Skip to content

chore(deps): select current patched Node runtimes - #194

Merged
joshavant merged 1 commit into
mainfrom
security/emudhra-current-node-20261026
Oct 26, 2026
Merged

joshavant merged 1 commit into
mainfrom
security/emudhra-current-node-20261026

Conversation

@joshavant

Copy link
Copy Markdown
Contributor

Problem and change

Kova still selected older Node patches in its local toolchain, website and CI. Select Node 24.22.1 locally and for the website, qualify CI on Node 22.23.4/24.22.1/26.12.1, and use pnpm 12.15.0 for Crabbox hydration. Keep the Linux native command-owner gate on the updated Node 24 row. Public engine minima are unchanged.

Validation

Native macOS ARM64 task-owned UTM guest, official Node 24.22.1/OpenSSL 3.5.9 and pinned OCM 0.2.48: frozen install; core checks and 282/282 self-checks; 21/21 render snapshots; web payload/release contracts; release-shaped package build; actual checksum-verified installer with required OCM; installed version/setup and 282/282 self-checks; all installed documentation links. Independent review found no actionable issues; diff check passed.

Two initial receipt snapshots failed only with a long task TMPDIR. A controlled exact-base comparison reproduces both failures, and base/candidate both pass all 21 with the same short isolated TMPDIR. No expectations were changed. Broader Linux/Node/website qualification remains with this PR's existing CI.

Rebuilt archive SHA256: 0f46cbe96e919eec90a19babd19a84144a26cccaaaeb4ae6d727e47bbb80095b.

No release or deployment is included. This updates selected validation runtimes; it does not establish delivery to installed fleets.

@joshavant
joshavant requested a review from a team as a code owner October 26, 2026 06:49
@clawsweeper

clawsweeper Bot commented Oct 26, 2026 •

Copy link
Copy Markdown

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@clawsweeper clawsweeper Bot added P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Oct 26, 2026
@clawsweeper

clawsweeper Bot commented Oct 26, 2026

Copy link
Copy Markdown

Codex review: needs maintainer review before merge.

What this changes

Updates selected Node runtimes and Crabbox’s pnpm version while preserving the public Node 22 minimum.

Example: Run Linux validation on the selected Node 24 runtime.

  • Before: CI selects Node 24.21.0 and runs native command-owner verification there.
  • After: CI selects Node 24.22.1 and runs the same verification there.

Review scores

Measure Result What it means
Overall readiness 🦐 gold shrimp (3/6) A small, coherent maintenance patch with no actionable findings and conservative confidence in the supplied behavioral evidence.
Proof confidence 🦐 gold shrimp (3/6) Maintainer-authored exemption applies: the body reports native macOS ARM64 package installation and installed CLI checks, while verified exact-head CI supports the selected Node matrix; no live hydration trace is supplied.
Patch quality 🦞 diamond lobster (5/6) No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Kova’s selected validation and development tools lag the intended runtime versions.
Reason: The supplied maintainer-authored classification establishes direction, and the narrow refresh preserves documented support and coverage.

Merge readiness

✅ Ready for maintainer review

Keep open for landing: this PR makes a focused runtime refresh that is absent from main, preserves existing validation coverage, and has no actionable findings.

Priority: P3
Reviewed head: 6b0d36aec0a3f6961c6c8e49ad915c163f8ea6fb

Before merge

None.

Findings

None.

Tests

  • Missing end-to-end proof: No directly inspectable pnpm 12.15.0 hydration execution is supplied; ordinary contributor proof is exempt for this maintainer-authored PR.
Agent review details

How this fits together

Runtime pins select the tools used for Kova development, website and release builds, CI validation, and Crabbox hydration; they do not select installed OpenClaw fleet runtimes.

flowchart TD
  A[Runtime pins] --> B[CI matrix]
  A --> C[Website and release builds]
  A --> D[Crabbox hydration]
  B --> E[Kova checks and installed CLI smoke]
  D --> F[Validation workspace]
Loading

Technical review

Best possible solution:

Land the focused pin refresh with the existing engine minimum and validation gates preserved.

Do we have a high-confidence way to reproduce the issue?

This is maintenance rather than a reported runtime bug; source comparison verifies the older selections on main.

Is this the best way to solve the issue?

Directly updating the existing pins and their matching gate condition is the smallest complete change.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against e4aabcbe7034.

Provenance checked

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

Likely related people:

  • Vincent Koc: Raw commit cb604f3 adds .github/workflows/crabbox-hydrate.yml:62 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: cb604f3b562a; files: .github/workflows/crabbox-hydrate.yml)
  • Dallin Romney: Raw commit 17304ab adds .github/workflows/ci.yml:47 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 17304ab9d7aa; files: .github/workflows/ci.yml)

Labels

Label changes:

  • add P3: Focused validation-tool maintenance with no demonstrated user-facing failure or introduced regression.
  • add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦞 diamond lobster.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

  • P3: Focused validation-tool maintenance with no demonstrated user-facing failure or introduced regression.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 26, 2026, 3:01 AM ET / 07:01 UTC.

@joshavant
joshavant merged commit 54280b1 into main Oct 26, 2026
13 checks passed
@joshavant
joshavant deleted the security/emudhra-current-node-20261026 branch October 26, 2026 19:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant