Skip to content

fix: consolidate security updates and repair stale-lock recovery #205

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
siracusa5 merged 3 commits into from
Oct 26, 2026
Merged

fix: consolidate security updates and repair stale-lock recovery #205

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
dbf121d
fix(deps): consolidate security patches and pending dependency updates
siracusa5 Oct 25, 2026
a8ce6a9
fix(ci): require the Node patch floor for Astro builds
siracusa5 Oct 25, 2026
ed5cae3
fix(engine): distinguish stale lock owner generations during recovery
siracusa5 Oct 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/app-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -679,7 +679,7 @@ jobs:
- name: Setup Node
uses: actions/setup-node@v7
with:
node-version: 22
node-version: '^22.23.4'
cache: npm
cache-dependency-path: apps/site/package-lock.json

Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ concurrency:
cancel-in-progress: true

env:
NODE_VERSION: '22'
# Astro's app toolchain requires this patch floor; cached older 22.x fails.
NODE_VERSION: '^22.23.4'

jobs:
engine:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,12 +24,12 @@ jobs:
uses: actions/checkout@v7

- name: Initialize CodeQL
uses: github/codeql-action/init@v4.38.0
uses: github/codeql-action/init@v4.39.0
with:
languages: javascript-typescript
build-mode: none

- name: Analyze
uses: github/codeql-action/analyze@v4.38.0
uses: github/codeql-action/analyze@v4.39.0
with:
category: "/language:javascript-typescript"
2 changes: 1 addition & 1 deletion .github/workflows/site-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ concurrency:

env:
CLOUDFLARE_PROJECT_NAME: contextcake
NODE_VERSION: '22'
NODE_VERSION: '^22.23.4'
# Exposed so the deploy step can skip cleanly until the secret is configured.
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

Expand Down
676 changes: 273 additions & 403 deletions apps/console/package-lock.json
View file
Open in desktop

Large diffs are not rendered by default.

12 changes: 6 additions & 6 deletions apps/console/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,16 +19,16 @@
},
"dependencies": {
"@fontsource/jetbrains-mono": "^5.3.0",
"react": "^19.3.0",
"react-dom": "^19.3.0"
"react": "^19.3.1",
"react-dom": "^19.3.1"
},
"devDependencies": {
"@types/react": "^19.3.0",
"@types/react-dom": "^19.3.0",
"@vitejs/plugin-react": "^6.1.1",
"jsdom": "^30.0.1",
"@vitejs/plugin-react": "^6.1.2",
"jsdom": "^30.1.3",
"typescript": "^7.0.2",
"vite": "^8.3.0",
"vitest": "^4.1.11"
"vite": "^8.3.5",
"vitest": "^5.0.5"
}
}
5 changes: 5 additions & 0 deletions apps/desktop/CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,11 @@ CC_DEB_MAINTAINER="Name <address>" npm run dist:linux # the x64 .deb (runs on

## Gotchas

- **Warm Electron before parallel tests.** Electron 44 downloads its binary on
first `require('electron')` instead of during `npm ci`. The `pretest` hook
resolves it once before `node --test` starts workers; without that hook,
fresh installs can race while extracting the same binary. Keep this serial
warmup (which also respects `ELECTRON_OVERRIDE_DIST_PATH`).
- **CI runs Node 22; a green local run on Node 24 is not proof.** The two differ
on when the test runner gives up on a pending promise, and this package is
full of deliberately `unref()`ed timers (ack deadlines, the watchdog), so a
Expand Down
116 changes: 58 additions & 58 deletions apps/desktop/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 3 additions & 2 deletions apps/desktop/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
"renderer": "npm --prefix ../console run build:live",
"start": "electron .",
"dev": "npm run renderer && electron .",
"pretest": "node -e \"require('electron')\"",
"test": "node --test test/*.test.mjs",
"icon": "electron scripts/generate-icon.mjs",
"test:navigation": "node scripts/navigation-test.mjs",
Expand All @@ -33,11 +34,11 @@
"dist:linux": "npm run renderer && node scripts/dist-linux.mjs"
},
"dependencies": {
"@supabase/supabase-js": "2.116.0",
"@supabase/supabase-js": "2.117.2",
"electron-updater": "^6.8.9"
},
"devDependencies": {
"electron": "^43.2.0",
"electron": "^44.9.3",
"electron-builder": "^26.15.3"
}
}
Loading
Loading