae86b66 100644
--- a/.github/workflows/make-pdf-gate.yml
+++ b/.github/workflows/make-pdf-gate.yml
@@ -53,7 +53,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/.github/workflows/native-qualification.yml b/.github/workflows/native-qualification.yml
index c1739c9db..23c63ef36 100644
--- a/.github/workflows/native-qualification.yml
+++ b/.github/workflows/native-qualification.yml
@@ -41,7 +41,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
           node-version: 24.18.0
@@ -70,7 +70,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
           node-version: 24.18.0
@@ -117,7 +117,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         if: inputs.mode == 'dia-launch-comparison'
         with:
diff --git a/.github/workflows/platform-qualification.yml b/.github/workflows/platform-qualification.yml
index e3e1782fb..5b8aa4d15 100644
--- a/.github/workflows/platform-qualification.yml
+++ b/.github/workflows/platform-qualification.yml
@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Install Chromium
@@ -56,7 +56,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Install gitleaks
@@ -78,7 +78,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Run Swift build invariants
diff --git a/.github/workflows/quality-gate.yml b/.github/workflows/quality-gate.yml
index 806c81bd8..2fa5475fa 100644
--- a/.github/workflows/quality-gate.yml
+++ b/.github/workflows/quality-gate.yml
@@ -44,7 +44,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       - name: Install frozen dependencies
         run: bun install --frozen-lockfile --ignore-scripts
diff --git a/.github/workflows/skill-docs.yml b/.github/workflows/skill-docs.yml
index 9a8124633..b9585bdfb 100644
--- a/.github/workflows/skill-docs.yml
+++ b/.github/workflows/skill-docs.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - run: bun install --frozen-lockfile
       # One generation pass for ALL 10 hosts. gen-skill-docs --host all
       # hard-fails on any per-host generation error (scripts/gen-skill-docs.ts
diff --git a/.github/workflows/test-health.yml b/.github/workflows/test-health.yml
index f09423cd3..5bb711963 100644
--- a/.github/workflows/test-health.yml
+++ b/.github/workflows/test-health.yml
@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
diff --git a/.github/workflows/version-gate.yml b/.github/workflows/version-gate.yml
index 3468fbd5f..05aad51f7 100644
--- a/.github/workflows/version-gate.yml
+++ b/.github/workflows/version-gate.yml
@@ -29,7 +29,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       - name: Read versions
         id: versions
diff --git a/.github/workflows/windows-free-tests.yml b/.github/workflows/windows-free-tests.yml
index f579fec47..0b8adec1d 100644
--- a/.github/workflows/windows-free-tests.yml
+++ b/.github/workflows/windows-free-tests.yml
@@ -51,7 +51,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - id: plan
         name: Curate and balance the Windows-safe free suite
         # Six shards: ~85 s of Linux-measured work each, ~2.5 min on a
@@ -82,7 +82,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
@@ -190,7 +190,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: windows-plan
@@ -213,7 +213,7 @@ jobs:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
           node-version: 24.18.0
diff --git a/.github/workflows/windows-setup-e2e.yml b/.github/workflows/windows-setup-e2e.yml
index 906598346..1216f6624 100644
--- a/.github/workflows/windows-setup-e2e.yml
+++ b/.github/workflows/windows-setup-e2e.yml
@@ -45,7 +45,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.2
 
       # Same lockfile-keyed install cache as windows-free-tests.yml (install
       # was 45s of a 64s job, all network).
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 4f9345feb..eb7735ac0 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -6,7 +6,7 @@ stages:
   - check
 
 variables:
-  BUN_VERSION: "1.4.0"
+  BUN_VERSION: "1.4.2"
 
 .setup-bun: &setup-bun
   - apt-get update -qq && apt-get install -qq -y curl jq git
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 642206e98..506350920 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -182,9 +182,9 @@ the new defaults.
 
 | I want to… | Command | Cost / time | Needs |
 |---|---|---|---|
-| Check an ordinary edit quickly | `bun run test:quick` | Free, about a minute | Bun 1.4.0 |
+| Check an ordinary edit quickly | `bun run test:quick` | Free, about a minute | Bun 1.4.2 |
 | Run one free test file while repairing | `bun test <file>` | Free, seconds | Never bare `bun test` for the suite |
-| Run full free acceptance before publishing | `bun run test` | Free, a few minutes | Bun 1.4.0 |
+| Run full free acceptance before publishing | `bun run test` | Free, a few minutes | Bun 1.4.2 |
 | Run the full free suite from a small machine | `bun run test:ubicloud` | Free suite on a billed 16-vCPU VM, about 5 minutes | `UBICLOUD_API_KEY` |
 | Run the curated Windows-safe subset | `bun run test:windows` (CI: six `windows-latest` jobs) | Free | Windows, Git Bash |
 | Refresh the Windows duration seed | `gh workflow run windows-free-tests.yml --ref <branch> -f record_durations=true`, then commit the `free-test-durations-windows` artifact | Free CI runners | Pushed branch, `gh` with workflow rights |
@@ -207,7 +207,7 @@ Old command names are listed under [Retired commands](#retired-commands).
 
 ### Setup
 
-Development and tests require Bun 1.4.0 or newer; CI pins and tests 1.4.0.
+Development and tests require Bun 1.4.2 or newer; CI pins and tests 1.4.2.
 Earlier Linux versions can close unrelated live file descriptors during
 subprocess garbage collection, causing intermittent browser and HTTP fixture
 failures ([upstream diagnosis](https://github.com/oven-sh/bun/issues/34785#issuecomment-5020318035)).
diff --git a/README.md b/README.md
index ef6621de5..d35450885 100644
--- a/README.md
+++ b/README.md
@@ -44,7 +44,7 @@ Fork it. Improve it. Make it yours. And if you want to hate on free open source
 
 `./setup` took 31 seconds after the clone on a 4-vCPU Linux cloud machine (v1.91.13.0, clean HOME, including the binary build and the Chromium download). Slower networks and laptops take longer.
 
-**Requirements:** [Claude Code](https://docs.anthropic.com/en/docs/claude-code), [Git](https://git-scm.com/), [Bun](https://bun.sh/) v1.4.0+ (the tested version; setup refuses Bun older than 1.3.3, which would let compiled tools read a project's `.env`, and warns in between), [Node.js](https://nodejs.org/) (Windows only). **Recommended on macOS:** the [Aside](https://aside.com) browser (macOS 15+) — browser skills, `/make-pdf`, and `/diagram` drive it first, with your real logged-in sessions. Without it, `./setup` builds gstack's own bundled browser and the same skills use that. `/cso` additionally needs a Bun release with all four `--no-compile-autoload-*` build flags plus a native toolchain: a static-capable C compiler on Linux, Xcode command-line tools on macOS, or Visual Studio 2022 Build Tools with Desktop development with C++ on Windows. If those are absent, setup installs everything else, removes stale CSO helpers, and `/cso` reports `not assessed` with the prerequisite.
+**Requirements:** [Claude Code](https://docs.anthropic.com/en/docs/claude-code), [Git](https://git-scm.com/), [Bun](https://bun.sh/) v1.4.2+ (the tested version; setup refuses Bun older than 1.3.3, which would let compiled tools read a project's `.env`, and warns in between), [Node.js](https://nodejs.org/) (Windows only). **Recommended on macOS:** the [Aside](https://aside.com) browser (macOS 15+) — browser skills, `/make-pdf`, and `/diagram` drive it first, with your real logged-in sessions. Without it, `./setup` builds gstack's own bundled browser and the same skills use that. `/cso` additionally needs a Bun release with all four `--no-compile-autoload-*` build flags plus a native toolchain: a static-capable C compiler on Linux, Xcode command-line tools on macOS, or Visual Studio 2022 Build Tools with Desktop development with C++ on Windows. If those are absent, setup installs everything else, removes stale CSO helpers, and `/cso` reports `not assessed` with the prerequisite.
 
 When qualified CSO runtime images are published, setup gives each automatic preload a 30-second window plus a bounded setup allowance for the declared catalog. For slower registries, set an integer such as `GSTACK_CSO_IMAGE_PULL_TIMEOUT_SECONDS=120` (accepted range: 5–300 seconds). One image timing out does not consume the remaining images' windows; setup reports partial progress and a later run resumes from exact digests already present in local Docker. The complete preload is capped at one hour.
 
diff --git a/TODOS.md b/TODOS.md
index 3756baad3..ebffbacf2 100644
--- a/TODOS.md
+++ b/TODOS.md
@@ -125,7 +125,7 @@ From the approved 2026-10 test/eval/CI audit plan; the audit PR files these.
 
 Deferred from the approved severe fix wave (docs/designs/SEVERE_FIX_WAVE_2026_10.md), each with its reason.
 
-- ~~**Enforce the Bun floor at setup (#2815)**~~ — done in v1.91.26.0: setup refuses Bun below 1.3.3 and warns below 1.4.0; auto-update and /gstack-upgrade check the incoming floor before moving the checkout. Original note: — `engines.bun` is now `>=1.4.0`
+- ~~**Enforce the Bun floor at setup (#2815)**~~ — done in v1.91.26.0: setup refuses Bun below 1.3.3 and warns below 1.4.2; auto-update and /gstack-upgrade check the incoming floor before moving the checkout. Original note: — `engines.bun` is now `>=1.4.0`
   (the CI pin), but Bun does not enforce `engines` and setup never checks the
   version. Bun older than 1.3.3 silently ignores `--no-compile-autoload-dotenv`
   and `--no-env-file` (verified with 1.3.2), so D0's protection against a
diff --git a/bin/gstack-bun-version.sh b/bin/gstack-bun-version.sh
index 2b50e8ea0..b7b8ccc5a 100644
--- a/bin/gstack-bun-version.sh
+++ b/bin/gstack-bun-version.sh
@@ -14,7 +14,7 @@
 # .env): Bun 1.3.2 loads it, 1.3.3 and 1.4.0 do not.
 # GSTACK_BUN_TESTED is the supported minimum: the CI pin and engines.bun.
 GSTACK_BUN_FLOOR="1.3.3"
-GSTACK_BUN_TESTED="1.4.0"
+GSTACK_BUN_TESTED="1.4.2"
 
 # _gstack_bun_parse <version> — sets _gb_core ("MAJOR MINOR PATCH" as decimal
 # integers) and _gb_pre (prerelease, may be empty); returns 1 when malformed.
diff --git a/browse/test/cookie-import-native-job.test.ts b/browse/test/cookie-import-native-job.test.ts
index de5c726ca..6b0431008 100644
--- a/browse/test/cookie-import-native-job.test.ts
+++ b/browse/test/cookie-import-native-job.test.ts
@@ -343,7 +343,7 @@ const request: NativeCookieRequest = {
   profile: 'Default',
   domains: ['example.test'],
   deadline: 25_000,
-  qualifiedBunVersions: ['1.4.0'],
+  qualifiedBunVersions: ['1.4.2'],
 };
 
