starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-10-30 16:47:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): update Node runtimes for October security releases (#31687)

Browse Source 
* fix(security): update Node runtimes for October security releases

* fix(ci): compare normalized web file inventory without ordering artifacts
This commit is contained in:
Neil
2026-10-21 17:06:28 -07:00
committed by GitHub
parent f47f632bd7
commit eb9d2f9a06
67 changed files with 162 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/actions/install-node-dependencies/action.yml
+2
View File
@@ -104,6 +104,7 @@ runs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
cache: ${{ github.event_name != 'pull_request' && inputs.cache-pnpm-store != 'false' && steps.pnpm-store-mode.outputs.lookup-only != 'true' && 'pnpm' || '' }}
cache-dependency-path: ${{ inputs.cache-dependency-path }}
package-manager-cache: false
@@ -114,6 +115,7 @@ runs:
uses: actions/setup-node@v6
with:
node-version: ${{ inputs.node-version }}
check-latest: true
cache: ${{ github.event_name != 'pull_request' && inputs.cache-pnpm-store != 'false' && steps.pnpm-store-mode.outputs.lookup-only != 'true' && 'pnpm' || '' }}
cache-dependency-path: ${{ inputs.cache-dependency-path }}
package-manager-cache: false
.github/actions/setup-wsl-test-runtime/setup.ps1
+2 -2
View File
@@ -20,10 +20,10 @@ $installer = Start-Process msiexec.exe -ArgumentList @('/i', $kernelMsi, '/quiet
if ($installer.ExitCode -ne 0) { throw "WSL kernel installation failed: $($installer.ExitCode)" }
wsl.exe --status
if ($LASTEXITCODE -ne 0) { throw "WSL status failed: $LASTEXITCODE" }
wsl.exe --distribution Ubuntu --user root --exec /usr/bin/curl --fail --silent --show-error --location https://nodejs.org/dist/v22.14.0/node-v22.14.0-linux-x64.tar.xz --output /tmp/orca-node.tar.xz
wsl.exe --distribution Ubuntu --user root --exec /usr/bin/curl --fail --silent --show-error --location https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-x64.tar.xz --output /tmp/orca-node.tar.xz
if ($LASTEXITCODE -ne 0) { throw 'Node download failed' }
$nodeHash = wsl.exe --distribution Ubuntu --user root --exec /usr/bin/sha256sum /tmp/orca-node.tar.xz
if ($LASTEXITCODE -ne 0 -or -not ($nodeHash -match '^69b09dba5c8dcb05c4e4273a4340db1005abeafe3927efda2bc5b249e80437ec')) { throw 'Node checksum mismatch' }
if ($LASTEXITCODE -ne 0 -or -not ($nodeHash -match '^1805bcd35e6815559bd2eb97db438d3fdb0eb3a5e6a977b7c1badca76337e9ce')) { throw 'Node checksum mismatch' }
wsl.exe --distribution Ubuntu --user root --exec /usr/bin/tar -xJf /tmp/orca-node.tar.xz -C /usr/local --strip-components=1
if ($LASTEXITCODE -ne 0) { throw 'Node extraction failed' }
wsl.exe --distribution Ubuntu --user root --exec /usr/local/bin/node --version
.github/workflows/adhoc-mac-build.yml
+2
View File
@@ -175,6 +175,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
package-manager-cache: false
- name: Compute adhoc version
@@ -415,6 +416,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
cache: pnpm
cache-dependency-path: |
pnpm-lock.yaml
.github/workflows/ci-xterm-cache.yml
+1
View File
@@ -32,6 +32,7 @@ jobs:
- uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
package-manager-cache: false
- uses: ./.github/actions/prepare-xterm-dependencies
id: cache
.github/workflows/cloud-bootstrap-relay-staging-capacity.yml
+1
View File
@@ -66,6 +66,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- name: Require explicit bootstrap confirmation
env:
.github/workflows/cloud-deploy-relay-production-capacity-job.yml
+1
View File
@@ -168,6 +168,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- run: pnpm install --frozen-lockfile
.github/workflows/cloud-deploy-relay-production-capacity.yml
+1
View File
@@ -137,6 +137,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- run: pnpm install --frozen-lockfile
.github/workflows/cloud-deploy-relay-production-director.yml
+1
View File
@@ -122,6 +122,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- name: Resolve immutable production image
shell: bash
.github/workflows/cloud-deploy-relay-production-multi-target.yml
+1
View File
@@ -194,6 +194,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- run: pnpm install --frozen-lockfile
.github/workflows/cloud-deploy-relay-production-same-cap-job.yml
+1
View File
@@ -97,6 +97,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- run: pnpm install --frozen-lockfile
.github/workflows/cloud-deploy-relay-production-same-cap.yml
+2 -2
View File
@@ -99,7 +99,7 @@ jobs:
