Pi-Bolt 0.7.4

Pi-Bolt 0.7.4 runs Pi 1.1.0. A security fix and better compatibility with Pi extensions. Updating is recommended.

Security

• Pi-Bolt no longer loads code from the directory it is started in. In the compiled executable, a package that Pi looked up
  by name could be found in the working directory's node_modules, and one such lookup loaded a native module. A repository
  could therefore supply code that Pi-Bolt ran. Pi-Bolt now takes its own code only from itself and the files next to it, and
  the runtime no longer resolves a module or package for code built into the executable from the working directory.
  Pi run with Node is not affected.

Extensions

• Extensions resolve their own packages as on Node. An extension's dependencies are found through their package.json
  (exports, main), so extensions that use packages such as sharp now load. Checked against the 50 most-installed Pi
  extensions on npm: each installs, loads and runs as it does on Node, except @ff-labs/pi-fff, which needs the -jit
  build. Without Node.js installed, extensions whose packages compile native code when installed (better-sqlite3,
  node-pty) need Node.js and npm.

Building

• Pi builds offline. Pi's model catalog is now part of the repository, so scripts/prepare-pi.sh needs no model provider
  to answer, and the same sources give the same Pi. --refresh-models fetches the catalog again. A step that fails prints
  its output (docs/BUILDING.md).
• Internal names and messages of the macOS launcher and runtime cleaned up.

Install

curl -fsSL https://pi-bolt.opensec.in/install.sh | sh

or pi-bolt update, or npm install -g pi-bolt. The installer detects Linux or macOS by itself.

Asset	For
pi-bolt-linux-x64.tar.xz / .tar.gz	Recommended on Linux. CPUs with AVX2 (Intel Haswell 2013+, AMD Zen+).
pi-bolt-linux-x64-baseline.tar.xz / .tar.gz	Any x86-64 CPU with SSE4.2.
pi-bolt-linux-x64-jit.tar.xz / .tar.gz	JIT also on, for plugins loaded at run time.
pi-bolt-darwin-arm64.tar.xz / .tar.gz	macOS. Macs with Apple silicon, macOS 13 or later.
pi-bolt-darwin-arm64-jit.tar.xz / .tar.gz	macOS, JIT also on.
pi-bolt-runtime-linux-x64.tar.gz, pi-bolt-runtime-darwin-arm64.tar.gz	The Pi-Bolt Bun runtime, for compiling plugins in.

Linux x86-64 with glibc 2.17 or later; macOS 13 or later on Apple silicon.