Require patched Node.js releases and refresh affected application and build dependencies.
Align installation requirements, startup checks, and release workflows with the security baseline.
* feat(core): carry hook process status in notifications
`offline` alone cannot tell an external supervisor whether the QQ session dropped (log back in) or the process is gone (restart the client). Resolve the hook process behind a UIN at notify time and expose `status`, `pid` and `error` as template variables; a failing lookup degrades to empty values so delivery is never blocked.
The default webhook/email templates gain a process-status line; existing channels keep their stored template untouched.
* fix(core): preserve notification lifecycle ordering and simplify state
---------
Co-authored-by: zhngzhu <215231231+zhngzhu@users.noreply.github.com>
Co-authored-by: 手瓜一十雪 <nanaeonn@outlook.com>
Move database work off the main thread on Node.js 24 and improve message handling and runtime diagnostics.
Preserve migration, restart, and concurrency coverage with the async SQLite driver.
SNOWLUMA_ variables can set the factory OneBot listen ports, WebUI TLS,
packet and hook timeouts, the stream directory, file download timeout,
and notification HTTP timeout. The values apply in memory and are not
written back to saved config.
Use safer defaults for newly created service endpoints and guide operators toward suitable access credentials without disrupting existing deployments.
Apply the same policy at the save boundary, retain deliberate local-only setups and external client compatibility, and add regression coverage for editing, recovery, and trusted access paths.
DrSmoothl