diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ffe8baac..807b0881 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -125,7 +125,7 @@ jobs: if: ${{ contains(fromJSON(needs.classify.outputs.go_plan).test, 'cyberagent-workbench/internal/dependencycache') }} uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24 + node-version: '24.22.1' - name: Prepare integrity-pinned package preparation fixtures if: ${{ contains(fromJSON(needs.classify.outputs.go_plan).test, 'cyberagent-workbench/internal/dependencycache') }} run: | @@ -335,7 +335,7 @@ jobs: cache: true - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24 + node-version: '24.22.1' - name: Install reviewed real language servers shell: pwsh run: | @@ -384,7 +384,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24 + node-version: '24.22.1' cache: npm cache-dependency-path: web/package-lock.json - run: npm ci @@ -452,6 +452,8 @@ jobs: cache: true - name: Report Go toolchain run: go version + - name: Update rustup certificate trust + run: rustup self update - name: Install pinned Rust toolchain run: rustup toolchain install 1.97.1 --profile minimal --component rustfmt --component clippy - run: cargo fmt --all -- --check @@ -546,7 +548,7 @@ jobs: esac - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24 + node-version: '24.22.1' cache: npm cache-dependency-path: web/package-lock.json - name: Build embedded renderer @@ -657,9 +659,11 @@ jobs: ./scripts/prepare-windows-fixed-go.ps1 -ExpectedGoVersion $env:TRAVERSE_CI_GO_VERSION - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24 + node-version: '24.22.1' cache: npm cache-dependency-path: web/package-lock.json + - name: Update rustup certificate trust + run: rustup self update - name: Install pinned Rust toolchain run: rustup toolchain install 1.97.1 --profile minimal - name: Build deterministic Rust fixture diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml index 5b2f302f..48b5722e 100644 --- a/.github/workflows/release-desktop.yml +++ b/.github/workflows/release-desktop.yml @@ -199,10 +199,10 @@ jobs: go-version-file: go.mod cache: true - - name: Set up pinned Node 24.16.0 + - name: Set up pinned Node 24.22.1 uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: '24.16.0' + node-version: '24.22.1' cache: npm cache-dependency-path: web/package-lock.json @@ -218,6 +218,8 @@ jobs: working-directory: web run: npm ci --ignore-scripts + - name: Update rustup certificate trust + run: rustup self update - name: Install pinned Rust toolchain run: rustup toolchain install 1.97.1 --profile minimal @@ -258,10 +260,10 @@ jobs: with: go-version-file: go.mod cache: true - - name: Set up pinned Node 24.16.0 + - name: Set up pinned Node 24.22.1 uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: '24.16.0' + node-version: '24.22.1' cache: npm cache-dependency-path: web/package-lock.json - name: Build embedded renderer @@ -337,13 +339,15 @@ jobs: go-version-file: go.mod cache: true - - name: Set up pinned Node 24.16.0 + - name: Set up pinned Node 24.22.1 uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: '24.16.0' + node-version: '24.22.1' cache: npm cache-dependency-path: web/package-lock.json + - name: Update rustup certificate trust + run: rustup self update - name: Install pinned Rust toolchain for the fixture oracle shell: pwsh run: rustup toolchain install 1.97.1 --profile minimal diff --git a/README.en.md b/README.en.md index e545557d..a6681cdf 100644 --- a/README.en.md +++ b/README.en.md @@ -52,7 +52,7 @@ Packages retain their historical filenames; the product name shown in the applic ### Option 2: Build from Source -Install **Go as pinned in [go.mod](go.mod), currently 1.26.10**, and **Node.js 24** (CI uses 24.16.0), then clone the repository: +Install **Go as pinned in [go.mod](go.mod), currently 1.26.10**, and **Node.js 24** (CI uses 24.22.1), then clone the repository: ```bash git clone https://github.com/CWNU-Open-Source-Community/Universal-Code.git diff --git a/README.md b/README.md index 82d903ec..07dd6f75 100644 --- a/README.md +++ b/README.md @@ -52,7 +52,7 @@ ### 方式二：从源码构建运行 -安装 **Go（版本遵循 [go.mod](go.mod)，当前为 1.26.10）** 与 **Node.js 24**（CI 使用 24.16.0），然后克隆仓库： +安装 **Go（版本遵循 [go.mod](go.mod)，当前为 1.26.10）** 与 **Node.js 24**（CI 使用 24.22.1），然后克隆仓库： ```bash git clone https://github.com/CWNU-Open-Source-Community/Universal-Code.git diff --git a/docs/ci.md b/docs/ci.md index 1ecb8b46..7719ffe6 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -56,6 +56,34 @@ changing the schedule. Go 1.26 requires macOS 12+, so native build flags, bundle metadata and package verification use that same minimum; the earlier macOS 11 declaration was already inconsistent with Go 1.25's supported platforms. +## October 2026 runtime security updates + +CI and desktop release jobs use Node.js **24.22.1**. Local frontend builds should +use the same version. The [October 21 Node security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) +fixes TLS/DNS validation, Brotli decoding, and other runtime issues, and updates +certificate trust. Updating npm packages alone does not update the Node executable. + +Before downloading pinned Rust toolchains, CI and release jobs run +`rustup self update`. Local builders should also update rustup to **1.29.2 or +newer** before installing toolchains or targets; [rustup 1.29.2](https://blog.rust-lang.org/2026/10/20/Rustup-1.29.2/) +updates certificate verification dependencies for the eMudhra/emSign incident. +The analyzer compiler remains pinned to Rust 1.97.1 so the embedded WASI build +continues to use its established reproducible toolchain. + +The [Python security announcement](https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576) +requires pip **26.2.2**, certifi **2026.10.19**, and uv **0.13.4** or newer where +those tools perform HTTPS requests. Update existing virtual environments as well +as base installations and rebuild container images with updated CA certificates. +UC's project-preparation pip path uses local wheel URLs, `--no-index`, +`--no-deps`, `--require-hashes`, and `--disable-pip-version-check`; downloads go +through the Go dependency broker. Its pip >=25.3 requirement describes offline +lockfile compatibility, not a safe version for general network use. The Python +3.9 CI job remains an offline macOS archive compatibility test. + +Updating build configuration does not replace installed application binaries, +user-managed interpreters, or existing sandbox images. Go-built releases must +be rebuilt with the fixed toolchain; image owners must supply refreshed digests. + ## Go impact selection `scripts/ci/run_go_checks.py` uses `go list -json ./...` to identify package diff --git a/docs/evidence/runtime-security-october/after.png b/docs/evidence/runtime-security-october/after.png new file mode 100644 index 00000000..f74854db Binary files /dev/null and b/docs/evidence/runtime-security-october/after.png differ diff --git a/docs/evidence/runtime-security-october/before.png b/docs/evidence/runtime-security-october/before.png new file mode 100644 index 00000000..2f18e7b5 Binary files /dev/null and b/docs/evidence/runtime-security-october/before.png differ diff --git a/docs/macos-release.md b/docs/macos-release.md index b55f2519..5331a616 100644 --- a/docs/macos-release.md +++ b/docs/macos-release.md @@ -37,7 +37,7 @@ Extract the Actions transport ZIP, then the product ZIP inside it, and open `Tra ## 构建与核验 -本机源码构建需要 Xcode Command Line Tools、[go.mod](../go.mod) 固定的 Go（当前 1.26.10）、Node.js 24（CI 为 24.16.0）和 CGO。在仓库根目录运行： +本机源码构建需要 Xcode Command Line Tools、[go.mod](../go.mod) 固定的 Go（当前 1.26.10）、Node.js 24（CI 为 24.22.1）和 CGO。在仓库根目录运行： ```sh CGO_ENABLED=1 bash scripts/build-desktop-darwin.sh -Version v1.0.0-dev diff --git a/docs/project-preparation.md b/docs/project-preparation.md index 367c9a76..467cc78f 100644 --- a/docs/project-preparation.md +++ b/docs/project-preparation.md @@ -79,6 +79,8 @@ editable 安装，以及 requirements/Poetry/uv 专有锁文件需要先导出 声明的 wheel 字节数也会核对。安装使用本地文件、`--no-index --no-deps --require-hashes --only-binary=:all: --target`，不执行源码构建。 +通用联网使用的 pip、证书包及既有镜像应按[运行时安全更新](ci.md#october-2026-runtime-security-updates)升级；下述版本是离线安装的兼容性下限。 + 此入口当前使用 Standard Code Docker Engine。镜像需已包含 pip >=25.3； 旧版本在安装记录中给出明确错误。依赖只写入任务的 `.traverse-preparation` 私有目录，安装成功后才发布；解释器、兼容标签、环境或锁文件变化后需要 diff --git a/docs/windows-release.md b/docs/windows-release.md index 21eae82d..03318285 100644 --- a/docs/windows-release.md +++ b/docs/windows-release.md @@ -30,7 +30,7 @@ If this artifact has expired, select a newer successful [Desktop release run](ht ### 从源码构建与启动 / Build and launch from source -在仓库根目录使用 PowerShell、[go.mod](../go.mod) 固定的 Go（当前 1.26.10）与 Node.js 24（CI 为 24.16.0）： +在仓库根目录使用 PowerShell、[go.mod](../go.mod) 固定的 Go（当前 1.26.10）与 Node.js 24（CI 为 24.22.1）： ```powershell .\scripts\build-desktop.ps1 -Version v1.0.0-dev