fetch-depth: 0
- uses: actions/setup-node@v4
with: { node-version: 24 }
with: { node-version: 24, check-latest: true }
- id: wave
env:
@@ -361,7 +361,7 @@ jobs:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with: { node-version: 24 }
with: { node-version: 24, check-latest: true }
# Its pace checks are what let a batch drain faster than the default; a missing artifact
# seals UNVERIFIED, which only the default accepts. Named from the gate's normalized cell,
.github/workflows/cloud-deploy-relay-production.yml
+1
View File
@@ -91,6 +91,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- run: pnpm install --frozen-lockfile
.github/workflows/cloud-deploy-relay-staging-gce-candidate.yml
+1
View File
@@ -77,6 +77,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- name: Require explicit mutation confirmation
if: ${{ inputs.mode != 'preflight' }}
.github/workflows/cloud-deploy-relay-staging.yml
+1
View File
@@ -167,6 +167,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- name: Require the mirrored immutable image
run: |
.github/workflows/cloud-monitor-relay-production-job.yml
+1
View File
@@ -65,6 +65,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- run: pnpm install --frozen-lockfile
.github/workflows/cloud-operate-relay-asia-admission.yml
+1
View File
@@ -193,6 +193,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- uses: pnpm/setup@v2
with:
.github/workflows/cloud-operate-relay-production-cell-flags.yml
+1
View File
@@ -82,6 +82,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- id: google-auth
uses: google-github-actions/auth@v2
.github/workflows/cloud-operate-relay-production-rehome-job.yml
+1
View File
@@ -106,6 +106,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- id: google-auth
uses: google-github-actions/auth@v2
.github/workflows/cloud-operate-relay-production-reserve-watch.yml
+2
View File
@@ -114,6 +114,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- id: google-auth-1
uses: google-github-actions/auth@v2
@@ -276,6 +277,7 @@ jobs:
if: ${{ always() }}
with:
node-version: 24
check-latest: true
- id: google-auth
if: ${{ always() }}
.github/workflows/cloud-operate-relay-staging-cell-flags.yml
+1
View File
@@ -84,6 +84,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- id: google-auth
uses: google-github-actions/auth@v2
.github/workflows/cloud-power-relay-staging.yml
+1
View File
@@ -76,6 +76,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- name: Require explicit manual mutation confirmation
if: ${{ github.event_name == 'workflow_dispatch' && inputs.mode != 'status' }}
.github/workflows/cloud-prove-relay-asia-staging.yml
+3
View File
@@ -123,6 +123,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- uses: pnpm/setup@v2
with:
@@ -346,6 +347,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- name: Recover staging C4 with a fresh identity
env:
@@ -433,6 +435,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- uses: pnpm/setup@v2
with:
.github/workflows/cloud-prove-relay-staging-capacity.yml
+2
View File
@@ -107,6 +107,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- name: Initialize the exact staging backend
if: ${{ inputs.mode != 'restore-admission' }}
@@ -655,6 +656,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- name: Initialize the exact staging backend
run: node dev/scripts/infra.mjs init --env staging
.github/workflows/cloud-recover-relay-staging-c4-image.yml
+1
View File
@@ -102,6 +102,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- name: Initialize the exact staging backend
run: node dev/scripts/infra.mjs init --env staging
.github/workflows/cloud-verify.yml
+2
View File
@@ -94,6 +94,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- run: pnpm install --frozen-lockfile
- run: pnpm build
@@ -134,6 +135,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
check-latest: true
- run: pnpm install --frozen-lockfile
- run: pnpm test
.github/workflows/daemon-relocation-spike.yml
+1
View File
@@ -41,6 +41,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
- name: Setup pnpm
uses: pnpm/setup@v2
.github/workflows/daily-mac-build.yml
+1
View File
@@ -188,6 +188,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
cache: pnpm
cache-dependency-path: |
pnpm-lock.yaml
.github/workflows/dev-channel-win-build.yml
+1
View File
@@ -236,6 +236,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
cache: pnpm
cache-dependency-path: |
pnpm-lock.yaml
.github/workflows/docs.yml
+2
View File
@@ -56,6 +56,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: docs/site/package.json
check-latest: true
# setup-node probes the store from the repository root, not this app.
package-manager-cache: false
@@ -228,6 +229,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: docs/site/package.json
check-latest: true
package-manager-cache: false
- name: Install site dependencies
.github/workflows/golden-e2e-experiment.yml
+1
View File
@@ -41,6 +41,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
- name: Setup pnpm
uses: pnpm/setup@v2
.github/workflows/hourly-mac-build.yml
+1
View File
@@ -177,6 +177,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
cache: pnpm
cache-dependency-path: |
pnpm-lock.yaml
.github/workflows/linux-wayland-gpu-sandbox.yml
+1
View File
@@ -22,6 +22,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
- name: Setup pnpm
uses: pnpm/setup@v2
.github/workflows/mobile-android-release.yml
+1
View File
@@ -46,6 +46,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version: 24
check-latest: true
- name: Setup pnpm
uses: pnpm/setup@v2
.github/workflows/mobile-ios-release.yml
+1
View File
@@ -62,6 +62,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version: 24
check-latest: true
- name: Setup pnpm
uses: pnpm/setup@v2
.github/workflows/node-server-tests.yml
+2 -1
View File
@@ -78,6 +78,7 @@ jobs:
- uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
package-manager-cache: false
- name: Detect headless-server build and test inputs
id: scope
@@ -526,7 +527,7 @@ jobs:
-e ORCA_BACKGROUND_LAUNCH=1 \
-v "$VERIFICATION_CACHE_PATH:/root/.cache/pnpm/lockfile-verified.jsonl" \
-v "$GITHUB_WORKSPACE:/work" -w /work \
node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 sleep infinity
node:24.22.1-alpine@sha256:6a1c190e17215d844926b0677f4bf87273ff7d5e54db06d3b5b5863ab0b09a3d sleep infinity
docker exec -i orcad-alpine sh -s <<'NODE_SERVER_PREPARATION'
set -eu
apk add --no-cache bash git libstdc++ python3 make g++
.github/workflows/pr.yml
+2
View File
@@ -755,6 +755,7 @@ jobs:
- uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
package-manager-cache: false
# Rebuild both pristine and patched bundles; reuse only the pinned toolchain.
@@ -1529,6 +1530,7 @@ jobs:
- uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
package-manager-cache: false
- name: Setup pnpm
.github/workflows/qualified-orcad-template.yml
+1
View File
@@ -32,6 +32,7 @@ jobs:
- uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
package-manager-cache: false
- name: Checkout the workflow policy
uses: actions/checkout@v6
.github/workflows/release-cut.yml
+7
View File
@@ -128,6 +128,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
- name: Configure git author
run: |
@@ -902,6 +903,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
cache: pnpm
# Why: Linux terminal golden E2E uses the same native install path as
@@ -1128,6 +1130,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
cache: pnpm
# Why: keep the non-blocking evidence lane on the same Linux native
@@ -1351,6 +1354,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
cache: pnpm
cache-dependency-path: |
pnpm-lock.yaml
@@ -2377,6 +2381,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
- name: Run isolated macOS release build
id: dispatch
@@ -2413,6 +2418,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
- name: Require the exact isolated macOS release build to succeed
run: node config/scripts/run-release-mac-build-workflow.mjs wait
@@ -2457,6 +2463,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
- name: Verify release is still draft
env:
.github/workflows/release-javascript-benchmark.yml
+1
View File
@@ -102,6 +102,7 @@ jobs:
- uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
- uses: ./.github/actions/install-node-dependencies
- uses: actions/download-artifact@v8
with:
.github/workflows/release-mac-build.yml
+1
View File
@@ -91,6 +91,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
cache: pnpm
cache-dependency-path: |
pnpm-lock.yaml
.github/workflows/skill-update-roundtrip.yml
+1
View File
@@ -50,6 +50,7 @@ jobs:
id: node
with:
node-version-file: package.json
check-latest: true
- name: Verify pinned symlink placement with autocrlf false
if: ${{ !cancelled() && matrix.skills-cli == 'pinned' && steps.checkout.outcome == 'success' && steps.node.outcome == 'success' }}
env:
.github/workflows/ssh-hostile-hosts.yml
+1 -1
View File
@@ -116,7 +116,7 @@ jobs:
-e ORCA_BACKGROUND_LAUNCH=1 \
-v "$VERIFICATION_CACHE_PATH:/root/.cache/pnpm/lockfile-verified.jsonl" \
-v "$GITHUB_WORKSPACE:/work" -w /work \
node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 sh -s <<'MUSL_SLOT'
node:24.22.1-alpine@sha256:6a1c190e17215d844926b0677f4bf87273ff7d5e54db06d3b5b5863ab0b09a3d sh -s <<'MUSL_SLOT'
set -eu
apk add --no-cache bash git libstdc++ python3 make g++
git config --global --add safe.directory /work
.github/workflows/terminal-perf.yml
+1
View File
@@ -115,6 +115,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
cache: pnpm
# Historical refs can lack the shared action; retain their original install path.
.github/workflows/unit-module-cache-benchmark.yml
+3 -3
View File
@@ -14,7 +14,7 @@ jobs:
baseline:
uses: ./.github/workflows/unit-tests.yml
with:
node_versions: '["24.21.0"]'
node_versions: '["24.22.1"]'
runner: ubuntu-24.04-arm
shards: '[{"index":1,"count":5},{"index":2,"count":5},{"index":3,"count":5},{"index":4,"count":5},{"index":5,"count":5}]'
artifact_prefix: baseline-unit
@@ -25,7 +25,7 @@ jobs:
needs: baseline
uses: ./.github/workflows/unit-tests.yml
with:
node_versions: '["24.21.0"]'
node_versions: '["24.22.1"]'
runner: ubuntu-24.04-arm
shards: '[{"index":1,"count":5},{"index":2,"count":5},{"index":3,"count":5},{"index":4,"count":5},{"index":5,"count":5}]'
artifact_prefix: producer-unit
@@ -39,7 +39,7 @@ jobs:
needs: producer
uses: ./.github/workflows/unit-tests.yml
with:
node_versions: '["24.21.0"]'
node_versions: '["24.22.1"]'
runner: ubuntu-24.04-arm
shards: '[{"index":1,"count":5},{"index":2,"count":5},{"index":3,"count":5},{"index":4,"count":5},{"index":5,"count":5}]'
artifact_prefix: warm-unit
.github/workflows/win-crash-survival-e2e.yml
+1
View File
@@ -55,6 +55,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
cache: pnpm
cache-dependency-path: |
pnpm-lock.yaml
.github/workflows/win-update-e2e.yml
+1
View File
@@ -83,6 +83,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
- name: Setup pnpm
uses: pnpm/setup@v2
.github/workflows/win-update-survival-e2e.yml
+1
View File
@@ -71,6 +71,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
- name: Setup pnpm
uses: pnpm/setup@v2
.github/workflows/windows-native-preparation-benchmark.yml
+1 -1
View File
@@ -49,7 +49,7 @@ jobs:
node -e 'require("node:fs").writeFileSync(".build/windows-native-benchmark/job-start.json", JSON.stringify({startedAt:new Date().toISOString()}))'
- uses: ./.github/actions/install-node-dependencies
with:
node-version: '24.21.0'
node-version: '24.22.1'
native-runtime: none
cache-pnpm-store: 'false'
cache-pnpm-verification: 'false'
.github/workflows/windows-signing-rehearsal.yml
+1
View File
@@ -56,6 +56,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
cache: pnpm
cache-dependency-path: |
pnpm-lock.yaml
.github/workflows/windows-terminal-restart-e2e.yml
+1
View File
@@ -41,6 +41,7 @@ jobs:
uses: actions/setup-node@v6
with:
node-version-file: package.json
check-latest: true
cache: pnpm
- name: Install dependencies
cloud/.node-version
+1 -1
View File
@@ -1,2 +1,2 @@
24
24.22.1
cloud/apps/push/Dockerfile
+2 -2
View File
@@ -1,4 +1,4 @@
FROM node:24-alpine AS build
FROM node:24.22.1-alpine AS build
WORKDIR /app
RUN corepack enable
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
@@ -11,7 +11,7 @@ COPY apps/push apps/push
COPY packages/postgres-schema packages/postgres-schema
RUN pnpm --filter @orca-cloud/postgres-schema build && pnpm --filter @orca-cloud/push-contract build && pnpm --filter @orca-cloud/push build
FROM node:24-alpine AS runtime
FROM node:24.22.1-alpine AS runtime
ENV NODE_ENV=production
ENV PORT=8080
WORKDIR /app
cloud/apps/relay-fence-broker/Dockerfile
+1 -1
View File
@@ -1,4 +1,4 @@
FROM node:24-bookworm-slim AS build
FROM node:24.22.1-bookworm-slim AS build
WORKDIR /workspace
RUN corepack enable
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
cloud/apps/relay/Dockerfile
+2 -2
View File
@@ -1,4 +1,4 @@
FROM node:24-alpine AS build
FROM node:24.22.1-alpine AS build
WORKDIR /app
RUN corepack enable
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
@@ -11,7 +11,7 @@ COPY apps/relay apps/relay
COPY packages/postgres-schema packages/postgres-schema
RUN pnpm --filter @orca-cloud/postgres-schema build && pnpm --filter @orca-cloud/relay-contract build && pnpm --filter @orca-cloud/relay build
FROM node:24-alpine AS runtime
FROM node:24.22.1-alpine AS runtime
ENV NODE_ENV=production
ENV PORT=8080
WORKDIR /app
config/docker/daemon-scope-lifetime/Dockerfile
+1 -1
View File
@@ -1,5 +1,5 @@
ARG BASE_IMAGE=debian:bookworm-slim
FROM node:22-bookworm-slim AS node
FROM node:22.23.4-bookworm-slim AS node
FROM ${BASE_IMAGE}
ENV DEBIAN_FRONTEND=noninteractive
config/docker/daemon-shutdown-descendants/Dockerfile
+1 -1
View File
@@ -1,4 +1,4 @@
FROM node:22-bookworm-slim
FROM node:22.23.4-bookworm-slim
ENV DEBIAN_FRONTEND=noninteractive
ENV NODE_PATH=/usr/local/lib/node_modules
config/docker/headless-pairing/Dockerfile.build
+1 -1
View File
@@ -1,4 +1,4 @@
FROM node:24-bookworm
FROM node:24.22.1-bookworm
ENV DEBIAN_FRONTEND=noninteractive
config/docker/linux-lid-sleep-assertion/Dockerfile
+1 -1
View File
@@ -1,4 +1,4 @@
FROM node:22-bookworm-slim
FROM node:22.23.4-bookworm-slim
ENV container=docker
ENV ORCA_BACKGROUND_LAUNCH=1
config/scripts/benchmark-windows-native-preparation.mjs
+1 -1
View File
@@ -180,7 +180,7 @@ export async function benchmarkWindowsNativePreparation(
) {
assert.equal(process.platform, 'win32', 'This hosted comparison requires Windows')
assert(['x64', 'arm64'].includes(process.arch), 'Unsupported Windows runner')
assert.equal(process.versions.node, '24.21.0', 'Comparison requires pinned Node')
assert.equal(process.versions.node, '24.22.1', 'Comparison requires pinned Node')
assert(
!hasWindowsCompilerSelection(process.env),
'Explicit compiler selection prevents a qualified automatic-capture comparison'
config/scripts/ci-unit-module-cache.test.mjs
+1 -1
View File
@@ -174,7 +174,7 @@ it('runs full same-source controls serially with five four-worker shards and inc
expect(warm.needs).toBe('producer')
for (const job of [baseline, producer, warm]) {
expect(job.uses).toBe('./.github/workflows/unit-tests.yml')
expect(job.with.node_versions).toBe('["24.21.0"]')
expect(job.with.node_versions).toBe('["24.22.1"]')
expect(job.with.runner).toBe('ubuntu-24.04-arm')
expect(JSON.parse(job.with.shards)).toEqual(
Array.from({ length: 5 }, (_, index) => ({ index: index + 1, count: 5 }))
config/scripts/release-javascript-parity.mjs
+6
View File
@@ -94,6 +94,12 @@ export function annotateJavascriptParityFiles(root, files) {
if (manifest) {
content = JSON.stringify(normalizeManifestSourcePaths(JSON.parse(content)))
}
if (file.path === 'renderer/.orca-web-client-files.json') {
const members = JSON.parse(content)
assert(Array.isArray(members) && members.every((member) => typeof member === 'string'))
// Asset aliases can change the order of this file inventory after hash normalization.
