fix(release): ship Node 24.22.1 with pinned runtime checksums

.github/workflows/ci.yml

@@ -37,12 +37,12 @@ jobs:
       - if: matrix.os == 'windows'
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.21.0
+          node-version: 24.22.1
           architecture: arm64
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.21.0
+          node-version: 24.22.1
           architecture: arm64
           # Saving the pnpm store with the Windows guest's tar.exe hangs until the job times out.
           cache: ${{ matrix.os != 'windows' && 'pnpm' || '' }}

.github/workflows/deploy-site.yml

@@ -21,7 +21,7 @@ jobs:
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.21.0
+          node-version: 24.22.1
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm site:deploy

.github/workflows/release.yml

@@ -48,7 +48,7 @@ jobs:
           version: 10.24.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.21.0
+          node-version: 24.22.1
           cache: pnpm
       - run: pnpm install --frozen-lockfile --ignore-scripts
       - run: pnpm package
@@ -77,7 +77,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.21.0
+          node-version: 24.22.1
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: unsigned-release
@@ -143,7 +143,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.21.0
+          node-version: 24.22.1
           architecture: arm64
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -186,7 +186,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.21.0
+          node-version: 24.22.1
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: unsigned-release

CONTRIBUTING.md

@@ -10,7 +10,7 @@ Thanks for helping. Read [AGENTS.md](AGENTS.md) first: it describes what Inbot n
 
 ## Development
 
-Use Node 24.21.0 and pnpm 10.24.0:
+Use Node 24.22.1 and pnpm 10.24.0:
 
 ```sh
 pnpm install --frozen-lockfile

THIRD_PARTY_NOTICES.md

@@ -2,7 +2,7 @@
 
 Inbot's original code is licensed under the MIT License in `LICENSE`. Third-party components retain their own licenses. This notice does not replace their license texts or source-distribution requirements.
 
-- Release archives include Node.js 24.21.0 with its upstream `runtime/LICENSE`, covering Node and its bundled components.
+- Release archives include Node.js 24.22.1 with its upstream `runtime/LICENSE`, covering Node and its bundled components.
 - Production JavaScript dependencies retain the license files supplied by their publishers under `application/node_modules`. Each archive includes a generated `licenses/` directory and `licenses/INDEX.md` recording exact package versions, declared licenses, and copied license and notice materials, including dependencies compiled into the owner UI and Email Worker.
 - `better-sqlite3-multiple-ciphers` includes the MIT-licensed better-sqlite3 and SQLite3 Multiple Ciphers work and a target-specific native prebuild. Its upstream `LICENSE` is retained. SQLite itself is public domain.
 - `@napi-rs/keyring` and its target-specific native prebuild are MIT-licensed. Their upstream license texts are included with the archive notices.

apps/cli/README.md

@@ -9,7 +9,7 @@ override both defaults.
 
 ## Development
 
-Requires Node 24.21.0 and pnpm 10.24.0. Build from the workspace root:
+Requires Node 24.22.1 and pnpm 10.24.0. Build from the workspace root:
 
 ```sh
 pnpm install
@@ -26,7 +26,7 @@ dependencies resolve from the root package. No additional dependency is needed.
 
 ## Packaged installation
 
-Release archives include Node 24.21.0, production dependencies with the target's
+Release archives include Node 24.22.1, production dependencies with the target's
 native prebuilds, the server, CLI, inbound Worker bundle, and owner UI. No external
 Node runtime is required. See the [installation guide](https://inbot.kerd.dev/docs/get-started/install)
 for the one-line checksum-verifying installers, supported platforms, updating and removal.

apps/docs/docs/development/build.md

@@ -5,7 +5,7 @@ description: Build and run Inbot from a source checkout, run the checks the proj
 
 ## Requirements
 
-- Node.js 24.21.0 or newer, below 25
+- Node.js 24.22.1 or newer, below 25
 - pnpm 10.24.0
 - An OS keychain, or the test-only memory keychain described below
 

apps/docs/docs/development/packaging.md

@@ -5,7 +5,7 @@ description: Build release archives for every platform, smoke-test them locally,
 
