Skip to content

Szpont Engine 0.10.0 — Node 26 LTS

Choose a tag to compare

View all tags
@dalkedev dalkedev released this 10 Nov 14:05
· 9 commits to main since this release
v0.10.0
d09b9c8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release requires Node 26 LTS, at least 26.13.0 and below 27, with linked SQLite 3.54.0 or newer. It replaces the affected Node 24 runtime to address CVE-2026-119375 tracked in #11. Upgrade the host runtime together with the engine; older 0.9.x images remain affected.

Runtime and state protection

  • Pin both Docker stages to the verified official Node 26.13.0 multiarch index; include libatomic1 required by official Linux binaries.
  • Compare SQLite runtime metadata with an actual fresh in-memory SQL query. Startup, Store construction, setup and snapshots reject unsupported or inconsistent runtimes before filesystem database access.
  • Add required sqlite_runtime diagnostics. A Node-major assertion alone cannot pass this security requirement.
  • Move CI, package requirements/types, .node-version, .nvmrc, installation and backup documentation to the same supported runtime contract.
  • Preserve public SQLite schema 6, provider bindings, saved sessions and explicit recovery semantics. No database migration or automatic job replay is introduced.

Verification

The exact source passed all five PR CI jobs. Linux runs 573 engine/script tests and 36 browser tests; the 55 permission/snapshot checks also run under private umask 0077. macOS passed 572 with one Linux-only skip. Regression tests verify rejection before database modification and WAL/snapshot/restore behavior.

Official macOS arm64 and Linux x64 archives were checksum-verified; actual runtime metadata and in-memory SQL queries report Node 26.13.0/SQLite 3.54.0. Both native container architectures verify their actual linked SQLite, Codex 0.166.0, sandbox and synthetic persistence.

A coordinated private host backup preceded a staged runtime rollout. Its complete 377-test suite passed. All logical tables and configuration were retained before resuming, and zero active turns were interrupted. The actual Node child process beneath the systemd wrappers was verified; temporary verification configuration was removed. No new live model or multi-day soak claim is made by this runtime upgrade.

Verified image

docker pull ghcr.io/dalkedev/szpont-engine@sha256:307e901924b44cf228f2443056aaa1bc919f4edc4e2717c45926e0306498909f

The amd64 and arm64 manifests identify revision d09b9c8448b6b36972fb01f7cc2fe1ba72d7f5e8, version 0.10.0 and Node 26.13.0, with SPDX SBOM and SLSA provenance. The release workflow promoted the exact tested OCI bytes without rebuilding; attached JSON identifies the observed manifest digests.

Upgrade

Use the quick start, runtime finding record and backup guide. Linux host installations need libatomic; the supported image includes it. Take a coordinated backup and drain active work before switching an existing service. Keep previous binaries and the matching private backup for rollback.

Codex remains the verified container runner; Claude Code and OpenCode remain experimental host adapters. This release changes runtime prerequisites, not their permission or isolation boundaries.

Assets 4
Loading