diff --git a/.nvmrc b/.nvmrc index 6edc5a2..a9276c4 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -v22.17.0 +v22.23.4 diff --git a/Extensions/e2e/discussion/README.md b/Extensions/e2e/discussion/README.md index 1e11b5a..e8a2b08 100644 --- a/Extensions/e2e/discussion/README.md +++ b/Extensions/e2e/discussion/README.md @@ -12,7 +12,7 @@ node node_modules/webpack-cli/bin/cli.js --mode=production --env liveTest=true - node Extensions/e2e/discussion/hermetic-discussion-smoke.js ``` -Use Node 22.17.0. `RYD_DISCUSSION_ARTIFACT` can select another generated local-test +Use Node 22.23.4. `RYD_DISCUSSION_ARTIFACT` can select another generated local-test Chrome artifact; `RYD_DISCUSSION_OUTPUT` can select a fresh evidence directory. The default output creates a new timestamped directory under `test-results/discussion`. Set `RYD_DISCUSSION_NOTIFICATIONS_ONLY=true` for a focused notification/reconnect diff --git a/README_AMO_SOURCE.md b/README_AMO_SOURCE.md index ee748c3..70052ad 100644 --- a/README_AMO_SOURCE.md +++ b/README_AMO_SOURCE.md @@ -7,7 +7,7 @@ This source package is provided for Mozilla Add-ons review. The extension is bui Build the 4.1.0 release with this exact toolchain: - Windows 11 (PowerShell); the build script also supports Linux and macOS -- Node.js 22.17.0 +- Node.js 22.23.4 - npm 10.8.2 These versions are intentionally pinned instead of relying on the default AMO reviewer environment. The build script checks both versions before installing dependencies and stops if either differs. The release's accompanying reproducibility report records the environment actually used for its independent source rebuild. @@ -17,8 +17,8 @@ These versions are intentionally pinned instead of relying on the default AMO re Using `nvm`: ```sh -nvm install 22.17.0 -nvm use 22.17.0 +nvm install 22.23.4 +nvm use 22.23.4 npm install --global npm@10.8.2 ``` @@ -32,7 +32,7 @@ npm --version Expected versions: ```text -v22.17.0 +v22.23.4 10.8.2 ``` @@ -46,7 +46,7 @@ node scripts/build-firefox-source.mjs The script performs all required technical build steps: -1. Confirms Node.js 22.17.0 and npm 10.8.2 are in use. +1. Confirms Node.js 22.23.4 and npm 10.8.2 are in use. 2. Installs the locked dependencies with `npm ci`. 3. Builds the extension with the release-specific `npm run build-for-amo` hook. 4. Verifies the generated Firefox manifest is version 4.1.0, retains the published AMO add-on ID, and declares the expected desktop data-collection permissions and minimum Firefox version. diff --git a/package-lock.json b/package-lock.json index 7fb5c9e..b05b0b3 100644 --- a/package-lock.json +++ b/package-lock.json @@ -33,7 +33,7 @@ "webpack-cli": "^6.0.1" }, "engines": { - "node": "22.17.0", + "node": "22.23.4", "npm": "10.8.2" } }, diff --git a/package.json b/package.json index 2f9c038..046d9c9 100644 --- a/package.json +++ b/package.json @@ -5,7 +5,7 @@ "main": "ryd.content-script.js", "packageManager": "npm@10.8.2", "engines": { - "node": "22.17.0", + "node": "22.23.4", "npm": "10.8.2" }, "scripts": { diff --git a/scripts/build-firefox-source.mjs b/scripts/build-firefox-source.mjs index ccecd4c..2f28230 100644 --- a/scripts/build-firefox-source.mjs +++ b/scripts/build-firefox-source.mjs @@ -10,7 +10,7 @@ const firefoxManifestPath = join(firefoxOutputDirectory, "manifest.json"); const contentScriptPath = join(firefoxOutputDirectory, "ryd.content-script.js"); const menuFixerPath = join(firefoxOutputDirectory, "menu-fixer.js"); const maxContentScriptBytes = 5 * 1024 * 1024; -const expectedNodeVersion = "v22.17.0"; +const expectedNodeVersion = "v22.23.4"; const expectedNpmVersion = "10.8.2"; const expectedExtensionVersion = "4.1.0"; const expectedFirefoxExtensionId = "{762f9885-5a13-4abd-9c77-433dcd38b8fd}"; diff --git a/scripts/fixtures/aaa-certificate-services.pem b/scripts/fixtures/aaa-certificate-services.pem new file mode 100644 index 0000000..33c71ba --- /dev/null +++ b/scripts/fixtures/aaa-certificate-services.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb +MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow +GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj +YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL +MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE +BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM +GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP +ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua +BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe +3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4 +YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR +rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm +ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU +oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF +MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v +QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t +b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF +AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q +GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz +Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2 +G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi +l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3 +smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg== +-----END CERTIFICATE----- diff --git a/scripts/package-amo-release.cjs b/scripts/package-amo-release.cjs index e169602..b9aae20 100644 --- a/scripts/package-amo-release.cjs +++ b/scripts/package-amo-release.cjs @@ -9,7 +9,7 @@ const { collectExtensionBuildInputs, createExtensionBuildReceipt } = require(".. const { verifyBuildReceipt, verifyExtensionArtifacts } = require("../Extensions/e2e/verify-extension-artifact"); const REPOSITORY_ROOT = path.resolve(__dirname, ".."); -const EXPECTED_NODE = "v22.17.0"; +const EXPECTED_NODE = "v22.23.4"; const EXPECTED_NPM = "10.8.2"; const ARTIFACT_VERIFIER_PATH = "Extensions/e2e/verify-extension-artifact.js"; const EXTRA_SOURCE_FILES = Object.freeze([ diff --git a/scripts/with-trusted-node.spec.js b/scripts/with-trusted-node.spec.js index bfe80db..66244f3 100644 --- a/scripts/with-trusted-node.spec.js +++ b/scripts/with-trusted-node.spec.js @@ -7,11 +7,11 @@ const { spawnSync } = require("node:child_process"); const { filterCertificates, readCertificates, prepareEnvironment, main } = require("./with-trusted-node.cjs"); const root = path.resolve(__dirname, "../.private/node-trust-tests"); -const blocked = tls.rootCertificates.find((pem) => - new X509Certificate(pem).subject.includes("CN=AAA Certificate Services"), -); +// Public root certificate from https://emudhra.we-have-a-problem.com/roots.json. +// Patched Node versions no longer include it in their bundled trust store. +const blocked = fs.readFileSync(path.join(__dirname, "fixtures/aaa-certificate-services.pem"), "utf8"); const allowed = tls.rootCertificates.filter( - (pem) => !new X509Certificate(pem).subject.includes("emSign") && pem !== blocked, + (pem) => !/emSign|CN=AAA Certificate Services/.test(new X509Certificate(pem).subject), ); const npmConfig = { ca: null, cafile: null, strictSsl: true, nodeOptions: null }; let temporary;