0.11.0

Breaking: the runtime baseline is now Node 24 LTS

engines.node moves from >=20.9.0 to >=24.0.0. Node 20 and 22 are dropped deliberately: this
release clears the runway for the LibreDB Agent work, whose runtime is ESM-only and needs a modern
Node. Node 24 LTS is the reference runtime the release payload is built and smoke-tested on.

Who has to do anything

Twenty-five of the twenty-seven distribution channels carry their own Node runtime, so the floor is
invisible there. Only two hand the payload to a Node you supply.

Channel	Runtime	Action
Docker, Helm, operator, all PaaS templates and one-click catalogs	in the image	none
deb / rpm, Snap, AppImage, Flatpak, Windows zip, winget	bundled with the package	none
Homebrew	formula depends on node@24	none
npx @libredb/studio	yours	Node 24+ required
Standalone tarballs	yours	Node 24+ required

If you run npx @libredb/studio on Node 20 or 22

npm does not raise an error for a bare specifier. Its version picker silently resolves the newest
engine-compatible release instead, so you stay on 0.10.0 with no notice that a newer Studio
exists. That older release keeps working; it is simply frozen for you until you upgrade Node.

• To confirm what you are getting: the launcher prints Starting LibreDB Studio <version>.
• To see the requirement stated explicitly, pin the version: npx @libredb/studio@0.11.0 runs the
  launcher's preflight, which refuses with the required Node version and a Docker alternative.
• The simplest fix is Node 24 LTS from https://nodejs.org, or run Studio in Docker:
  docker run -p 3000:3000 ghcr.io/libredb/libredb-studio:latest

Node 26 is now fully supported

Including server-side SQLite storage (STORAGE_PROVIDER=sqlite), which previously could not work on
any Node major other than the one that built the payload. better-sqlite3 moved to its N-API line,
so a single prebuilt binary stays valid across Node majors instead of being pinned to the ABI that
compiled it. CI proves it rather than assuming it: the engine-smoke matrix now boots the same
Node-24-built payload on both Node 24 and Node 26 and asserts identical behaviour on each.

Security

lodash advances to 4.18.1, clearing CVE-2026-4800 (arbitrary code execution via untrusted input
in template imports, HIGH). It enters the tree only through recharts and no Studio code path
reaches the affected template import, so this is not an exploitable path in Studio - but the version
a scanner reports now carries the fix. Nothing in this repository imports lodash directly; the
resolution is forced by an override and will be removed once recharts raises its own floor.

Dependency refresh

Roughly fifty packages advance within their existing ranges, including React, the Radix set, pg,
mysql2, mongodb, openid-client, zod, sql-formatter and the Playwright and Biome toolchain.
better-sqlite3 takes the major described above.

Helm chart: 0.1.32

appVersion follows to 0.11.0 and the default image tag with it. There is no change to templates or
values, and the image this chart deploys already ran Node 24 - a Helm upgrade needs no action.

Full changelog: 0.10.0...0.11.0