Backup/SnowLuma
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(security): update runtime baseline and vulnerable dependencies

Browse Source 
Require patched Node.js releases and refresh affected application and build dependencies.

Align installation requirements, startup checks, and release workflows with the security baseline.
This commit is contained in:
DrSmoothl
2026-10-22 01:00:13 +08:00
parent 8fc68c0ec3
commit c5464e48d1
30 changed files with 420 additions and 342 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/dev-build.yml
+1 -1
View File
@@ -141,7 +141,7 @@ jobs:
# Naming convention:
# SnowLuma-dev-<arch>.zip|tar.gz – zero-install (node bundled)
# SnowLuma-dev-<arch>-lite.zip|tar.gz – user provides Node 24+
# SnowLuma-dev-<arch>-lite.zip|tar.gz – user provides Node ^24.22.1 or >=26.12.1
- name: Package (windows)
if: matrix.os == 'windows-latest'
shell: pwsh
.github/workflows/mcp-npm-publish.yml
+2 -3
View File
@@ -41,9 +41,8 @@ jobs:
uses: actions/setup-node@v6
with:
# Trusted Publishing requires Node >=22.14 and npm >=11.5.1.
# Node 24 ships a supported npm CLI; the application runtime stays
# pinned separately by .node-version.
node-version: '24'
# Use the same patched runtime as application builds.
node-version-file: '.node-version'
cache: 'pnpm'
registry-url: 'https://registry.npmjs.org'
.github/workflows/release.yml
+2 -2
View File
@@ -90,7 +90,7 @@ jobs:
# Naming convention:
# SnowLuma-<tag>-<arch>.zip|tar.gz – zero-install (node bundled)
# SnowLuma-<tag>-<arch>-lite.zip|tar.gz – user provides Node 24+
# SnowLuma-<tag>-<arch>-lite.zip|tar.gz – user provides Node ^24.22.1 or >=26.12.1
- name: Package (windows)
if: matrix.os == 'windows-latest'
shell: pwsh
@@ -157,7 +157,7 @@ jobs:
## 选择下载
| 平台 | 完整版（内置 Node.js，推荐） | Lite（Node.js 24+） |
| 平台 | 完整版（内置 Node.js，推荐） | Lite（Node.js 24.22.1 / 26.12.1 起） |
| --- | --- | --- |
| Windows x64 | \`SnowLuma-${tag}-win-x64.zip\` | \`SnowLuma-${tag}-win-x64-lite.zip\` |
| Linux x64 | \`SnowLuma-${tag}-linux-x64.tar.gz\` | \`SnowLuma-${tag}-linux-x64-lite.tar.gz\` |
.github/workflows/sdk-npm-publish.yml
+2 -3
View File
@@ -38,9 +38,8 @@ jobs:
uses: actions/setup-node@v6
with:
# Trusted Publishing requires Node >=22.14 and npm >=11.5.1.
# Node 24 ships a supported npm CLI; the application runtime stays
# pinned separately by .node-version.
node-version: '24'
# Use the same patched runtime as application builds.
node-version-file: '.node-version'
cache: 'pnpm'
registry-url: 'https://registry.npmjs.org'
.github/workflows/ui-npm-publish.yml
+2 -3
View File
@@ -38,9 +38,8 @@ jobs:
uses: actions/setup-node@v6
with:
# Trusted Publishing requires Node >=22.14 and npm >=11.5.1.
# Node 24 ships a supported npm CLI; the application runtime stays
# pinned separately by .node-version.
node-version: '24'
# Use the same patched runtime as application builds.
node-version-file: '.node-version'
cache: 'pnpm'
registry-url: 'https://registry.npmjs.org'
.node-version
+1 -1
View File
@@ -1 +1 @@
24.21.0
24.22.1
AGENTS.md
+2
View File
@@ -54,6 +54,8 @@ Read the relevant owner before changing a path:
Use the Node version in [.node-version](.node-version) and the pnpm version in [package.json](package.json). Install with `pnpm install --frozen-lockfile`; keep the existing lockfile unless changing dependencies.
The Node security baseline is `^24.22.1 || >=26.12.1`; older 24.x releases, 25.x and unpatched 26.x releases are unsupported. Keep workspace `engines.node` declarations and [the launcher preflight](packages/runtime/check-node-version.cjs) aligned. CI and bundled releases use `.node-version`; raising that pin alone does not upgrade an existing installation's runtime.
