3ngram 1.2.6

3ngram v1.2.6

Patch release: dependency advisory fixes, plus a move to Node 24 for how this
project is built, tested and shipped. The supported Node floor for consumers
is unchanged at >=22.

1.2.5 was versioned but never published — see Skipped version below.

Changes

• hono is now a declared dependency of @3ngram/server, pinned to 4.12.34.
  It previously arrived as an optional peer of @modelcontextprotocol/node,
  which pnpm auto-installs. Two consequences, both fixed here:

  1. It carried an open advisory, and pnpm overrides cannot reach an
     auto-installed peer — a scoped override, a bare override and
     pnpm install --force all left the vulnerable version pinned. Only an
     explicit declaration moves it.
  2. @modelcontextprotocol/node@2.0.0 declares hono: ^4.12.34, so the
     auto-installed version was violating that peer range, which
     pnpm peers check reported as an unmet peer.

  Declaring it also means consumers resolve the version this project actually
  tests against, rather than whatever their own tree happens to auto-install.

• postcss advisory override raised to 8.5.23. The previous selector
  (<=8.5.17) no longer covered the advisory range.

• Built, tested and shipped on Node 24 (Active LTS). CI, the release
  workflow and the server image base move to Node 24 — node:24-bookworm-slim,
  digest-pinned so the base is reproducible rather than tracking a moving tag.
  Node 22 entered maintenance on 2025-10-21 and receives security fixes only.

• engines.node deliberately stays >=22. What this project builds on and
  what it requires of consumers are separate decisions. Nothing in this
  closure uses a Node 24 feature, and Node 22 is supported upstream until
  2027-04-30, so raising the published floor would have hard-failed Node 22
  consumers on a patch release. Raising it will be a deliberate major when
  there is an actual reason.

Skipped version

1.2.5 was versioned and tagged but never published to npm or GHCR. Its
engines.node raise to >=24 would have broken Node 22 consumers in a patch
release; the release gate rejected the tag for missing curated notes before any
publish job ran, and the repository's tag-protection ruleset makes release tags
immutable, so the version was burned rather than moved. No 1.2.5 artifact
exists for any package.

Upgrading

No configuration or migration changes. No action required for consumers on
Node 22 or Node 24.

Library versions

@3ngram/core 0.8.4, @3ngram/db 0.7.3, @3ngram/schema 0.6.3,
@3ngram/config 0.2.5, @3ngram/llm 0.2.4.

Immutable container reference

ghcr.io/b3dmar/3ngram@sha256:17dce5b494b9c88ae5d7b174b5db0bebac5e5078c371babb17f489396b4ebcdb