 function kernelContract(mode: string) {
diff --git a/browse/test/cookie-import-native-qualification.ts b/browse/test/cookie-import-native-qualification.ts
index 950fcc39b..8c703c9fe 100644
--- a/browse/test/cookie-import-native-qualification.ts
+++ b/browse/test/cookie-import-native-qualification.ts
@@ -24,7 +24,7 @@ function incomplete(reason: string, diagnostic?: NativeCookieDiagnostic): never
   console.log(JSON.stringify({ ...receipt, artifactDirectory: output }));
   process.exit(2);
 }
-if (Bun.version !== '1.4.0') incomplete('bun_1_4_0_required');
+if (Bun.version !== '1.4.2') incomplete('bun_1_4_2_required');
 let emptyJob: NativeCookieJob | undefined;
 try {
   emptyJob = await createNativeCookieJob();
diff --git a/browse/test/dia-launch-comparison.test.ts b/browse/test/dia-launch-comparison.test.ts
index 871473c2a..cab823ae6 100644
--- a/browse/test/dia-launch-comparison.test.ts
+++ b/browse/test/dia-launch-comparison.test.ts
@@ -98,7 +98,7 @@ describe('diagnostic-only Dia runtime comparison', () => {
   const arm = (runtime: 'bun' | 'node', ready: boolean) => {
     const sha = 'a'.repeat(64);
     const config = { mode: 'launch-only', runtime, qualificationCredit: false, executableSha256: runtime === 'bun' ? sha : 'b'.repeat(64), driverSha256: sha, helpersSha256: sha };
-    const driver = { runtime, version: runtime === 'bun' ? '1.4.0' : '24.18.0', architecture: 'arm64', os: 'darwin', release: '24.6.0', playwright: '1.62.1',
+    const driver = { runtime, version: runtime === 'bun' ? '1.4.2' : '24.18.0', architecture: 'arm64', os: 'darwin', release: '24.6.0', playwright: '1.62.1',
       executableSha256: config.executableSha256, driverSha256: sha, helpersSha256: sha };
     const result = (purpose: string, success: boolean) => ({ protocol: 1, purpose, ready: success, launchReturned: success, protocolResponded: success,
       samplingEnabled: false, rootCount: 1, supervisor: { closed: true, exitCode: 0 }, cleanup: { confirmed: true, childClosed: true, groupAbsent: true, launchSettled: true,
@@ -112,7 +112,7 @@ describe('diagnostic-only Dia runtime comparison', () => {
       qualification: { launchComparison: { qualificationCredit: false, source: result('source', ready) }, counts: { pass: 0, fail: 0, skip: 0 },
         keychainStage: 'completed', isolation: { registeredIdentity: true, sharedRegisteredHome: true },
         cleanup: { ownedBrowsersStopped: true, sourceProfileRemoved: true, keychainRestored: true, mountDetached: true, fixtureRemoved: true },
-        platform: { os: 'darwin', architecture: 'arm64', bun: '1.4.0', playwright: '1.62.1', release: '24.6.0' },
+        platform: { os: 'darwin', architecture: 'arm64', bun: '1.4.2', playwright: '1.62.1', release: '24.6.0' },
         artifact: { signatureVerified: true, gatekeeperNotarized: true, macosCompatibility: { compatible: true, hostVersion: '15.7.9' },
           architectures: ['arm64'], sha256: sha, executableSha256: sha, version: '1.49.1', bundleId: 'company.thebrowser.dia', team: 'S6N382Y83G' } } };
   };
diff --git a/bun.lock b/bun.lock
index 42dd194ba..8cf207df2 100644
--- a/bun.lock
+++ b/bun.lock
@@ -17,7 +17,7 @@
       "devDependencies": {
         "@anthropic-ai/claude-agent-sdk": "0.2.117",
         "@anthropic-ai/sdk": "^0.78.0",
-        "@types/bun": "1.4.0",
+        "@types/bun": "1.4.2",
         "prettier": "3.9.9",
         "typescript": "7.0.2",
         "xterm": "^5.3.0",
@@ -176,7 +176,7 @@
 
     "@protobufjs/utf8": ["@protobufjs/utf8@1.1.2", "", {}, "sha512-b1UQwcEZ4yCnMCD8DAL1VlbvBJE9/IX4FTIp7BG1xYpf29SLazLSrqUkj4w7Y5y7cCVP6E5tcqqcI0xemPkHug=="],
 
-    "@types/bun": ["@types/bun@1.4.0", "", { "dependencies": { "bun-types": "1.4.0" } }, "sha512-K+lZULY23vRgK/CfTjFIV+tyifaNdSMlPh9j+6mQ/cLfpOznLyAuzgV/JQysyECpkBQLVMSyvjlr2fBUSA9wFQ=="],
+    "@types/bun": ["@types/bun@1.4.2", "", { "dependencies": { "bun-types": "1.4.2" } }, "sha512-GimotNn7+ZV0uVArItBbriZsR1oNf0+WTzPkdcFrzShI7k2norL0uzEaJT8T33dWr7O/c9ZDuAFQrctKCi72oQ=="],
 