 ## Build archives
 
-Packaging runs on macOS or Linux with Node.js exactly 24.21.0, pnpm 10.24.0, `tar`, `zip` and `unzip`:
+Packaging runs on macOS or Linux with Node.js exactly 24.22.1, pnpm 10.24.0, `tar`, `zip` and `unzip`:
 
 ```sh
 pnpm install --frozen-lockfile --ignore-scripts
@@ -20,7 +20,7 @@ pnpm package --target darwin-arm64 --target linux-x64
 | `--output <dir>`  | Release directory, default `dist-release`                                                                             |
 | `--skip-build`    | Reuse an existing complete build                                                                                      |
 
-The output is `inbot-<version>-<target>.tar.gz` (Windows: `.zip`) plus `SHA256SUMS`. One machine can build all six targets: Node.js runtimes are downloaded and verified against nodejs.org's `SHASUMS256.txt`, and the SQLite and keychain native modules come from official npm prebuilds verified against the lockfile's integrity hashes. Nothing is compiled natively. Download caches live in the output's `.cache` directory and are not part of the release.
+The output is `inbot-<version>-<target>.tar.gz` (Windows: `.zip`) plus `SHA256SUMS`. One machine can build all six targets: Node.js runtimes are downloaded and verified against SHA-256 pins in `scripts/package.mjs`. Packaging also fetches nodejs.org's `SHASUMS256.txt` and fails if any pinned checksum disagrees. The SQLite and keychain native modules come from official npm prebuilds verified against the lockfile's integrity hashes. Nothing is compiled natively. Download caches live in the output's `.cache` directory and are not part of the release.
 
 See [Install Inbot](/get-started/install#what-gets-installed) for what each archive contains.
 

apps/docs/docs/get-started/install.md

@@ -74,14 +74,14 @@ Paths must be absolute. A custom install root does not change the default bin di
 
 ## What gets installed
 
-| Path                       | Contents                                                                        |
-| -------------------------- | ------------------------------------------------------------------------------- |
-| `inbot` or `inbot.cmd`     | Launcher                                                                        |
-| `runtime/`                 | Node.js 24.21.0, verified against nodejs.org's published checksums at packaging |
-| `application/dist`         | Server, CLI, shared packages and the inbound Email Worker bundle                |
-| `application/web`          | Owner web app                                                                   |
-| `application/node_modules` | Production dependencies, including prebuilt SQLite and keychain native modules  |
-| `BUILD.json`               | Version, target and integrity values of the bundled runtime and native modules  |
+| Path                       | Contents                                                                                                  |
+| -------------------------- | --------------------------------------------------------------------------------------------------------- |
+| `inbot` or `inbot.cmd`     | Launcher                                                                                                  |
+| `runtime/`                 | Node.js 24.22.1, verified against pinned SHA-256 hashes and nodejs.org's published checksums at packaging |
+| `application/dist`         | Server, CLI, shared packages and the inbound Email Worker bundle                                          |
+| `application/web`          | Owner web app                                                                                             |
+| `application/node_modules` | Production dependencies, including prebuilt SQLite and keychain native modules                            |
+| `BUILD.json`               | Version, target and integrity values of the bundled runtime and native modules                            |
 
 Installed commands default to the production flavor: the home is `~/.inbot` (`%USERPROFILE%\.inbot` on Windows), and `inbot serve` serves the bundled web app. The home is separate from the install directory and holds your encrypted mail database and key files. See [Configuration](/operations/configuration).
 

apps/server/src/http/README.md

@@ -1,6 +1,6 @@
 # Loopback HTTP API
 
-Build with Node 24.21.0 and run against an explicit home:
+Build with Node 24.22.1 and run against an explicit home:
 