content = JSON.stringify(members.sort())
}
return {
...file,
comparablePath,
config/scripts/release-javascript-parity.test.mjs
+24
View File
@@ -206,3 +206,27 @@ it('compares manifest keys without ordering differences while preserving import
})
expect(compareJavascriptParityFiles(before, changed)).toEqual(['renderer/.vite/manifest.json'])
})
it('compares web file membership after asset aliases change their sort order', () => {
const before = inventory({
'renderer/assets/App-AAAAAAAA.js': 'desktop()',
'renderer/assets/App-BBBBBBBB.js': 'web()',
'renderer/.orca-web-client-files.json': '["assets/App-AAAAAAAA.js","assets/App-BBBBBBBB.js"]'
})
const files = {
'renderer/assets/App-CCCCCCCC.js': 'web()',
'renderer/assets/App-DDDDDDDD.js': 'desktop()'
}
const after = inventory({
...files,
'renderer/.orca-web-client-files.json': '["assets/App-CCCCCCCC.js","assets/App-DDDDDDDD.js"]'
})
expect(compareJavascriptParityFiles(before, after)).toEqual([])
const changed = inventory({
...files,
'renderer/.orca-web-client-files.json': '["assets/App-CCCCCCCC.js"]'
})
expect(compareJavascriptParityFiles(before, changed)).toEqual([
'renderer/.orca-web-client-files.json'
])
})
config/scripts/windows-native-preparation-benchmark.test.mjs
+1 -1
View File
@@ -205,7 +205,7 @@ test('manual workflow freezes source and limits Windows occupancy without changi
(step) => step.uses === './.github/actions/install-node-dependencies'
)
assert.equal(install.with['native-runtime'], 'none')
assert.equal(install.with['node-version'], '24.21.0')
assert.equal(install.with['node-version'], '24.22.1')
assert.equal(install.with['cache-pnpm-store'], 'false')
assert.equal(workflow.jobs.compare.steps.at(-1).if, 'always()')
assert(!Object.hasOwn(workflow.jobs, 'verify'))
config/scripts/windows-security-reuse-benchmark.test.mjs
+2 -1
View File
@@ -14,6 +14,7 @@ import { dirname, join } from 'node:path'
import { runInNewContext } from 'node:vm'
import { afterEach, expect, it, vi } from 'vitest'
import { parse } from 'yaml'
import { NODE_RUNTIME_PIN } from '../../src/shared/node-runtime-pin.ts'
import { sha256Of } from './orcad-prebuild-slot-contents.mjs'
import { peImage } from './windows-pe-image-fixture.mjs'
import {
@@ -93,7 +94,7 @@ function windows(arch = 'x64') {
...process,
platform: 'win32',
arch,
versions: { ...process.versions, node: '24.21.0' }
versions: { ...process.versions, node: NODE_RUNTIME_PIN.version }
})
vi.stubEnv('SOURCE_SHA', sourceSha)
vi.stubEnv('BENCHMARK_RUNNER', arch === 'x64' ? 'windows-2022' : 'windows-11-arm')
src/main/managed-server/install/orcad-remote-node-runtime-windows.test.ts
+5 -5
View File
@@ -79,12 +79,12 @@ describe('Windows runtime store commands', () => {
.toMatchInlineSnapshot(`
"$ProgressPreference = 'SilentlyContinue'
function Get-OrcaSha256([string]$p) { if (Test-Path -LiteralPath $p -PathType Leaf) { (Get-FileHash -LiteralPath $p -Algorithm SHA256).Hash.ToLowerInvariant() } else { "" } }
$runtimeDir = 'C:/Users/u/.orca-remote/runtimes/node-ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32'
$exe = 'C:/Users/u/.orca-remote/runtimes/node-ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32/node.exe'
$verified = 'C:/Users/u/.orca-remote/runtimes/node-ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32/.verified'
if ((Get-OrcaSha256 $exe) -eq 'ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32') {
$runtimeDir = 'C:/Users/u/.orca-remote/runtimes/node-d702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5'
