chore(deps): bump the production group across 1 directory with 3 updates - #369
Merged
Merged
Conversation
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
dependabotBotforce-pushed
the
dependabot/npm_and_yarn/production-5a092cb738
branch
from
July 24, 2026 15:24
57c445f to
383ef02CompareBumps the production group with 3 updates in the / directory: [better-sqlite3](https://github.com/WiseLibs/better-sqlite3), [@napi-rs/canvas](https://github.com/Brooooooklyn/canvas) and [unpdf](https://github.com/unjs/unpdf). Updates `better-sqlite3` from 12.11.1 to 13.0.1 - [Release notes](https://github.com/WiseLibs/better-sqlite3/releases) - [Commits](WiseLibs/better-sqlite3@v12.11.1...v13.0.1) Updates `@napi-rs/canvas` from 0.1.100 to 1.0.2 - [Release notes](https://github.com/Brooooooklyn/canvas/releases) - [Changelog](https://github.com/Brooooooklyn/canvas/blob/main/CHANGELOG.md) - [Commits](Brooooooklyn/canvas@v0.1.100...v1.0.2) Updates `unpdf` from 1.6.2 to 1.7.0 - [Release notes](https://github.com/unjs/unpdf/releases) - [Commits](unjs/unpdf@v1.6.2...v1.7.0) --- updated-dependencies: - dependency-name: "@napi-rs/canvas" dependency-version: 1.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production - dependency-name: better-sqlite3 dependency-version: 13.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production - dependency-name: unpdf dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabotBotforce-pushed
the
dependabot/npm_and_yarn/production-5a092cb738
branch
from
July 24, 2026 15:27
383ef02 to
da74405CompareUh oh!
There was an error while loading. Please reload this page.
aliasunder added a commit
that referenced
this pull request
Jul 30, 2026
…ings per-arch at build time (#384) ## Problem Every **arm64** image since **v0.33.0 (July 25)** crash-loops at startup — all Apple Silicon local-mode users are affected: ``` /lib/aarch64-linux-gnu/libm.so.6: version 'GLIBC_2.38' not found (required by /app/node_modules/better-sqlite3/prebuilds/linux-arm64.node) ``` better-sqlite3 v13 (Dependabot #369) bundles its prebuilds in the npm tarball, and the **linux-arm64 prebuild requires glibc >= 2.38** while the bookworm base ships **2.36**. amd64 was unaffected only because its prebuild's glibc floor happens to fit — which is why prod (Lightsail, amd64) never surfaced it and no CI check caught it: nothing ever *executes* the arm64 artifact. ## Why the existing defense failed The deps stage ran `npm ci --ignore-scripts && npm rebuild better-sqlite3 onnxruntime-node` precisely to compile bindings against the image's libc. Two independent failures made it dead weight: 1. **npm's allow-scripts gating silently no-ops `npm rebuild`** — it prints a warning, reports "rebuilt dependencies successfully", and exits 0 without building anything. Reproduced in a clean container at the exact pinned base digest. 2. **v13 tarballs no longer produce a working binding from source** — even with scripts approved and build tools present, the compile completes without linking a `.node` (upstream moved to bundled prebuilds; 13.0.2 sets `gypfile: false`, making source builds a permanent no-op). Both shipped image arches contain **no compiled binding at all** — they run on bundled prebuilds, so amd64 is also one upstream prebuild-toolchain bump away from the same crash. ## Fix - **Base image → `node:24-trixie-slim`** (glibc 2.41 ≥ 2.38), digest-pinned as before. Aligns with upstream's prebuild-only direction instead of fighting it. - **Replace the dead rebuild with an executed assertion**: the deps stage `RUN`s `new Database(':memory:')` + `require('onnxruntime-node')`. Release builds are `linux/amd64,linux/arm64`, so this executes on **both** architectures (arm64 under QEMU) — a glibc/arch mismatch now **fails the build on the affected arch** instead of shipping a crash-looping image. This makes per-arch validation a hard release gate. - Dropped the now-unused `python3 make g++` from the deps stage (the build stage keeps its own copy). - Docs lockstep: AGENTS.md + ARCHITECTURE.md base-image references updated with the glibc-floor rationale. ## Validation - **arm64 local target**: built with the assertion passing, booted via the CLI against a scaffolded `.env` — healthz ok, authenticated MCP `initialize` returns serverInfo, index rebuild + **embedding pass complete** (both native bindings exercised for real). - **amd64 deps stage**: built under `--platform linux/amd64` emulation — assertion passes, proving the cross-arch gate works exactly as CI will run it. - **remote target**: builds cleanly on trixie (s6-overlay static binaries, obsidian-headless npm ci, UID-1000 user swap all unaffected). - Regression window confirmed by probing released images: `0.32.0` (better-sqlite3 12.x) opens a database on arm64; `0.33.2` and `:latest` do not. Note: bare `require('better-sqlite3')` passes on broken images — v13 defers the native load — so the assertion opens a real database. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the production group with 3 updates in the / directory: better-sqlite3, @napi-rs/canvas and unpdf.
Updates
better-sqlite3from 12.11.1 to 13.0.1Release notes
Sourced from better-sqlite3's releases.
Commits
6efdbc513.0.132ee0abMerge remote-tracking branch 'origin/master'bce8300fixed overly strict regression in parameter bindingecfe2f713.0.0ae19080fixed typos57d4bbbimplemented Database#explain()49fd7e6added docs for Statement#toString()1cb18ecimplemented Statement#toString()af60f6bupdated github workflow dep versions6ffd750fixed tests for SqliteErrorInstall script changes
This version modifies
installscript that runs during installation. Review the package contents before updating.Updates
@napi-rs/canvasfrom 0.1.100 to 1.0.2Release notes
Sourced from @napi-rs/canvas's releases.
Changelog
Sourced from @napi-rs/canvas's changelog.
Commits
826600b1.0.23fe9b54feat: chrome/m149 (#1281)6ad99861.0.13067f7echore(deps): update actions/cache action to v6 (#1279)e1a75d1fix: missing icudtl.dat in win32-arm64 package (#1278)1f1e0f1chore(deps): update debian docker tag to bullseye-20260623 (#1280)046c422chore(deps): update actions/checkout action to v7 (#1277)0967d5echore(deps): update dependency npm-run-all2 to v9 (#1266)8483662fix: link aarch64-pc-windows-msvc against static CRT (#1276)48e9eecchore(deps): update yarn monorepo to v4.17.0 (#1275)Updates
unpdffrom 1.6.2 to 1.7.0Release notes
Sourced from unpdf's releases.
Commits
5125d67chore: release v1.7.053d78fadocs: hardening guidance for untrusted PDFs (#61)95ebf64perf: encode PNG bytes directly inrenderPageAsImage(#60)ed9ac1dfix: destroy internally created document proxies and canvas resources (#57)a49be35fix: preserve line breaks inextractTextwithmergePages(#58)6552a9edocs: collapserenderPageAsImageoverloads into a single signaturef5406c2fix: resolve@napi-rs/canvasin the bundled PDF.js canvas factory (#54)10e6d78fix: add .js extension to relative imports in .d.mts & .d.cts files (#56)3789c3efix: add cMapUrl for CJK font support in Node.js (#52)ab8e04cci: drop redundant NPM_TOKEN (publishing via OIDC)