     "@types/node": ["@types/node@26.4.0", "", { "dependencies": { "undici-types": "~8.3.0" } }, "sha512-faiGnoIrLH/V8cibOMEAZ8pMw6oXqSukl29ra4mN8GdaB2ZewzeaLj+INpV5N+Z1eKWzY+IzaIZH2EIR6YZRNQ=="],
 
@@ -234,7 +234,7 @@
 
     "browser-split": ["browser-split@0.0.1", "", {}, "sha512-JhvgRb2ihQhsljNda3BI8/UcRHVzrVwo3Q+P8vDtSiyobXuFpuZ9mq+MbRGMnC22CjW3RrfXdg6j6ITX8M+7Ow=="],
 
-    "bun-types": ["bun-types@1.4.0", "", { "dependencies": { "@types/node": "*" } }, "sha512-iIKw23BspnQQYd3prITOBxeUsxBHnwzX6YJfGMuNOZzeNcMmVqzIIVGRm1l69ogaPQmb4wB6BN8mA5bE9YuC5Q=="],
+    "bun-types": ["bun-types@1.4.2", "", { "dependencies": { "@types/node": "*" } }, "sha512-bxV1FgK7yBIzjRe5zBozIM4Bem11ZJcCXSrjWRG3YWLt8yFDePu4cLjpebO8OvPeIE9trbyPF4fuj3Cia4Fj3w=="],
 
     "bytes": ["bytes@3.1.2", "", {}, "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="],
 
diff --git a/docs/evals/census-red.md b/docs/evals/census-red.md
index 4b212b37b..a9620032d 100644
--- a/docs/evals/census-red.md
+++ b/docs/evals/census-red.md
@@ -16,7 +16,7 @@ Where the report is:
 
 ## Prerequisites
 
-- A checkout of the census branch with `bun install` done. Bun 1.4.0 is the
+- A checkout of the census branch with `bun install` done. Bun 1.4.2 is the
   tested version.
 - `gh` authenticated with read access to the repository's Actions (or
   `GH_TOKEN` set). `eval:pass-rates` downloads artifacts through the REST zip
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index 246dfb490..96af7e1eb 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -451,13 +451,13 @@ stopped instead of touching your project.
 ## Setup and auto-update
 
 <a id="bun-too-old"></a>
-### `gstack needs Bun 1.3.3 or newer (1.4.0 recommended); found <version> at <path>. Nothing was installed or changed.`
+### `gstack needs Bun 1.3.3 or newer (1.4.2 recommended); found <version> at <path>. Nothing was installed or changed.`
 
 **Meaning.** Bun older than 1.3.3 silently ignores the build flags that stop
 gstack's compiled tools from reading a project's `.env`, so setup refuses it
 before writing anything. The same link appears on two warnings that do not stop
-setup: `warning: gstack is tested on Bun 1.4.0 (CI pin); found <version>` (1.3.3
-up to 1.4.0 works but is untested) and `warning: could not read the Bun version
+setup: `warning: gstack is tested on Bun 1.4.2 (CI pin); found <version>` (1.3.3
+up to 1.4.2 works but is untested) and `warning: could not read the Bun version
 (...)` (setup continued; check `bun --version`).
 
 **Fix.**
@@ -467,7 +467,7 @@ bun upgrade
 ./setup
 ```
 
-**Expected result.** `bun --version` prints 1.4.0 or newer and setup finishes
+**Expected result.** `bun --version` prints 1.4.2 or newer and setup finishes
 with no Bun warning.
 
 <a id="auto-update-bun-too-old"></a>
diff --git a/open-gstack-browser/SKILL.md b/open-gstack-browser/SKILL.md
index 56f91e73c..2754d9db5 100644
--- a/open-gstack-browser/SKILL.md
+++ b/open-gstack-browser/SKILL.md
@@ -176,7 +176,7 @@ If `NEEDS_SETUP`:
 3. If `bun` is not installed:
    ```bash
    if ! command -v bun >/dev/null 2>&1; then
-     BUN_VERSION="1.4.0"
+     BUN_VERSION="1.4.2"
      BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd"
      tmpfile=$(mktemp "${TMPDIR:-/tmp}/bun-install.XXXXXX")
      curl -fsSL "https://bun.sh/install" -o "$tmpfile"
diff --git a/package.json b/package.json
index 1d53ad84a..2fae3d87f 100644
--- a/package.json
+++ b/package.json
@@ -78,7 +78,7 @@
     "socks": "^2.8.9"
   },
   "engines": {
-    "bun": ">=1.4.0"
+    "bun": ">=1.4.2"
   },
   "keywords": [
     "browser",
@@ -93,7 +93,7 @@
   "devDependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.2.117",
     "@anthropic-ai/sdk": "^0.78.0",
-    "@types/bun": "1.4.0",
+    "@types/bun": "1.4.2",
     "prettier": "3.9.9",
     "typescript": "7.0.2",
     "xterm": "^5.3.0",
diff --git a/pair-agent/SKILL.md b/pair-agent/SKILL.md
index 7dce568db..1baaa1854 100644
--- a/pair-agent/SKILL.md
+++ b/pair-agent/SKILL.md
@@ -393,7 +393,7 @@ If `NEEDS_SETUP`:
 3. If `bun` is not installed:
    ```bash
    if ! command -v bun >/dev/null 2>&1; then
-     BUN_VERSION="1.4.0"
+     BUN_VERSION="1.4.2"
      BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd"
      tmpfile=$(mktemp "${TMPDIR:-/tmp}/bun-install.XXXXXX")
      curl -fsSL "https://bun.sh/install" -o "$tmpfile"
diff --git a/scripts/resolvers/browse.ts b/scripts/resolvers/browse.ts
index ae3b48a7f..96e432e9b 100644
--- a/scripts/resolvers/browse.ts
+++ b/scripts/resolvers/browse.ts
@@ -133,7 +133,7 @@ If \`NEEDS_SETUP\`:
 3. If \`bun\` is not installed:
    \`\`\`bash
    if ! command -v bun >/dev/null 2>&1; then
-     BUN_VERSION="1.4.0"
+     BUN_VERSION="1.4.2"
      BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd"
      tmpfile=$(mktemp "\${TMPDIR:-/tmp}/bun-install.XXXXXX")
      curl -fsSL "https://bun.sh/install" -o "$tmpfile"
diff --git a/scripts/ubicloud/setup-free-suite.sh b/scripts/ubicloud/setup-free-suite.sh
index 11fd87fc0..ed8d09253 100755
--- a/scripts/ubicloud/setup-free-suite.sh
+++ b/scripts/ubicloud/setup-free-suite.sh
@@ -4,7 +4,7 @@
 # Runs as user `ubi` (passwordless sudo) from the synced checkout.
 set -euo pipefail
 
-BUN_VERSION=1.4.0
+BUN_VERSION=1.4.2
 NODE_VERSION=22.20.0
 
 export DEBIAN_FRONTEND=noninteractive
diff --git a/setup-browser-cookies/SKILL.md b/setup-browser-cookies/SKILL.md
index 85ec2b875..23f193d0c 100644
--- a/setup-browser-cookies/SKILL.md
+++ b/setup-browser-cookies/SKILL.md
@@ -173,7 +173,7 @@ If `NEEDS_SETUP`:
 3. If `bun` is not installed:
    ```bash
    if ! command -v bun >/dev/null 2>&1; then
-     BUN_VERSION="1.4.0"
+     BUN_VERSION="1.4.2"
      BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd"
      tmpfile=$(mktemp "${TMPDIR:-/tmp}/bun-install.XXXXXX")
      curl -fsSL "https://bun.sh/install" -o "$tmpfile"
diff --git a/test/arm-setup-smoke-workflow.test.ts b/test/arm-setup-smoke-workflow.test.ts
index 4dc399afa..4b40aa4e6 100644
--- a/test/arm-setup-smoke-workflow.test.ts
+++ b/test/arm-setup-smoke-workflow.test.ts
@@ -42,7 +42,7 @@ describe('native ARM setup smoke workflow', () => {
     expect(scripts).toContain('git archive --format=tar HEAD');
     expect(scripts).toContain('sha256sum setup bun.lock package.json');
     expect(scripts).toContain('ln -s bun /usr/local/bin/bunx');
-    expect(scripts).toContain('test "$(bunx --version)" = 1.4.0');
+    expect(scripts).toContain('test "$(bunx --version)" = 1.4.2');
     expect(scripts.match(/sha256sum --check \/input\/source.sha256/g)).toHaveLength(2);
     expect(scripts).toContain('bun install --frozen-lockfile');
     expect(scripts).toContain('bash setup --host claude');
@@ -78,7 +78,7 @@ describe('native ARM setup smoke workflow', () => {
     expect(upload.if).toBe('always()');
     expect(upload.with['retention-days']).toBe(14);
     expect(upload.with['if-no-files-found']).toBe('error');
-    expect(job.steps[1].with['bun-version']).toBe('1.4.0');
+    expect(job.steps[1].with['bun-version']).toBe('1.4.2');
   });
 
   test('the registered shell step refuses a nonnative Docker daemon before pulling or running', () => {
diff --git a/test/bun-subprocess-fd-lifetime.test.ts b/test/bun-subprocess-fd-lifetime.test.ts
index 6714298c2..8914ada8c 100644
--- a/test/bun-subprocess-fd-lifetime.test.ts
+++ b/test/bun-subprocess-fd-lifetime.test.ts
@@ -71,7 +71,7 @@ test.skipIf(process.platform === 'win32')('extra-stdio cleanup preserves unrelat
     new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited,
   ]);
   const diagnosis = `Bun ${Bun.version} failed the subprocess descriptor-ownership probe. `
-    + 'Install the repository\'s pinned Bun version (1.4.0 or newer); '
+    + 'Install the repository\'s pinned Bun version (1.4.2 or newer); '
     + 'older Bun can double-close extra stdio and destroy unrelated browser/server sockets '
     + '(oven-sh/bun#32520, #33828).\n'
     + `exit=${code}\nstdout:\n${stdout}\nstderr:\n${stderr}`;
diff --git a/test/ci-paid-coordination.test.ts b/test/ci-paid-coordination.test.ts
index e43cf5743..31c6ca253 100644
--- a/test/ci-paid-coordination.test.ts
+++ b/test/ci-paid-coordination.test.ts
@@ -93,7 +93,7 @@ describe('paid CI coordination stays off the eval image', () => {
       expect(checkout.with?.['persist-credentials']).toBe(false);
       if (name === 'evals.yml') expect(checkout.with?.['fetch-depth']).toBe(0);
       const setup = planner.steps.find(step => step.uses?.startsWith('oven-sh/setup-bun@'))!;
-      expect(setup.with?.['bun-version']).toBe('1.4.0');
+      expect(setup.with?.['bun-version']).toBe('1.4.2');
       expect(JSON.stringify(planner)).not.toMatch(/secrets\.|restore-deps|bun install|bun run build/);
       expect(planner.steps.find(step => step.run?.includes('--emit-plan'))?.run).toContain('bun --no-install run');
     });
diff --git a/test/helpers/manual-judge-review-fixture.ts b/test/helpers/manual-judge-review-fixture.ts
index aeba5d066..13d6cd55c 100644
--- a/test/helpers/manual-judge-review-fixture.ts
+++ b/test/helpers/manual-judge-review-fixture.ts
@@ -29,7 +29,7 @@ const LATER_PREAMBLE_EDITS: Array<[string, string]> = [
 // The v1.91.26.0 Bun floor (E1) pinned the install hint to the tested Bun.
 const LATER_WAVE_EDITS: Array<[string, string]> = [
   ['tmpfile=$(mktemp "${TMPDIR:-/tmp}/bun-install.XXXXXX")', 'tmpfile=$(mktemp)'],
-  ['BUN_VERSION="1.4.0"', 'BUN_VERSION="1.3.10"'],
+  ['BUN_VERSION="1.4.2"', 'BUN_VERSION="1.3.10"'],
 ];
 
 export function approvedCookieWorkflowSource(source: string): string {
diff --git a/test/setup-bun-floor.test.ts b/test/setup-bun-floor.test.ts
index f812aaaf7..d6c1d105e 100644
--- a/test/setup-bun-floor.test.ts
+++ b/test/setup-bun-floor.test.ts
@@ -5,7 +5,7 @@ import * as os from 'os';
 import * as path from 'path';
 
 // E1: setup refuses Bun below the security floor (1.3.3) before writing
-// anything, warns from the floor up to the tested version (1.4.0), warns and
+// anything, warns from the floor up to the tested version (1.4.2), warns and
 // continues on a version it cannot parse, and keeps --help/--status working
 // without Bun. The auto-updater half lives in session-update-stages.test.ts.
 
@@ -76,8 +76,9 @@ describe.skipIf(process.platform === 'win32')('Bun floor (E1)', () => {
       '1.3.3': 'untested',
       '1.3.14': 'untested',
       '1.4.0-canary.20261001+abc123': 'untested',
-      '1.4.0': 'ok',
-      'v1.4.1': 'ok',
+      '1.4.0': 'untested',
+      'v1.4.1': 'untested',
+      '1.4.2': 'ok',
       '1.10.0': 'ok',
       '2.0.0': 'ok',
       '': 'malformed',
@@ -97,7 +98,7 @@ describe.skipIf(process.platform === 'win32')('Bun floor (E1)', () => {
     for (const version of ['1.3.2', '1.3.3-canary.1']) {
       const r = runSetupWithBun(version);
       expect(r.status).toBe(1);
-      expect(r.stderr).toContain(`gstack needs Bun 1.3.3 or newer (1.4.0 recommended); found ${version} at ${r.stub}. Nothing was installed or changed.`);
+      expect(r.stderr).toContain(`gstack needs Bun 1.3.3 or newer (1.4.2 recommended); found ${version} at ${r.stub}. Nothing was installed or changed.`);
       expect(r.stderr).toContain('older Bun ignores --no-compile-autoload-dotenv');
       expect(r.stderr).toContain('Fix: bun upgrade, then re-run ./setup (docs/troubleshooting.md#bun-too-old)');
       expect(r.bunCalls).toBe('');
@@ -107,20 +108,20 @@ describe.skipIf(process.platform === 'win32')('Bun floor (E1)', () => {
 
   test('between the floor and the tested version: one warning, then setup continues', () => {
     const r = runSetupWithBun('1.3.14');
-    expect(r.stderr).toContain('warning: gstack is tested on Bun 1.4.0 (CI pin); found 1.3.14. Upgrade with: bun upgrade');
+    expect(r.stderr).toContain('warning: gstack is tested on Bun 1.4.2 (CI pin); found 1.3.14. Upgrade with: bun upgrade');
     expect(r.stderr).not.toContain('gstack needs Bun');
     expect(r.bunCalls).toContain('run scripts/models.ts claude-overlay claude-opus-4-8');
   });
 
   test('the tested version passes silently', () => {
-    const r = runSetupWithBun('1.4.0');
+    const r = runSetupWithBun('1.4.2');
     expect(r.stderr).not.toMatch(/warning: gstack is tested on Bun|gstack needs Bun|could not read the Bun version/);
     expect(r.bunCalls).toContain('run scripts/models.ts claude-overlay claude-opus-4-8');
   });
 
   test('a malformed version warns and continues', () => {
     const r = runSetupWithBun('bun-dev (local build)');
-    expect(r.stderr).toContain("warning: could not read the Bun version (bun --version printed 'bun-dev (local build)'); continuing. gstack is tested on Bun 1.4.0");
+    expect(r.stderr).toContain("warning: could not read the Bun version (bun --version printed 'bun-dev (local build)'); continuing. gstack is tested on Bun 1.4.2");
     expect(r.stderr).not.toContain('gstack needs Bun');
     expect(r.bunCalls).toContain('run scripts/models.ts claude-overlay claude-opus-4-8');
   });