$exe = 'C:/Users/u/.orca-remote/runtimes/node-d702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5/node.exe'
$verified = 'C:/Users/u/.orca-remote/runtimes/node-d702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5/.verified'
if ((Get-OrcaSha256 $exe) -eq 'd702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5') {
if (Test-Path -LiteralPath $verified -PathType Leaf) { Write-Output 'ORCA_NODE_RUNTIME_READY'; exit 0 }
try { $adoptOut = ((& $exe --version 2>&1) | ForEach-Object { "$_" }) -join ''; if (($LASTEXITCODE -eq 0) -and ($adoptOut.Trim() -eq 'v24.21.0')) { [IO.File]::WriteAllText($verified, ''); Write-Output 'ORCA_NODE_RUNTIME_READY'; exit 0 } } catch { }
try { $adoptOut = ((& $exe --version 2>&1) | ForEach-Object { "$_" }) -join ''; if (($LASTEXITCODE -eq 0) -and ($adoptOut.Trim() -eq 'v24.22.1')) { [IO.File]::WriteAllText($verified, ''); Write-Output 'ORCA_NODE_RUNTIME_READY'; exit 0 } } catch { }
}
Write-Output 'ORCA_NODE_RUNTIME_MISSING'"
`)
src/shared/node-runtime-pin.ts
+39 -39
View File
@@ -60,12 +60,12 @@ export type NodeRuntimeAsset = {
// @generated-begin by config/scripts/update-node-runtime-pin.mjs
export const NODE_RUNTIME_PIN: NodeRuntimePin = {
version: '24.21.0',
version: '24.22.1',
electron: '43.7.8',
napi: 10,
headers: {
file: 'node-v24.21.0-headers.tar.gz',
sha256: '57c6bee2e30bbbee5bd51d6cc343eb992e174b56a2a1d0eab7a7510771c20ea2'
file: 'node-v24.22.1-headers.tar.gz',
sha256: '322e0a27db9088093ab8347bdc8c7e0aaa21dc9ed548390bf06b394494c09267'
},
windowsImportLibs: {
'win32-arm64': {
@@ -82,69 +82,69 @@ export const NODE_RUNTIME_PIN: NodeRuntimePin = {
export const NODE_RUNTIME_ASSETS: Record<ServerTarget, NodeRuntimeAsset> = {
'darwin-arm64': {
source: 'official',
archive: 'node-v24.21.0-darwin-arm64.tar.gz',
archiveSha256: 'bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057',
executableSha256: 'e4b5a3af0e05c75de2eae013904145f40fe7fc2a6e6f17510128bf45cca4e79b',
executableSize: 122129232
archive: 'node-v24.22.1-darwin-arm64.tar.gz',
archiveSha256: '89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7',
executableSha256: '6f32069480ec14d52b6d7b1f3c7124cfbbc46203abf5ddf5c65b127435f3f329',
executableSize: 122545856
},
'darwin-x64': {
source: 'official',
archive: 'node-v24.21.0-darwin-x64.tar.gz',
archiveSha256: '1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097',
executableSha256: '7abcf39bd37ab251015337ff75304d7555f0d8e88c6e0fbf04bce8ce34636f49',
executableSize: 125270960
archive: 'node-v24.22.1-darwin-x64.tar.gz',
archiveSha256: 'd132557e7ee2b85af08b0c8c34338e65c6430f2238d01f727728ef42dc83b035',
executableSha256: 'cc6f41f72e3eb4460154952e56a35afdd96b6995cea51cd25e637355a2955a51',
executableSize: 125715808
},
'linux-arm64-glibc': {
source: 'official',
archive: 'node-v24.21.0-linux-arm64.tar.gz',
archiveSha256: '724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5',
executableSha256: '0f8949d1028f6d61506b2d5bc57e7e6fe893d7b1997509b7847294fc9c616584',
executableSize: 122893672
archive: 'node-v24.22.1-linux-arm64.tar.gz',
archiveSha256: '33c37be234ba8bee041961047b19160f4d7d0f164e8e246f78bdd10feff148b3',
executableSha256: 'c8c5721679d8d1a09e9987e345d5f9a64899bb85f7a384783ba8a93e6e62348a',
executableSize: 123377224
},
'linux-x64-glibc': {
source: 'official',
archive: 'node-v24.21.0-linux-x64.tar.gz',
archiveSha256: '6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff',
executableSha256: '7fde7b8afa198da66257f42ee2001d874c7355631e6d1579a5fb5ef1f246df4c',
executableSize: 126595440
archive: 'node-v24.22.1-linux-x64.tar.gz',
archiveSha256: 'eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c',
executableSha256: 'e32e2d16081cf644f88392934288086e7662529d0d43277c34f7aad2207cfafb',
executableSize: 126879696
},
'linux-arm64-musl': {
source: 'unofficial',
archive: 'node-v24.21.0-linux-arm64-musl.tar.gz',
archiveSha256: '3048b0811e158ca0d8672b59c839861763e144492980d8d29b369dfee45747e4',
executableSha256: 'fa2789559dbc3603794a229877c244d1c0d06625c124631611ca4e13eac765be',
executableSize: 128653768
archive: 'node-v24.22.1-linux-arm64-musl.tar.gz',
archiveSha256: '8254125825a3e5e834bd8a260dab4c8303f720464a741506ec27989b9ba1769b',
executableSha256: '211a0371ba3e565863ae5358ffd06bc4fb4ffb0e53689d82c9a5b286ab4ad8d1',
executableSize: 129067232
},
'linux-x64-musl': {
source: 'official',
archive: 'node-v24.21.0-linux-x64-musl.tar.gz',
archiveSha256: '3d63405fc65a0d2d2976c1f0bc2fd27bb0bd07212469e705aac3f03ae5ab4c9c',
executableSha256: '2cd83acecc7693ce96bcb4e292ff4c80461b7490028a002abe5a28ac9892bc29',
executableSize: 132204408
archive: 'node-v24.22.1-linux-x64-musl.tar.gz',
archiveSha256: '9b250d29d6ab8ae38dd23019e2c04a6d6b2916ab1dad721c5f6e1da2b2901c6a',
executableSha256: '569128f3066ac7be59b10b9a0adef708def642ee37cbf9d560a9bdb68f872108',
executableSize: 132485920
},
'win32-arm64': {
source: 'official',
archive: 'node-v24.21.0-win-arm64.zip',
archiveSha256: '8779b1bde1d39f8d420e3b57aa657b39891af434d3de44a919044cec06785921',
executableSha256: 'dff59da18b6ffe1bf1ca99e1d2af4906080c481740619f5b5098c0fca28bd9b7',
executableSize: 81881416
archive: 'node-v24.22.1-win-arm64.zip',
archiveSha256: 'a0c807319fede24c4a0d8f84564c82a619bd313b16b10c007c383c2609e99171',
executableSha256: '8bea91dc437fe01e7d92ef0efc6c9eaf654369aaba9b2d3e9841552ea7b95a00',
executableSize: 82150728
},
'win32-x64': {
source: 'official',
archive: 'node-v24.21.0-win-x64.zip',
archiveSha256: '158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541',
executableSha256: 'ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32',
executableSize: 93580104
archive: 'node-v24.22.1-win-x64.zip',
archiveSha256: 'd2046d28c2c3dcd211ac5145c0bf30e2047ef9dfb306693c8c6e2eccd8b95fa5',
executableSha256: 'd702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5',
executableSize: 93915464
}
}
export const NODE_RUNTIME_COMPAT_ASSETS: Record<CompatServerTarget, NodeRuntimeAsset> = {
'linux-x64-glibc217': {
source: 'unofficial',
archive: 'node-v24.21.0-linux-x64-glibc-217.tar.gz',
archiveSha256: 'b1d164136d4b218d663e664f40ba5e260ebc07f90e2bd784c63a57d8c0e6aa8a',
executableSha256: '1e75c95b1af4ec41e83d75816856b205f00c9427fd7d2dadd81472b38ff53d2c',
executableSize: 139511096
archive: 'node-v24.22.1-linux-x64-glibc-217.tar.gz',
archiveSha256: '422ddeec2c08902a34ef80ae25de388c7b7e2920763030a5262d56b10675c570',
executableSha256: '6ecc984d4bd0ff3012e91efa39eaf5f7e519037d5b1cbab8a6e1bb5c7914e18a',
executableSize: 139795880
}
}
// @generated-end
tests/e2e/fixtures/docker-ssh-host/Dockerfile
+3
View File
@@ -1,5 +1,8 @@
FROM node:22.23.4-bookworm@sha256:2bd396628eceb5c999a6e43731fab69d5fb98b94ba9d9d90b5f64575c5178765 AS patched-node
FROM node:22-bookworm@sha256:5647be709086c696ff32edaaf1c70cd26d1da6ab2b39c32f3c7b4c4a31957e37
COPY --from=patched-node /usr/local/bin/node /usr/local/bin/node
# Why: immutable snapshot inputs keep the SSH/Git fixture identical across rebuild dates.
RUN sed -i \
-e 's|http://deb.debian.org/debian-security|https://snapshot.debian.org/archive/debian-security/20260713T000000Z|' \