mirror of
https://github.com/chroma-core/chroma.git
synced 2026-10-28 08:54:55 +08:00
lyon-chromaandlyon-chroma
26e51e7974
## Summary JavaScript builds and releases need a supported Node.js runtime containing the October 21 security fixes. This change selects Node 22.23.4 for native-binding builds and publication, JavaScript client release workflows, and the client integration-test job. [Official security advisory](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). ```diff - Native-binding build and publication: Node 20 - JavaScript client release workflows: Node 18 - Client integration tests: runner-provided Node + All seven project runtime selections: Node 22.23.4 ``` Node 22 is the nearest supported release line to the existing Node 18 and 20 workflows. The change selects the build-tool runtime; it leaves the published packages' engine requirements and Node-API compatibility level unchanged. ## Evidence - **Before:** Six setup steps select unsupported Node 18 or 20, and the client test job has no explicit setup step. **After:** Every explicit selection and the client test job use 22.23.4. - The downloaded Node 22.23.4 archive matches the upstream SHA-256. - Both the legacy client (`clients/js`) and current client (`clients/new-js`) build successfully with Node 22.23.4 and pnpm 9.15.9. - Both client lockfiles already disagree with their package manifests. Validation uses the workflows' existing `--no-frozen-lockfile` install mode. Generated lockfile changes are excluded from this PR. - The native-binding tools install with the committed lockfile; the N-API CLI and AVA start on Node 22.23.4. Native binaries have not been rebuilt across macOS, Windows, and Linux locally. - Repository commit hooks, including YAML validation, and `git diff --check` pass. Docker-backed integration tests are not run locally because Docker is unavailable. No package publication is run. ## Critical review - **Standards:** An independent review finds no blocking violations. Repeated version pins are a nonblocking maintenance concern. - **Spec:** An independent review finds no actionable defects in runtime selection. Passing current-client tests alone does not validate the legacy release packages; both package builds are validated locally. Cross-platform native builds and integration tests remain required validation. ## Merge Danger **Door:** Two-way. Reverting the workflow selections is possible, but restores unsupported runtimes. **Blast Radius:** CI. This crosses Node major versions for build and publication tooling, so the native build and integration jobs need successful validation before relying on the upgraded release workflow. Merge follows existing workflow triggers, including the development package publication job; this PR does not add a publication trigger. The Node runtime bundled with JavaScript GitHub Actions is supplied separately by the runner and is outside these project-runtime selections. This change does not patch Node installations used by package consumers. Co-authored-by: lyon-chroma <lyon@trychroma.com>