Run commands from the repository root:
```sh
CONTRIBUTING.md
+1 -1
View File
@@ -58,7 +58,7 @@ SnowLuma 处于开发早期，迭代速度很快，**接口与目录结构随时
### 系统要求
- **Node.js 24+**
- **Node.js 24.22.1（24 系列），或 26.12.1 及更新版本**；开发和构建使用 [`.node-version`](.node-version) 固定的版本。
- **pnpm 11.25.0**（项目通过 `packageManager` 与 CI 统一版本）
- macOS / Linux / Windows 均可。如果要构建原生产物，需要对应平台的工具链。
package.json
+3 -3
View File
@@ -35,8 +35,8 @@
"devDependencies": {
"@eslint/js": "^10.0.1",
"@stylistic/eslint-plugin": "5.10.0",
"@vitest/coverage-istanbul": "4.1.4",
"@vitest/coverage-v8": "^4.1.4",
"@vitest/coverage-istanbul": "4.1.11",
"@vitest/coverage-v8": "4.1.11",
"cross-env": "^10.1.0",
"eslint": "^10.2.0",
"eslint-config-prettier": "10.1.8",
@@ -50,7 +50,7 @@
},
"packageManager": "pnpm@11.25.0",
"engines": {
"node": ">=24",
"node": "^24.22.1 || >=26.12.1",
"pnpm": "11.25.0"
}
}
packages/bridge/package.json
+2 -2
View File
@@ -61,9 +61,9 @@
"@types/node": "catalog:",
"typescript": "catalog:",
"vite": "catalog:",
"vitest": "^4.1.4"
"vitest": "4.1.11"
},
"engines": {
"node": ">=24"
"node": "^24.22.1 || >=26.12.1"
}
}
packages/common/package.json
+2 -2
View File
@@ -109,7 +109,7 @@
"@types/node": "catalog:",
"@types/semver": "7.7.1",
"typescript": "catalog:",
"vitest": "^4.1.4"
"vitest": "4.1.11"
},
"dependencies": {
"@zxcvbn-ts/core": "^4.1.2",
@@ -118,6 +118,6 @@
"semver": "7.7.4"
},
"engines": {
"node": ">=24"
"node": "^24.22.1 || >=26.12.1"
}
}
packages/core/package.json
+3 -3
View File
@@ -57,15 +57,15 @@
"@rollup/plugin-node-resolve": "^16.0.3",
"@types/node": "catalog:",
"cross-env": "^10.1.0",
"hono": "^4.12.34",
"hono": "^4.13.11",
"tsx": "^4.21.0",
"typescript": "catalog:",
"vite": "catalog:",
"vite-plugin-cp": "^6.0.3",
"vitest": "^4.1.4",
"vitest": "4.1.11",
"@snowluma/sqlite": "workspace:*"
},
"engines": {
"node": ">=24"
"node": "^24.22.1 || >=26.12.1"
}
}
packages/core/tests/runtime-node-version.test.ts
+42 -10
View File
@@ -1,4 +1,5 @@
import { createRequire } from 'node:module';
import { readFileSync, readdirSync } from 'node:fs';
import { describe, expect, it } from 'vitest';
const require = createRequire(import.meta.url);
@@ -9,17 +10,48 @@ const { SUPPORTED_NODE_RANGE, isSupportedNodeVersion } =
};
describe('runtime Node.js preflight', () => {
it('accepts the documented minimum and newer versions', () => {
expect(SUPPORTED_NODE_RANGE).toBe('>=24');
expect(isSupportedNodeVersion('24.0.0')).toBe(true);
expect(isSupportedNodeVersion('24.21.0')).toBe(true);
expect(isSupportedNodeVersion('26.0.0')).toBe(true);
it.each(['24.22.1', '24.22.2', '24.23.0', '24.22.1+vendor.1', '26.12.1', '26.13.0', '27.0.0'])(
'accepts patched stable Node.js %s',
(version) => {
expect(isSupportedNodeVersion(version)).toBe(true);
},
);
it.each([
'22.23.4',
'23.99.99',
'24.0.0',
'24.21.0',
'24.22.0',
'25.99.99',
'26.0.0',
'26.11.99',
'26.12.0',
'24.22.1-rc.1',
'26.12.1-rc.1',
'not-a-version',
])('rejects unpatched, unsupported or malformed Node.js %s', (version) => {
expect(isSupportedNodeVersion(version)).toBe(false);
});
it('rejects older and malformed versions', () => {
expect(isSupportedNodeVersion('22.99.99')).toBe(false);
expect(isSupportedNodeVersion('23.99.99')).toBe(false);
expect(isSupportedNodeVersion('21.99.99')).toBe(false);
expect(isSupportedNodeVersion('not-a-version')).toBe(false);
it('keeps workspace requirements and the bundled runtime baseline aligned', () => {
expect(SUPPORTED_NODE_RANGE).toBe('^24.22.1 || >=26.12.1');
const root = new URL('../../../', import.meta.url);
const packages = readdirSync(new URL('packages/', root), { withFileTypes: true });
const manifests = [
new URL('package.json', root),
...packages
.filter((entry) => entry.isDirectory())
.map((entry) => new URL(`packages/${entry.name}/package.json`, root)),
];
for (const manifest of manifests) {
const pkg = JSON.parse(readFileSync(manifest, 'utf8'));
expect(pkg.engines.node, manifest.pathname).toBe(SUPPORTED_NODE_RANGE);
}
const baseline = readFileSync(new URL('.node-version', root), 'utf8').trim();
expect(baseline).toBe('24.22.1');
expect(isSupportedNodeVersion(baseline)).toBe(true);
});
});
packages/mcp/package.json
+3 -3
View File
@@ -40,7 +40,7 @@
"qq"
],
"dependencies": {
"@modelcontextprotocol/sdk": "^1.0.0"
"@modelcontextprotocol/sdk": "^1.32.0"
},
"devDependencies": {
"@snowluma/onebot": "workspace:*",
@@ -48,10 +48,10 @@
"@types/node": "catalog:",
"typescript": "catalog:",
"vite": "catalog:",
"vitest": "^4.1.4"
"vitest": "4.1.11"
},
"engines": {
"node": ">=24"
"node": "^24.22.1 || >=26.12.1"
},
"publishConfig": {
"access": "public"
packages/onebot/package.json
+2 -2
View File
@@ -119,9 +119,9 @@
"@types/node": "catalog:",
"typescript": "catalog:",
"vite": "catalog:",
"vitest": "^4.1.4"
"vitest": "4.1.11"
},
"engines": {
"node": ">=24"
"node": "^24.22.1 || >=26.12.1"
}
}
packages/proto-defs/package.json
+1 -1
View File
@@ -84,6 +84,6 @@
"typescript": "catalog:"
},
"engines": {
"node": ">=24"
"node": "^24.22.1 || >=26.12.1"
}
}
packages/protocol/package.json
+2 -2
View File
@@ -121,9 +121,9 @@
"@types/node": "catalog:",
"typescript": "catalog:",
"vite": "catalog:",
"vitest": "^4.1.4"
"vitest": "4.1.11"
},
"engines": {
"node": ">=24"
"node": "^24.22.1 || >=26.12.1"
}
}
packages/proton/package.json
+2 -2
View File
@@ -39,9 +39,9 @@
"@types/node": "catalog:",
"tsup": "^8.5.0",
"vite": "catalog:",
"vitest": "^4.1.4"
"vitest": "4.1.11"
},
"engines": {
"node": ">=24"
"node": "^24.22.1 || >=26.12.1"
}
}
packages/runtime/check-node-version.cjs
+6 -4
View File
@@ -1,9 +1,9 @@
'use strict';
const SUPPORTED_NODE_RANGE = '>=24';
const SUPPORTED_NODE_RANGE = '^24.22.1 || >=26.12.1';
function parseNodeVersion(version) {
const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(version);
const match = /^(\d+)\.(\d+)\.(\d+)(?:\+[0-9A-Za-z.-]+)?$/.exec(version);
return match ? match.slice(1, 4).map(Number) : null;
}
@@ -11,8 +11,10 @@ function isSupportedNodeVersion(version) {
const actual = parseNodeVersion(version);
if (!actual) return false;
const [major] = actual;
return major >= 24;
const [major, minor, patch] = actual;
if (major === 24) return minor > 22 || (minor === 22 && patch >= 1);
if (major === 26) return minor > 12 || (minor === 12 && patch >= 1);
return major > 26;
}
if (require.main === module && !isSupportedNodeVersion(process.versions.node)) {
packages/runtime/launcher.sh
+1 -1
View File
@@ -8,7 +8,7 @@ if [[ -x "./node" ]]; then
else
NODE_BIN="$(command -v node || true)"
if [[ -z "$NODE_BIN" ]]; then
echo "error: 'node' not found on PATH and no bundled ./node; install Node.js 24+." >&2
echo "error: 'node' not found on PATH and no bundled ./node; install Node.js 24.22.1 (24.x) or >=26.12.1." >&2
exit 127
fi
fi
packages/runtime/package.json
+1 -1
View File
@@ -7,6 +7,6 @@
"main": "index.mjs",
"description": "SnowLuma runtime distribution manifest: ships into dist/ (launcher.bat, package.json, native/*.dll, native/*.node). All native bindings ship as standalone `.node` files in `dist/native/` — loaded via `process.dlopen()` / `createRequire().require()` from inside the bundle. There are intentionally NO runtime npm dependencies; production artifacts are self-contained.",
"engines": {
"node": ">=24"
"node": "^24.22.1 || >=26.12.1"
}
}
packages/sdk/CHANGELOG.md
+4
View File
@@ -1,5 +1,9 @@
# Changelog
## Unreleased
- Require patched Node.js releases: 24.22.1 or newer in the 24.x line, or 26.12.1 and newer.
## 2.0.0
Upgrade to Node.js 24 or newer before updating the SDK. SDK and application versions are released together.
packages/sdk/VERSIONING.md
+2
View File
@@ -11,6 +11,8 @@ The SDK follows SemVer for its public package surface:
SDK and application versions are synchronized by `pnpm bump <version>` from the repository root.
The current Node.js requirement is `^24.22.1 || >=26.12.1`. Use the repository's `.node-version` for development and builds.
- Major: removes or changes a public export, changes runtime behavior incompatibly, changes supported Node version, or changes package subpaths.
- Minor: adds new public API, supports new SnowLuma actions, adds optional parameters, or adds error subclasses.
- Patch: fixes bugs, improves docs, narrows implementation details without breaking public types, or updates action metadata without changing call signatures.
packages/sdk/package.json
+2 -2
View File
@@ -85,11 +85,11 @@
"access": "public"
},
"engines": {
"node": ">=24"
"node": "^24.22.1 || >=26.12.1"
},
"devDependencies": {
"@types/node": "catalog:",
"typescript": "catalog:",
"vitest": "^4.1.4"
"vitest": "4.1.11"
}
}
packages/sqlite/package.json
+2 -2
View File
@@ -28,9 +28,9 @@
"@types/node": "catalog:",
"typescript": "catalog:",
"vite": "catalog:",
"vitest": "^4.1.4"
"vitest": "4.1.11"
},
"engines": {
"node": ">=24"
"node": "^24.22.1 || >=26.12.1"
}
}
packages/ui/package.json
+1 -1
View File
@@ -53,7 +53,7 @@
"access": "public"
},
"engines": {
"node": ">=24"
"node": "^24.22.1 || >=26.12.1"
},
"peerDependencies": {
"react": "^19.0.0",
packages/websocket/package.json
+2 -2
View File
@@ -20,9 +20,9 @@
"devDependencies": {
"@types/node": "catalog:",
"typescript": "catalog:",
"vitest": "^4.1.4"
"vitest": "4.1.11"
},
"engines": {
"node": ">=24"
"node": "^24.22.1 || >=26.12.1"
}
}
packages/webui/package.json
+2 -2
View File
@@ -50,9 +50,9 @@
"typescript": "catalog:",
"typescript-eslint": "^8.58.2",
"vite": "catalog:",
"vitest": "^4.1.4"
"vitest": "4.1.11"
},
"engines": {
"node": ">=24"
"node": "^24.22.1 || >=26.12.1"
}
}
pnpm-lock.yaml
Generated
+309 -278
View File
File diff suppressed because it is too large Load Diff
pnpm-workspace.yaml
+13 -5
View File
@@ -3,7 +3,7 @@ packages:
catalog:
'@types/node': 24.19.2
vite: ^8.0.16
vite: ~8.1.6
typescript: ~6.0.2
overrides:
@@ -11,13 +11,21 @@ overrides:
'esbuild@<0.28.1': ^0.28.1
'@babel/core@<7.29.6': ^7.29.6
'qs@<=6.15.3': ^6.16.0
'fast-uri@<3.1.6': ^3.1.6
'fast-uri@<3.1.8': ^3.1.8
'@hono/node-server@<1.19.15': ^1.19.15
'hono': ~4.12.34
'hono': ~4.13.11
'postcss@<=8.5.22': ^8.5.23
'ip-address@<=10.3.0': ^10.3.1
'ip-address@<10.7.1': ^10.7.1
'body-parser@<2.3.0': ^2.3.0
'brace-expansion@<5.0.7': ^5.0.7
'brace-expansion@<5.0.12': ^5.0.12
'undici@>=8.0.0 <8.12.2': 8.12.2
'browserslist@<4.28.7': 4.28.7
'@humanfs/node@<0.16.8': 0.16.8
'baseline-browser-mapping@<2.11.0': 2.11.0
'figlet@<1.11.3': 1.11.3
'seroval@<1.6.3': 1.6.3
'source-map-js@<1.2.2': 1.2.2
'proxy-addr@<2.0.8': 2.0.8
peerDependencyRules:
allowedVersions: