Release bundles were set to ship Node 24.21.0. The release workflow runs
build-bundle.sh with no version, so the script's default decides the Node
every bundle carries, and that default predates Node's October 2026
security release. v24.22.1 (2026-10-20) fixes 8 CVEs, 4 rated High (TLS,
DNS, Brotli), and ships OpenSSL 3.5.9. It keeps V8 13.6.233.17, libuv
1.52.1 and module ABI 137, and it carries 24.20.0's fix for the Windows
abort at exit (issue #2617). The script also never checked the Node
download against the SHA-256 sums nodejs.org publishes.
Fix:
- The default and the usage example move to v24.22.1. The comment and a
new test hold the default at 24.22.1 or later, on 24.x.
- Step 1 downloads the release's SHASUMS256.txt and refuses the archive,
before unpacking anything, unless its SHA-256 matches the listed one.
The zip and tar.gz downloads now share that one code path (sha256sum,
or shasum on macOS).
- The unreleased CHANGELOG bullet for issue #2617 now names 24.22.1 and
the check. BUNDLING.md describes the check.
Validation (Windows 11 x64):
- bundle-launcher.test.ts: 4 new tests (the version floor; a matching
download is unpacked; a mismatched or unlisted one is refused before
unpacking). With main's build-bundle.sh all 4 fail; with the fix the
file has 7 passed and 3 POSIX-only skipped.
- build-bundle.sh win32-x64 with the new default: the check passed
(sha256 d2046d28...8b95fa5, as listed). The bundled node.exe is
byte-identical to the official v24.22.1 one and prints v24.22.1
(OpenSSL 3.5.9). Its launchers from Git Bash, cmd and PowerShell, with
no system Node on PATH, ran --version, init, status, query, callers and
sync on a small TypeScript + Python fixture: all exit 0.
- Node's own reproducer for the exit abort, 300 runs per mode, 4 at a
time: the bundled v24.22.1 exited cleanly 300/300 in all three modes.
The official v24.16.0 control aborted 299/300 with 0xC0000409 when the
child ran directly.
- 13 runtime-facing test files (sqlite, wasm flags, worker and stdin
teardown, watcher, launcher, shim) run on the bundled node.exe: 136
passed, 22 skipped, 0 failed.
Fixes#2780
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Root cause: every release bundles the Node that scripts/build-bundle.sh
defaults to, since the release workflow passes only the target, and that
default was v24.16.0. On Windows that Node can abort just as the process
exits, after the command's work is done: a V8 worker posts a delayed task
after the platform's delayed-task scheduler has started closing its uv_async
handle, and libuv fails "Assertion failed: !(handle->flags &
UV_HANDLE_CLOSING), file src\win\async.c, line 94" with status 0xC0000409
(nodejs/node issue 56645). Node fixed it in 24.20.0 (nodejs/node PR 61999).
Fix: the default moves to v24.21.0, the newest 24.x LTS release that is at
least two weeks old (2026-09-07). It also carries the Windows 8.3 short-path
file-watcher fix (nodejs/node PR 65118). V8 13.6.233.17, libuv 1.52.1 and the
module ABI (137, N-API 10) are unchanged; SQLite goes from 3.53.0 to 3.53.4.
A comment at the default says why it must stay on 24.x at 24.20.0 or later,
and a test pins that, along with the workflow passing only the target.
Validation, on Windows 11 x64:
- Node's own regression test for the crash
(test-process-exit-after-fetch-throw.js, from the v24.21.0 tag), 300 runs
per arm, against the official win-x64 node.exe of each version (zips checked
against nodejs.org's SHASUMS256.txt): v24.16.0 aborted 300/300 with
0xC0000409 and that async.c line 94 assertion, and the test as written
failed 300/300; v24.21.0 passed 300/300. With the launchers' --liftoff-only
both passed 300/300, since that flag only removes this test's trigger.
- build-bundle.sh win32-x64 builds the bundle on this machine. Its node.exe is
byte-identical to the official v24.21.0 one. --version through the Git Bash
launcher, cmd and PowerShell, then init, status, query, callers and sync on
a small TypeScript and Python project all exit 0, on the wasm path and with
the native kernel bundled.
- The real CLI (index, status -j, sync) run 300 times per runtime on the
bundled app: 0 nonzero exits on either.
- The runtime-facing test files (WASM flags, node:sqlite backend and open
errors, launchers, worker teardown, version check) pass under Node 24.21.0:
9 files, 65 passed, 3 skipped (POSIX-only).
- The new test fails on main's script (expected 16 to be greater than or
equal to 20) and passes with the fix.
Fixes#2617
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ship an extensionless shell launcher alongside codegraph.cmd for Windows.
Use bundled node.exe with matching runtime flags and preserve arguments, exit status, and inherited host PID.
Validate on Windows 11, macOS, and Linux, including CLI/hooks and archive contents.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