 ```sh
 pnpm build

package.json

@@ -66,7 +66,7 @@
     "vitest": "5.0.2"
   },
   "engines": {
-    "node": ">=24.21.0 <25"
+    "node": ">=24.22.1 <25"
   },
   "packageManager": "pnpm@10.24.0",
   "pnpm": {

scripts/archive.test.mjs

@@ -99,7 +99,7 @@ test(
           assertArchitecture(await readFile(join(temporary, file)), target);
         const build = JSON.parse(await readFile(join(temporary, "inbot/BUILD.json")));
         assert.equal(build.target, target);
-        assert.equal(build.node, "24.21.0");
+        assert.equal(build.node, "24.22.1");
         assert.equal(
           JSON.parse(await readFile(join(temporary, "inbot/application/package.json"))).license,
           "MIT",

scripts/package.mjs

@@ -20,7 +20,19 @@ import { releaseTargets as targets, writeReleaseChecksums } from "./release-chec
 import { stagePackageNotices } from "./package-notices.mjs";
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const nodeVersion = "24.21.0";
+const nodeVersion = "24.22.1";
+const nodeChecksums = {
+  "node-v24.22.1-darwin-arm64.tar.gz":
+    "89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7",
+  "node-v24.22.1-darwin-x64.tar.gz":
+    "d132557e7ee2b85af08b0c8c34338e65c6430f2238d01f727728ef42dc83b035",
+  "node-v24.22.1-linux-x64.tar.gz":
+    "eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c",
+  "node-v24.22.1-linux-arm64.tar.gz":
+    "33c37be234ba8bee041961047b19160f4d7d0f164e8e246f78bdd10feff148b3",
+  "node-v24.22.1-win-x64.zip": "d2046d28c2c3dcd211ac5145c0bf30e2047ef9dfb306693c8c6e2eccd8b95fa5",
+  "node-v24.22.1-win-arm64.zip": "a0c807319fede24c4a0d8f84564c82a619bd313b16b10c007c383c2609e99171",
+};
 const { values } = parseArgs({
   options: {
     target: { type: "string", multiple: true },
@@ -144,19 +156,21 @@ try {
   });
   if (!sumsResponse.ok) throw new Error("Cannot fetch official Node checksums.");
   const sums = await sumsResponse.text();
+  for (const [filename, checksum] of Object.entries(nodeChecksums)) {
+    const published = sums.split(/\r?\n/).filter((line) => line.endsWith(`  ${filename}`));
+    if (published.length !== 1 || published[0].split(/\s+/)[0] !== checksum)
+      throw new Error(`Official Node checksum disagrees with pin: ${filename}`);
+  }
   const sqliteVersion = manifest.dependencies["better-sqlite3-multiple-ciphers"];
   const sqliteArchive = await npmArchive("better-sqlite3-multiple-ciphers", sqliteVersion);
   const keyringVersion = manifest.dependencies["@napi-rs/keyring"];
   for (const target of new Set(selected)) {
     const windows = target.startsWith("win32-");
     const runtimeName = `node-v${nodeVersion}-${target.replace("win32-", "win-")}`;
     const runtimeFile = `${runtimeName}.${windows ? "zip" : "tar.gz"}`;
-    const checksum = sums
-      .split("\n")
-      .find((line) => line.endsWith(`  ${runtimeFile}`))
-      ?.split(/\s+/)[0];
+    const checksum = nodeChecksums[runtimeFile];
     if (!checksum || !/^[a-f0-9]{64}$/.test(checksum))
-      throw new Error(`No official checksum: ${runtimeFile}`);
+      throw new Error(`No pinned Node checksum: ${runtimeFile}`);
     const runtimeArchive = await download(
       `https://nodejs.org/dist/v${nodeVersion}/${runtimeFile}`,
       runtimeFile,

scripts/smoke-release.mjs

@@ -76,7 +76,7 @@ try {
     : await exec(launcher, ["--help"], { env: helpEnv });
   assert.match(help.stdout, /Usage: inbot/);
   const node = join(bundle, windows ? "runtime/node.exe" : "runtime/bin/node");
-  assert.equal((await exec(node, ["--version"], { env: bundledEnv })).stdout.trim(), "v24.21.0");
+  assert.equal((await exec(node, ["--version"], { env: bundledEnv })).stdout.trim(), "v24.22.1");
   if (windows)
     assert.equal(
       (await exec(node, ["-p", "process.arch"], { env: bundledEnv })).stdout.trim(),