diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b882c25..09fa940 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,12 +37,12 @@ jobs: - if: matrix.os == 'windows' uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24.21.0 + node-version: 24.22.1 architecture: arm64 - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24.21.0 + node-version: 24.22.1 architecture: arm64 # Saving the pnpm store with the Windows guest's tar.exe hangs until the job times out. cache: ${{ matrix.os != 'windows' && 'pnpm' || '' }} diff --git a/.github/workflows/deploy-site.yml b/.github/workflows/deploy-site.yml index af23344..b84e5cd 100644 --- a/.github/workflows/deploy-site.yml +++ b/.github/workflows/deploy-site.yml @@ -21,7 +21,7 @@ jobs: - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24.21.0 + node-version: 24.22.1 cache: pnpm - run: pnpm install --frozen-lockfile - run: pnpm site:deploy diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f4c4ebc..4a6c13f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -48,7 +48,7 @@ jobs: version: 10.24.0 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24.21.0 + node-version: 24.22.1 cache: pnpm - run: pnpm install --frozen-lockfile --ignore-scripts - run: pnpm package @@ -77,7 +77,7 @@ jobs: persist-credentials: false - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24.21.0 + node-version: 24.22.1 - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: unsigned-release @@ -143,7 +143,7 @@ jobs: persist-credentials: false - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24.21.0 + node-version: 24.22.1 architecture: arm64 - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: @@ -186,7 +186,7 @@ jobs: persist-credentials: false - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24.21.0 + node-version: 24.22.1 - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: unsigned-release diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 82ac99e..17ed4ab 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -10,7 +10,7 @@ Thanks for helping. Read [AGENTS.md](AGENTS.md) first: it describes what Inbot n ## Development -Use Node 24.21.0 and pnpm 10.24.0: +Use Node 24.22.1 and pnpm 10.24.0: ```sh pnpm install --frozen-lockfile diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 07ace9b..ad3ee67 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -2,7 +2,7 @@ Inbot's original code is licensed under the MIT License in `LICENSE`. Third-party components retain their own licenses. This notice does not replace their license texts or source-distribution requirements. -- Release archives include Node.js 24.21.0 with its upstream `runtime/LICENSE`, covering Node and its bundled components. +- Release archives include Node.js 24.22.1 with its upstream `runtime/LICENSE`, covering Node and its bundled components. - Production JavaScript dependencies retain the license files supplied by their publishers under `application/node_modules`. Each archive includes a generated `licenses/` directory and `licenses/INDEX.md` recording exact package versions, declared licenses, and copied license and notice materials, including dependencies compiled into the owner UI and Email Worker. - `better-sqlite3-multiple-ciphers` includes the MIT-licensed better-sqlite3 and SQLite3 Multiple Ciphers work and a target-specific native prebuild. Its upstream `LICENSE` is retained. SQLite itself is public domain. - `@napi-rs/keyring` and its target-specific native prebuild are MIT-licensed. Their upstream license texts are included with the archive notices. diff --git a/apps/cli/README.md b/apps/cli/README.md index b57576c..2211ba9 100644 --- a/apps/cli/README.md +++ b/apps/cli/README.md @@ -9,7 +9,7 @@ override both defaults. ## Development -Requires Node 24.21.0 and pnpm 10.24.0. Build from the workspace root: +Requires Node 24.22.1 and pnpm 10.24.0. Build from the workspace root: ```sh pnpm install @@ -26,7 +26,7 @@ dependencies resolve from the root package. No additional dependency is needed. ## Packaged installation -Release archives include Node 24.21.0, production dependencies with the target's +Release archives include Node 24.22.1, production dependencies with the target's native prebuilds, the server, CLI, inbound Worker bundle, and owner UI. No external Node runtime is required. See the [installation guide](https://inbot.kerd.dev/docs/get-started/install) for the one-line checksum-verifying installers, supported platforms, updating and removal. diff --git a/apps/docs/docs/development/build.md b/apps/docs/docs/development/build.md index b7f5e42..0d33381 100644 --- a/apps/docs/docs/development/build.md +++ b/apps/docs/docs/development/build.md @@ -5,7 +5,7 @@ description: Build and run Inbot from a source checkout, run the checks the proj ## Requirements -- Node.js 24.21.0 or newer, below 25 +- Node.js 24.22.1 or newer, below 25 - pnpm 10.24.0 - An OS keychain, or the test-only memory keychain described below diff --git a/apps/docs/docs/development/packaging.md b/apps/docs/docs/development/packaging.md index c10ca80..2a14931 100644 --- a/apps/docs/docs/development/packaging.md +++ b/apps/docs/docs/development/packaging.md @@ -5,7 +5,7 @@ description: Build release archives for every platform, smoke-test them locally, ## Build archives -Packaging runs on macOS or Linux with Node.js exactly 24.21.0, pnpm 10.24.0, `tar`, `zip` and `unzip`: +Packaging runs on macOS or Linux with Node.js exactly 24.22.1, pnpm 10.24.0, `tar`, `zip` and `unzip`: ```sh pnpm install --frozen-lockfile --ignore-scripts @@ -20,7 +20,7 @@ pnpm package --target darwin-arm64 --target linux-x64 | `--output ` | Release directory, default `dist-release` | | `--skip-build` | Reuse an existing complete build | -The output is `inbot--.tar.gz` (Windows: `.zip`) plus `SHA256SUMS`. One machine can build all six targets: Node.js runtimes are downloaded and verified against nodejs.org's `SHASUMS256.txt`, and the SQLite and keychain native modules come from official npm prebuilds verified against the lockfile's integrity hashes. Nothing is compiled natively. Download caches live in the output's `.cache` directory and are not part of the release. +The output is `inbot--.tar.gz` (Windows: `.zip`) plus `SHA256SUMS`. One machine can build all six targets: Node.js runtimes are downloaded and verified against SHA-256 pins in `scripts/package.mjs`. Packaging also fetches nodejs.org's `SHASUMS256.txt` and fails if any pinned checksum disagrees. The SQLite and keychain native modules come from official npm prebuilds verified against the lockfile's integrity hashes. Nothing is compiled natively. Download caches live in the output's `.cache` directory and are not part of the release. See [Install Inbot](/get-started/install#what-gets-installed) for what each archive contains. diff --git a/apps/docs/docs/get-started/install.md b/apps/docs/docs/get-started/install.md index fcc4a58..04c9348 100644 --- a/apps/docs/docs/get-started/install.md +++ b/apps/docs/docs/get-started/install.md @@ -74,14 +74,14 @@ Paths must be absolute. A custom install root does not change the default bin di ## What gets installed -| Path | Contents | -| -------------------------- | ------------------------------------------------------------------------------- | -| `inbot` or `inbot.cmd` | Launcher | -| `runtime/` | Node.js 24.21.0, verified against nodejs.org's published checksums at packaging | -| `application/dist` | Server, CLI, shared packages and the inbound Email Worker bundle | -| `application/web` | Owner web app | -| `application/node_modules` | Production dependencies, including prebuilt SQLite and keychain native modules | -| `BUILD.json` | Version, target and integrity values of the bundled runtime and native modules | +| Path | Contents | +| -------------------------- | --------------------------------------------------------------------------------------------------------- | +| `inbot` or `inbot.cmd` | Launcher | +| `runtime/` | Node.js 24.22.1, verified against pinned SHA-256 hashes and nodejs.org's published checksums at packaging | +| `application/dist` | Server, CLI, shared packages and the inbound Email Worker bundle | +| `application/web` | Owner web app | +| `application/node_modules` | Production dependencies, including prebuilt SQLite and keychain native modules | +| `BUILD.json` | Version, target and integrity values of the bundled runtime and native modules | Installed commands default to the production flavor: the home is `~/.inbot` (`%USERPROFILE%\.inbot` on Windows), and `inbot serve` serves the bundled web app. The home is separate from the install directory and holds your encrypted mail database and key files. See [Configuration](/operations/configuration). diff --git a/apps/server/src/http/README.md b/apps/server/src/http/README.md index aa5f09a..31efd4c 100644 --- a/apps/server/src/http/README.md +++ b/apps/server/src/http/README.md @@ -1,6 +1,6 @@ # Loopback HTTP API -Build with Node 24.21.0 and run against an explicit home: +Build with Node 24.22.1 and run against an explicit home: ```sh pnpm build diff --git a/package.json b/package.json index 43b2ac2..cfe0126 100644 --- a/package.json +++ b/package.json @@ -66,7 +66,7 @@ "vitest": "5.0.2" }, "engines": { - "node": ">=24.21.0 <25" + "node": ">=24.22.1 <25" }, "packageManager": "pnpm@10.24.0", "pnpm": { diff --git a/scripts/archive.test.mjs b/scripts/archive.test.mjs index c2b067a..abfd943 100644 --- a/scripts/archive.test.mjs +++ b/scripts/archive.test.mjs @@ -99,7 +99,7 @@ test( assertArchitecture(await readFile(join(temporary, file)), target); const build = JSON.parse(await readFile(join(temporary, "inbot/BUILD.json"))); assert.equal(build.target, target); - assert.equal(build.node, "24.21.0"); + assert.equal(build.node, "24.22.1"); assert.equal( JSON.parse(await readFile(join(temporary, "inbot/application/package.json"))).license, "MIT", diff --git a/scripts/package.mjs b/scripts/package.mjs index 354bbf3..557c679 100644 --- a/scripts/package.mjs +++ b/scripts/package.mjs @@ -20,7 +20,19 @@ import { releaseTargets as targets, writeReleaseChecksums } from "./release-chec import { stagePackageNotices } from "./package-notices.mjs"; const root = resolve(dirname(fileURLToPath(import.meta.url)), ".."); -const nodeVersion = "24.21.0"; +const nodeVersion = "24.22.1"; +const nodeChecksums = { + "node-v24.22.1-darwin-arm64.tar.gz": + "89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7", + "node-v24.22.1-darwin-x64.tar.gz": + "d132557e7ee2b85af08b0c8c34338e65c6430f2238d01f727728ef42dc83b035", + "node-v24.22.1-linux-x64.tar.gz": + "eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c", + "node-v24.22.1-linux-arm64.tar.gz": + "33c37be234ba8bee041961047b19160f4d7d0f164e8e246f78bdd10feff148b3", + "node-v24.22.1-win-x64.zip": "d2046d28c2c3dcd211ac5145c0bf30e2047ef9dfb306693c8c6e2eccd8b95fa5", + "node-v24.22.1-win-arm64.zip": "a0c807319fede24c4a0d8f84564c82a619bd313b16b10c007c383c2609e99171", +}; const { values } = parseArgs({ options: { target: { type: "string", multiple: true }, @@ -144,6 +156,11 @@ try { }); if (!sumsResponse.ok) throw new Error("Cannot fetch official Node checksums."); const sums = await sumsResponse.text(); + for (const [filename, checksum] of Object.entries(nodeChecksums)) { + const published = sums.split(/\r?\n/).filter((line) => line.endsWith(` ${filename}`)); + if (published.length !== 1 || published[0].split(/\s+/)[0] !== checksum) + throw new Error(`Official Node checksum disagrees with pin: ${filename}`); + } const sqliteVersion = manifest.dependencies["better-sqlite3-multiple-ciphers"]; const sqliteArchive = await npmArchive("better-sqlite3-multiple-ciphers", sqliteVersion); const keyringVersion = manifest.dependencies["@napi-rs/keyring"]; @@ -151,12 +168,9 @@ try { const windows = target.startsWith("win32-"); const runtimeName = `node-v${nodeVersion}-${target.replace("win32-", "win-")}`; const runtimeFile = `${runtimeName}.${windows ? "zip" : "tar.gz"}`; - const checksum = sums - .split("\n") - .find((line) => line.endsWith(` ${runtimeFile}`)) - ?.split(/\s+/)[0]; + const checksum = nodeChecksums[runtimeFile]; if (!checksum || !/^[a-f0-9]{64}$/.test(checksum)) - throw new Error(`No official checksum: ${runtimeFile}`); + throw new Error(`No pinned Node checksum: ${runtimeFile}`); const runtimeArchive = await download( `https://nodejs.org/dist/v${nodeVersion}/${runtimeFile}`, runtimeFile, diff --git a/scripts/smoke-release.mjs b/scripts/smoke-release.mjs index a11a3a0..0416a7a 100644 --- a/scripts/smoke-release.mjs +++ b/scripts/smoke-release.mjs @@ -76,7 +76,7 @@ try { : await exec(launcher, ["--help"], { env: helpEnv }); assert.match(help.stdout, /Usage: inbot/); const node = join(bundle, windows ? "runtime/node.exe" : "runtime/bin/node"); - assert.equal((await exec(node, ["--version"], { env: bundledEnv })).stdout.trim(), "v24.21.0"); + assert.equal((await exec(node, ["--version"], { env: bundledEnv })).stdout.trim(), "v24.22.1"); if (windows) assert.equal( (await exec(node, ["-p", "process.arch"], { env: bundledEnv })).stdout.trim(),