Late November/december 2026: toolchain and library updates

@Nawid3333

@Nawid3333 Batched toolchain and library updates, planned for November 2026. Everything here was assessed on 2026-09-25; the tests named ran the full pnpm run verify.

1. Node.js in CI: 22 → 26

Node 26 becomes LTS in late October; switch then. node-version: 22 in the workflows (ci, release, patched-libraries, amo-signing-failsafe, toolchain-updates) and .nvmrc.
Your machine already runs Node 26, and every local verify on 2026-09-25 passed on it. None of the 937 installed packages excludes Node 22, 24 or 26.
Nothing changes for users: Node only builds and tests the extension. Node 22 is supported until April 2027, so this is not urgent.
The weekly Toolchain updates workflow opens a pull request when 26 is LTS (since ci: update PRs merge themselves when they ship nothing, and report the rest #60 it changes .nvmrc only; every workflow reads it).

2. pnpm: 11.22.0 → latest 11.x (done)

11.27.1 tested: clean. Frozen install OK, re-resolving leaves pnpm-lock.yaml byte-identical (still one document), full verify green.
Done: 11.27.1 is pinned (Toolchain update: pnpm 11.27.1 #62). Newer 11.x releases now come as pull requests that merge themselves.

3. pnpm 12: only once Dependabot supports it

12.6.0 tested: works - install, lockfile (no dependency changed, Coloris untouched) and full verify all green.
Blocked: pnpm 12 writes pnpm-lock.yaml as two YAML documents, and GitHub's dependency graph reads only the first (pnpm's own binaries), so it would see none of FastStream's dependencies - Dependabot alerts, security updates and the dependency review would go quiet. dependabot/dependabot-core#15904.
The weekly Toolchain updates workflow opens a pull request once that is fixed.

4. Patched libraries (own issues from the Patched libraries workflow)

        - **dash.js 5.1.0 → 5.2.1** (minor): re-cut the patch, verify.(already done)
        - **mp4box 0.5.3 → 2.4.1** (major, a rewrite): decide whether to take it; close its issue to skip. (already done)

5. More updates that merge themselves (todo, added 2026-09-30)

You decided to do these later, yourself. Each one is a small change in .github/workflows/update-prs.yml, in its list "Why this one waits for the owner".

Node.js majors (branches toolchain/node-*). Today every one waits: "a new Node.js major is your decision". Let them merge themselves once CI is green and the extension build is unchanged. Node only builds and tests the extension; nothing it does reaches Firefox. Do this after the Node 26 pull request from item 1, so that one still gets your look.
Dev-tool majors from Dependabot (vitest 6, eslint 11 and the like). Today a pull request that holds a major waits: "it holds a major version: read its release notes". Riskier than Node: a new major of a test runner or linter can change what the tests check without CI going red. If you do it, keep Dependabot's 5-day cooldown.

Both run on your PC after pnpm install, so the supply-chain guards matter for them as for the minor updates: the 5-day cooldown, pnpm running no install scripts except esbuild's and geckodriver's, and pnpm's minimum release age.

Not needed

npm: FastStream uses pnpm; npm only touches fsaunpack. Since ci(dependabot): version updates for fsaunpack, each waiting for you #71, Dependabot opens version-update pull requests for it too, and each one waits for you (build(deps): bump express from 4.22.3 to 5.2.1 in /fsaunpack #75: express 5).

How

One PR for all of it, pnpm run verify locally, CI green, merge - one release.

The Reminders workflow comments here on November 1 (label reminder: november).

verify:linux: take the Node major from ci.yml instead of a fixed 22

@Nawid3333

@Nawid3333 Where this stands after 2026-09-25, and the checklist for the November PR.

Done since this issue was written

dash.js 5.2.1 and mp4box 2.4.1 (deps: dash.js 5.2.1 and mp4box 2.4.1, with their patches re-cut #20).
Updates to patched libraries now arrive as ready-made PRs when the re-cut is clean, and as issues when it isn't (Re-cut tool for patched libraries, update PRs from the workflow, CI's Linux checks in WSL (24.04 + 26.04) #21).
pnpm run verify:linux runs CI's Linux checks in WSL on Ubuntu 24.04 and 26.04, and updates each distro to the latest first (Re-cut tool for patched libraries, update PRs from the workflow, CI's Linux checks in WSL (24.04 + 26.04) #21).
Dependabot's 2026-09-25 updates went out as one PR (Dependabot updates of 2026-09-25 as one release; ignore onnxruntime-web and mp4-muxer; release only what ships #27). Dependabot now ignores onnxruntime-web and mp4-muxer; the reasons are next to each entry in dependabot.yml.
A push that changes nothing shipped no longer releases (Dependabot updates of 2026-09-25 as one release; ignore onnxruntime-web and mp4-muxer; release only what ships #27). The November toolchain PR may therefore produce no Firefox update at all, which is correct.

Dates

ubuntu-latest moves to 26.04 between Oct 19 and Nov 19. During that window a CI job can land on either version. 26.04 already passes, locally and in runner-images.yml.
Node 26 becomes LTS in late October. Node 22 is supported until April 2027.

The November PR, in order

Node 22 → 26: node-version in every workflow and in .nvmrc. WSL follows ci.yml automatically. This closes Toolchain update: Node.js 24 #11 and the Node 26 issue that will replace it.
pnpm → the newest 11.x (11.28.0 on 2026-09-25).
pnpm 12, only if pnpm v12 env lockfile document is parsed as an empty dependency graph dependabot/dependabot-core#15904 is fixed.
A fresh check of everything: pnpm outdated, open Dependabot PRs, the Patched libraries workflow, Firefox stable and beta.
Run pnpm run verify (Windows) and pnpm run verify:linux (24.04 and 26.04). Then open the PR, wait for CI, merge.

actions/runner-images#14748

Ubuntu runner change

@Nawid3333

@Nawid3333 Since #60, most of this batch arrives by itself as pull requests. CI tests each one.

1. Node.js 22 → 26:

.nvmrc is now the only place that names the Node major. Every workflow reads it.
The weekly Toolchain updates run (Mondays) opens a PR that changes .nvmrc once 26 is LTS, in late October.
That PR waits for you. Its CI result reaches you as an @mention email.
Early look, 2026-09-29: CI passed on Node 26.10.0, covering lint, 618 unit tests, the build, and every e2e suite on Linux and Windows (run).

2. pnpm → latest 11.x:

The same weekly run opens a PR that changes only packageManager.
update-prs.yml merges it when all of these hold:
- CI is green on the unchanged lockfile (--frozen-lockfile);
- the built extension is identical to the last release, so nothing is released.
If it fails, it waits for you and you get an email.

3. pnpm 12: the weekly run opens its PR only once dependabot/dependabot-core#15904 is closed, and that PR waits for you.

4. Patched libraries: unchanged. There is one PR or issue per library, and a newer version now closes the older one.

Other npm updates (Dependabot):

A tooling minor or patch update merges itself when CI is green and the build is identical.
A shipped library or a major update waits for you.

All update sources are listed in docs/maintenance.md.

This issue stays open as your November reminder. What's left for you by hand is merging the Node 26 PR, and later pnpm 12.

build: Node.js 26 in CI, pnpm 11.28.0, @types/node 26 (issue #10) (#119)

ci(update-prs): every update merges itself once CI is green (issue #10)…

All four PRs that make this issue's batch are merged (squashed, each CI-green):

ci(update-prs): every update merges itself once CI is green (issue #10) #120 ci(update-prs): every update merges itself once CI is green — item 5's "more updates that merge themselves" groundwork. What the workflow checks is in its header; docs/maintenance.md documents what each kind waits for.
build: one double-click brings this PC's tools up to date (update-local.cmd) #121 build: one double-click brings this PC's tools up to date (update-local.cmd) — GitHub cannot update the PC itself; update-local.cmd (tools/update-local.ps1) does, applying CI's rule (a release counts once 5 days old). Node from nodejs.org's installer, SHASUMS256-checked + OpenJS-signature-verified, staged in a per-user ACL directory; npm; the pinned pnpm; a clean main; fsaunpack's npm ci; the mpv helper. Checks and reports by default; -Apply applies. Two CodeQL findings fixed while it was open.
build(deps): basic-ftp 6.2.1 under get-uri (Dependabot #59, high) #122 build(deps): basic-ftp 6.2.1 under get-uri (Dependabot ci: run shinchiro's mpv build on Windows, and move its pin daily #59, high) — clears the repository's one high-severity alert; nothing shipped changes (get-uri is dev-only).
ci(vendored-updates): watch the adapted copies' upstream code #123 ci(vendored-updates): watch the adapted copies' upstream code — vendored-updates.yml's new sources job checks knob.mjs, StreamSaver.mjs, crosstalk/fft.mjs and vad/vad.mjs (copies of other projects' code, changed here) against their upstream paths daily (tools/vendored-sources.json), and opens an issue when upstream moved past the ref a copy was taken from.

Items 1 (#119, Node 26 in CI), 2 (pnpm 11.27.1+, merged updates since) and 4 (dash.js 5.2.1, mp4box decision) were done earlier. Item 3 (pnpm 12) still waits on dependabot/dependabot-core#15904, and item 5's Node/dev-tool majors wait for your November go-ahead — that is what the Reminders comment on November 1 is for.

Closing this issue as planned: the batch is in, the November reminders carry it on.

Navigation Menu

Repository navigation

Late November/december 2026: toolchain and library updates #10

1. Node.js in CI: 22 → 26

2. pnpm: 11.22.0 → latest 11.x (done)

3. pnpm 12: only once Dependabot supports it

4. Patched libraries (own issues from the Patched libraries workflow)

5. More updates that merge themselves (todo, added 2026-09-30)

Not needed

How

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Late November/december 2026: toolchain and library updates #10

Description

1. Node.js in CI: 22 → 26

2. pnpm: 11.22.0 → latest 11.x (done)

3. pnpm 12: only once Dependabot supports it

4. Patched libraries (own issues from the Patched libraries workflow)

5. More updates that merge themselves (todo, added 2026-09-30)

Not needed

How

Activity

Nawid3333 commented on Sep 25, 2026

Nawid3333 commented on Sep 29, 2026

Nawid3333 commented on Sep 29, 2026

Nawid3333 commented on Oct 1, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions