codegraph

mirror of https://github.com/colbymchenry/codegraph.git synced 2026-10-25 03:49:59 +08:00

Files

T

Colby MchenryandClaude Opus 5.5 b8c3c032be fix(bundle): bundle Node 24.22.1, the October security release, and verify the download (#2817 )

Release bundles were set to ship Node 24.21.0. The release workflow runs
build-bundle.sh with no version, so the script's default decides the Node
every bundle carries, and that default predates Node's October 2026
security release. v24.22.1 (2026-10-20) fixes 8 CVEs, 4 rated High (TLS,
DNS, Brotli), and ships OpenSSL 3.5.9. It keeps V8 13.6.233.17, libuv
1.52.1 and module ABI 137, and it carries 24.20.0's fix for the Windows
abort at exit (issue #2617). The script also never checked the Node
download against the SHA-256 sums nodejs.org publishes.

Fix:
- The default and the usage example move to v24.22.1. The comment and a
  new test hold the default at 24.22.1 or later, on 24.x.
- Step 1 downloads the release's SHASUMS256.txt and refuses the archive,
  before unpacking anything, unless its SHA-256 matches the listed one.
  The zip and tar.gz downloads now share that one code path (sha256sum,
  or shasum on macOS).
- The unreleased CHANGELOG bullet for issue #2617 now names 24.22.1 and
  the check. BUNDLING.md describes the check.

Validation (Windows 11 x64):
- bundle-launcher.test.ts: 4 new tests (the version floor; a matching
  download is unpacked; a mismatched or unlisted one is refused before
  unpacking). With main's build-bundle.sh all 4 fail; with the fix the
  file has 7 passed and 3 POSIX-only skipped.
- build-bundle.sh win32-x64 with the new default: the check passed
  (sha256 d2046d28...8b95fa5, as listed). The bundled node.exe is
  byte-identical to the official v24.22.1 one and prints v24.22.1
  (OpenSSL 3.5.9). Its launchers from Git Bash, cmd and PowerShell, with
  no system Node on PATH, ran --version, init, status, query, callers and
  sync on a small TypeScript + Python fixture: all exit 0.
- Node's own reproducer for the exit abort, 300 runs per mode, 4 at a
  time: the bundled v24.22.1 exited cleanly 300/300 in all three modes.
  The official v24.16.0 control aborted 299/300 with 0xC0000409 when the
  child ran directly.
- 13 runtime-facing test files (sqlite, wasm flags, worker and stdin
  teardown, watcher, launcher, shim) run on the bundled node.exe: 136
  passed, 22 skipped, 0 failed.

Fixes #2780

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-22 23:32:10 +00:00

add-lang

fix(add-lang): check-grammar fails a grammar that crashes or hangs its process (#2808 )

2026-10-22 17:04:12 +00:00

agent-eval

fix(agent-eval): accept the trust dialog on "Yes", never type into a bare shell (#1925 )

2026-10-20 04:22:24 +00:00

benchmarks

fix: restore call graph relationships and Steps effects (#1862 )

2026-09-15 05:30:09 +00:00

build-bundle.sh

fix(bundle): bundle Node 24.22.1, the October security release, and verify the download (#2817 )