Bump docker image to use ubuntu 24.04

.github/workflows/build.yml

@@ -14,6 +14,9 @@ on:
     paths-ignore:
     - '**.md'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
@@ -80,3 +83,48 @@ jobs:
         name: runner-package-${{ matrix.runtime }}
         path: |
           _package
+
+  docker:
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, ubuntu-24.04-arm ]
+        include:
+          - os: ubuntu-latest
+            docker_platform: linux/amd64
+          - os: ubuntu-24.04-arm
+            docker_platform: linux/arm64
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v5
+
+    - name: Get latest runner version
+      id: latest_runner
+      uses: actions/github-script@v7
+      with:
+        github-token: ${{secrets.GITHUB_TOKEN}}
+        script: |
+          const release = await github.rest.repos.getLatestRelease({
+            owner: 'actions',
+            repo: 'runner',
+          });
+          const version = release.data.tag_name.replace(/^v/, '');
+          core.setOutput('version', version);
+
+    - name: Setup Docker buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Build Docker image
+      uses: docker/build-push-action@v6
+      with:
+        context: ./images
+        load: true
+        platforms: ${{ matrix.docker_platform }}
+        tags: |
+          ${{ github.sha }}:latest
+        build-args: |
+          RUNNER_VERSION=${{ steps.latest_runner.outputs.version }}
+
+    - name: Test Docker image
+      run: |
+        docker run --rm ${{ github.sha }}:latest ./run.sh --version
+  

.github/workflows/docker-buildx-upgrade.yml

@@ -2,8 +2,8 @@ name: "Docker/Buildx Version Upgrade"
 
 on:
   schedule:
-    - cron: "0 9 * * 1" # Weekly on Monday at 9 AM UTC (independent of other dependencies)
-  workflow_dispatch: # Allow manual triggering
+    - cron: '0 0 * * 1'  # Run every Monday at midnight
+  workflow_dispatch:      # Allow manual triggering
 
 jobs:
   check-versions:
@@ -35,7 +35,7 @@ jobs:
             echo "Failed to retrieve a valid Docker version"
             exit 1
           fi
-
+          
           should_update=0
           [ "$current_version" != "$latest_version" ] && should_update=1
 
@@ -64,17 +64,17 @@ jobs:
         run: |
           docker_should_update="${{ steps.check_docker_version.outputs.SHOULD_UPDATE }}"
           buildx_should_update="${{ steps.check_buildx_version.outputs.SHOULD_UPDATE }}"
-
+          
           # Show annotation if only Docker needs update
           if [[ "$docker_should_update" == "1" && "$buildx_should_update" == "0" ]]; then
             echo "::warning ::Docker version (${{ steps.check_docker_version.outputs.LATEST_VERSION }}) needs update but Buildx is current. Only updating when both need updates."
           fi
-
+          
           # Show annotation if only Buildx needs update
           if [[ "$docker_should_update" == "0" && "$buildx_should_update" == "1" ]]; then
             echo "::warning ::Buildx version (${{ steps.check_buildx_version.outputs.LATEST_VERSION }}) needs update but Docker is current. Only updating when both need updates."
           fi
-
+          
           # Show annotation when both are current
           if [[ "$docker_should_update" == "0" && "$buildx_should_update" == "0" ]]; then
             echo "::warning ::Latest Docker version is ${{ steps.check_docker_version.outputs.LATEST_VERSION }} and Buildx version is ${{ steps.check_buildx_version.outputs.LATEST_VERSION }}. No updates needed."
@@ -90,25 +90,25 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
-
+      
       - name: Update Docker version
         shell: bash
         run: |
           latest_version="${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }}"
           current_version="${{ needs.check-versions.outputs.DOCKER_CURRENT_VERSION }}"
-
+          
           # Update version in Dockerfile
           sed -i "s/ARG DOCKER_VERSION=$current_version/ARG DOCKER_VERSION=$latest_version/g" ./images/Dockerfile
-
+      
       - name: Update Buildx version
         shell: bash
         run: |
           latest_version="${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}"
           current_version="${{ needs.check-versions.outputs.BUILDX_CURRENT_VERSION }}"
-
+          
           # Update version in Dockerfile
           sed -i "s/ARG BUILDX_VERSION=$current_version/ARG BUILDX_VERSION=$latest_version/g" ./images/Dockerfile
-
+      
       - name: Commit changes and create Pull Request
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -117,7 +117,7 @@ jobs:
           branch_name="feature/docker-buildx-upgrade"
           commit_message="Upgrade Docker to v${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} and Buildx to v${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}"
           pr_title="Update Docker to v${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} and Buildx to v${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}"
-
+          
           # Configure git
           git config --global user.name "github-actions[bot]"
           git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
@@ -129,35 +129,16 @@ jobs:
           else
             git checkout -b "$branch_name"
           fi
-
+          
           # Commit and push changes
           git commit -a -m "$commit_message"
           git push --force origin "$branch_name"
-
-          # Create PR body using here-doc for proper formatting
-          cat > pr_body.txt << 'EOF'
-          Automated Docker and Buildx version update:
           
-          - Docker: ${{ needs.check-versions.outputs.DOCKER_CURRENT_VERSION }} → ${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }}
-          - Buildx: ${{ needs.check-versions.outputs.BUILDX_CURRENT_VERSION }} → ${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}
-          
-          This update ensures we're using the latest stable Docker and Buildx versions for security and performance improvements.
-          
-          **Release notes:** https://docs.docker.com/engine/release-notes/
-          
-          **Next steps:**
-          - Review the version changes
-          - Verify container builds work as expected
-          - Test multi-platform builds if applicable
-          - Merge when ready
-          
-          ---
-          
-          Autogenerated by [Docker/Buildx Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/docker-buildx-upgrade.yml)
-          EOF
-
           # Create PR
+          pr_body="Upgrades Docker version from ${{ needs.check-versions.outputs.DOCKER_CURRENT_VERSION }} to ${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} and Docker Buildx version from ${{ needs.check-versions.outputs.BUILDX_CURRENT_VERSION }} to ${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}.\n\n"
+          pr_body+="Release notes: https://docs.docker.com/engine/release-notes/\n\n"
+          pr_body+="---\n\nAutogenerated by [Docker/Buildx Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/docker-buildx-upgrade.yml)"
+          
           gh pr create -B main -H "$branch_name" \
             --title "$pr_title" \
-            --label "dependencies" \
-            --body-file pr_body.txt
+            --body "$pr_body"

.github/workflows/dotnet-upgrade.yml

@@ -2,13 +2,13 @@ name: "DotNet SDK Upgrade"
 
 on:
   schedule:
-    - cron: "0 8 * * 1" # Weekly on Monday at 8 AM UTC (independent of Node.js/NPM)
+    - cron: '0 0 * * 1'
   workflow_dispatch:
 
 jobs:
   dotnet-update:
     runs-on: ubuntu-latest
-    outputs:
+    outputs: 
       SHOULD_UPDATE: ${{ steps.fetch_latest_version.outputs.SHOULD_UPDATE }}
       BRANCH_EXISTS: ${{ steps.fetch_latest_version.outputs.BRANCH_EXISTS }}
       DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION: ${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}
@@ -37,7 +37,7 @@ jobs:
 
           # check if git branch already exists for the upgrade
           branch_already_exists=0
-
+          
           if git ls-remote --heads --exit-code origin refs/heads/feature/dotnetsdk-upgrade/${latest_patch_version};
           then 
             branch_already_exists=1
@@ -89,17 +89,17 @@ jobs:
     if: ${{ needs.dotnet-update.outputs.SHOULD_UPDATE == 1 && needs.dotnet-update.outputs.BRANCH_EXISTS == 0 }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}
-      - name: Create Pull Request
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh pr create -B main -H feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }} --title "Update dotnet sdk to latest version @${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}" --label "dependencies" --body "
-            https://dotnetcli.blob.core.windows.net/dotnet/Sdk/${{ needs.dotnet-update.outputs.DOTNET_CURRENT_MAJOR_MINOR_VERSION }}/latest.version
+    - uses: actions/checkout@v5
+      with:
+        ref: feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}
+    - name: Create Pull Request
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        gh pr create -B main -H feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }} --title "Update dotnet sdk to latest version @${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}" --body "
+          https://dotnetcli.blob.core.windows.net/dotnet/Sdk/${{ needs.dotnet-update.outputs.DOTNET_CURRENT_MAJOR_MINOR_VERSION }}/latest.version
+          
             
-              
-            ---
-              
-            Autogenerated by [DotNet SDK Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/dotnet-upgrade.yml)"
+          ---
+            
+          Autogenerated by [DotNet SDK Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/dotnet-upgrade.yml)"

.github/workflows/node-upgrade.yml

@@ -1,126 +0,0 @@
-name: Auto Update Node Version
-
-on:
-  schedule:
-    - cron: "0 6 * * 1" # Weekly, every Monday
-  workflow_dispatch:
-
-jobs:
-  update-node:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - name: Get latest Node versions
-        id: node-versions
-        run: |
-          # Get latest Node.js releases from official GitHub releases
-          echo "Fetching latest Node.js releases..."
-
-          # Get latest v20.x release
-          LATEST_NODE20=$(curl -s https://api.github.com/repos/nodejs/node/releases | \
-            jq -r '.[] | select(.tag_name | startswith("v20.")) | .tag_name' | \
-            head -1 | sed 's/^v//')
-
-          # Get latest v24.x release  
-          LATEST_NODE24=$(curl -s https://api.github.com/repos/nodejs/node/releases | \
-            jq -r '.[] | select(.tag_name | startswith("v24.")) | .tag_name' | \
-            head -1 | sed 's/^v//')
-
-          echo "Found Node.js releases: 20=$LATEST_NODE20, 24=$LATEST_NODE24"
-
-          # Verify these versions are available in alpine_nodejs releases
-          echo "Verifying availability in alpine_nodejs..."
-          ALPINE_RELEASES=$(curl -s https://api.github.com/repos/actions/alpine_nodejs/releases | jq -r '.[].tag_name')
-
-          if ! echo "$ALPINE_RELEASES" | grep -q "^node20-$LATEST_NODE20$"; then
-            echo "::warning title=Node 20 Fallback::Node 20 version $LATEST_NODE20 not found in alpine_nodejs releases, using fallback"
-            # Fall back to latest available alpine_nodejs v20 release
-            LATEST_NODE20=$(echo "$ALPINE_RELEASES" | grep "^node20-" | head -1 | sed 's/^node20-//')
-            echo "Using latest available alpine_nodejs Node 20: $LATEST_NODE20"
-          fi
-
-          if ! echo "$ALPINE_RELEASES" | grep -q "^node24-$LATEST_NODE24$"; then
-            echo "::warning title=Node 24 Fallback::Node 24 version $LATEST_NODE24 not found in alpine_nodejs releases, using fallback"
-            # Fall back to latest available alpine_nodejs v24 release
-            LATEST_NODE24=$(echo "$ALPINE_RELEASES" | grep "^node24-" | head -1 | sed 's/^node24-//')
-            echo "Using latest available alpine_nodejs Node 24: $LATEST_NODE24"
-          fi
-
-          echo "latest_node20=$LATEST_NODE20" >> $GITHUB_OUTPUT
-          echo "latest_node24=$LATEST_NODE24" >> $GITHUB_OUTPUT
-
-          # Check current versions in externals.sh
-          CURRENT_NODE20=$(grep "NODE20_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
-          CURRENT_NODE24=$(grep "NODE24_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
-
-          echo "current_node20=$CURRENT_NODE20" >> $GITHUB_OUTPUT
-          echo "current_node24=$CURRENT_NODE24" >> $GITHUB_OUTPUT
-
-          # Determine if updates are needed
-          NEEDS_UPDATE20="false"
-          NEEDS_UPDATE24="false"
-
-          if [ "$CURRENT_NODE20" != "$LATEST_NODE20" ]; then
-            NEEDS_UPDATE20="true"
-            echo "::notice title=Node 20 Update Available::Current: $CURRENT_NODE20 → Latest: $LATEST_NODE20"
-          fi
-
-          if [ "$CURRENT_NODE24" != "$LATEST_NODE24" ]; then
-            NEEDS_UPDATE24="true"
-            echo "::notice title=Node 24 Update Available::Current: $CURRENT_NODE24 → Latest: $LATEST_NODE24"
-          fi
-
-          if [ "$NEEDS_UPDATE20" == "false" ] && [ "$NEEDS_UPDATE24" == "false" ]; then
-            echo "::notice title=No Updates Needed::All Node.js versions are up to date"
-          fi
-
-          echo "needs_update20=$NEEDS_UPDATE20" >> $GITHUB_OUTPUT
-          echo "needs_update24=$NEEDS_UPDATE24" >> $GITHUB_OUTPUT
-
-      - name: Update externals.sh and create PR
-        if: steps.node-versions.outputs.needs_update20 == 'true' || steps.node-versions.outputs.needs_update24 == 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Update the files
-          if [ "${{ steps.node-versions.outputs.needs_update20 }}" == "true" ]; then
-            sed -i 's/NODE20_VERSION="[^"]*"/NODE20_VERSION="${{ steps.node-versions.outputs.latest_node20 }}"/' src/Misc/externals.sh
-          fi
-
-          if [ "${{ steps.node-versions.outputs.needs_update24 }}" == "true" ]; then
-            sed -i 's/NODE24_VERSION="[^"]*"/NODE24_VERSION="${{ steps.node-versions.outputs.latest_node24 }}"/' src/Misc/externals.sh
-          fi
-
-          # Configure git
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
-
-          # Create branch and commit changes
-          branch_name="chore/update-node"
-          git checkout -b "$branch_name"
-          git commit -a -m "chore: update Node versions (20: ${{ steps.node-versions.outputs.latest_node20 }}, 24: ${{ steps.node-versions.outputs.latest_node24 }})"
-          git push --force origin "$branch_name"
-
-          # Create PR body using here-doc for proper formatting
-          cat > pr_body.txt << 'EOF'
-          Automated Node.js version update:
-
-          - Node 20: ${{ steps.node-versions.outputs.current_node20 }} → ${{ steps.node-versions.outputs.latest_node20 }}
-          - Node 24: ${{ steps.node-versions.outputs.current_node24 }} → ${{ steps.node-versions.outputs.latest_node24 }}
-
-          This update ensures we're using the latest stable Node.js versions for security and performance improvements.
-
-          **Note**: When updating Node versions, remember to also create a new release of alpine_nodejs at the updated version following the instructions at: https://github.com/actions/alpine_nodejs
-
-          ---
-
-          Autogenerated by [Node Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/node-upgrade.yml)
-          EOF
-
-          # Create PR
-          gh pr create -B main -H "$branch_name" \
-            --title "chore: update Node versions" \
-            --label "dependencies" \
-            --body-file pr_body.txt
-
-          echo "::notice title=PR Created::Successfully created Node.js version update PR on branch $branch_name"

.github/workflows/npm-audit-typescript.yml

@@ -1,235 +0,0 @@
-name: NPM Audit Fix with TypeScript Auto-Fix
-
-on:
-  workflow_dispatch:
-
-jobs:
-  npm-audit-with-ts-fix:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - name: NPM install and audit fix with TypeScript auto-repair
-        working-directory: src/Misc/expressionFunc/hashFiles
-        run: |
-          npm install
-
-          # Check for vulnerabilities first
-          echo "Checking for npm vulnerabilities..."
-          if npm audit --audit-level=moderate; then
-            echo "✅ No moderate or higher vulnerabilities found"
-            exit 0
-          fi
-
-          echo "⚠️ Vulnerabilities found, attempting npm audit fix..."
-
-          # Attempt audit fix and capture the result
-          if npm audit fix; then
-            echo "✅ npm audit fix completed successfully"
-            AUDIT_FIX_STATUS="success"
-          else
-            echo "⚠️ npm audit fix failed or had issues"
-            AUDIT_FIX_STATUS="failed"
-            
-            # Try audit fix with --force as a last resort for critical/high vulns only
-            echo "Checking if critical/high vulnerabilities remain..."
-            if ! npm audit --audit-level=high; then
-              echo "🚨 Critical/high vulnerabilities remain, attempting --force fix..."
-              if npm audit fix --force; then
-                echo "⚠️ npm audit fix --force completed (may have breaking changes)"
-                AUDIT_FIX_STATUS="force-fixed"
-              else
-                echo "❌ npm audit fix --force also failed"
-                AUDIT_FIX_STATUS="force-failed"
-              fi
-            else
-              echo "✅ Only moderate/low vulnerabilities remain after failed fix"
-              AUDIT_FIX_STATUS="partial-success"
-            fi
-          fi
-
-          echo "AUDIT_FIX_STATUS=$AUDIT_FIX_STATUS" >> $GITHUB_ENV
-
-          # Try to fix TypeScript issues automatically
-          echo "Attempting to fix TypeScript compatibility issues..."
-
-          # Check if build fails
-          if ! npm run build 2>/dev/null; then
-            echo "Build failed, attempting automated fixes..."
-            
-            # Common fix 1: Update @types/node to latest compatible version
-            echo "Trying to update @types/node to latest version..."
-            npm update @types/node
-            
-            # Common fix 2: If that doesn't work, try installing a specific known-good version
-            if ! npm run build 2>/dev/null; then
-              echo "Trying specific @types/node version..."
-              # Try Node 20 compatible version
-              npm install --save-dev @types/node@^20.0.0
-            fi
-            
-            # Common fix 3: Clear node_modules and reinstall if still failing
-            if ! npm run build 2>/dev/null; then
-              echo "Clearing node_modules and reinstalling..."
-              rm -rf node_modules package-lock.json
-              npm install
-              
-              # Re-run audit fix after clean install if it was successful before
-              if [[ "$AUDIT_FIX_STATUS" == "success" || "$AUDIT_FIX_STATUS" == "force-fixed" ]]; then
-                echo "Re-running npm audit fix after clean install..."
-                npm audit fix || echo "Audit fix failed on second attempt"
-              fi
-            fi
-            
-            # Common fix 4: Try updating TypeScript itself
-            if ! npm run build 2>/dev/null; then
-              echo "Trying to update TypeScript..."
-              npm update typescript
-            fi
-            
-            # Final check
-            if npm run build 2>/dev/null; then
-              echo "✅ Successfully fixed TypeScript issues automatically"
-            else
-              echo "⚠️ Could not automatically fix TypeScript issues"
-            fi
-          else
-            echo "✅ Build passes after audit fix"
-          fi
-
-      - name: Create PR if changes exist
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HUSKY: 0 # Disable husky hooks for automated commits
-        run: |
-          # Check if there are any changes
-          if [ -n "$(git status --porcelain)" ]; then
-            # Configure git
-            git config --global user.name "github-actions[bot]"
-            git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
-
-            # Create branch and commit changes
-            branch_name="chore/npm-audit-fix-with-ts-repair"
-            git checkout -b "$branch_name"
-            
-            # Commit with --no-verify to skip husky hooks
-            git commit -a -m "chore: npm audit fix with automated TypeScript compatibility fixes" --no-verify
-            git push --force origin "$branch_name"
-            
-            # Check final build status and gather info about what was changed
-            build_status="✅ Build passes"
-            fixes_applied=""
-            cd src/Misc/expressionFunc/hashFiles
-            
-            # Check what packages were updated
-            if git diff HEAD~1 package.json | grep -q "@types/node"; then
-              fixes_applied+="\n- Updated @types/node version for TypeScript compatibility"
-            fi
-            if git diff HEAD~1 package.json | grep -q "typescript"; then
-              fixes_applied+="\n- Updated TypeScript version"
-            fi
-            if git diff HEAD~1 package-lock.json | grep -q "resolved"; then
-              fixes_applied+="\n- Updated package dependencies via npm audit fix"
-            fi
-            
-            if ! npm run build 2>/dev/null; then
-              build_status="⚠️ Build fails - manual review required"
-            fi
-            cd - > /dev/null
-            
-            # Create enhanced PR body using here-doc for proper formatting
-            audit_status_msg=""
-            case "$AUDIT_FIX_STATUS" in
-              "success")
-                audit_status_msg="✅ **Audit Fix**: Completed successfully"
-                ;;
-              "partial-success")
-                audit_status_msg="⚠️ **Audit Fix**: Partial success (only moderate/low vulnerabilities remain)"
-                ;;
-              "force-fixed")
-                audit_status_msg="⚠️ **Audit Fix**: Completed with --force (may have breaking changes)"
-                ;;
-              "failed"|"force-failed")
-                audit_status_msg="❌ **Audit Fix**: Failed to resolve vulnerabilities"
-                ;;
-              *)
-                audit_status_msg="❓ **Audit Fix**: Status unknown"
-                ;;
-            esac
-            
-            if [[ "$build_status" == *"fails"* ]]; then
-              cat > pr_body.txt << EOF
-          Automated npm audit fix with TypeScript auto-repair for hashFiles dependencies.
-
-          **Build Status**: ⚠️ Build fails - manual review required
-          $audit_status_msg
-
-          This workflow attempts to automatically fix TypeScript compatibility issues that may arise from npm audit fixes.
-
-          ⚠️ **Manual Review Required**: The build is currently failing after automated fixes were attempted.
-
-          Common issues and solutions:
-          - Check for TypeScript version compatibility with Node.js types
-          - Review breaking changes in updated dependencies
-          - Consider pinning problematic dependency versions temporarily
-          - Review tsconfig.json for compatibility settings
-
-          **Automated Fix Strategy**:
-          1. Run npm audit fix with proper error handling
-          2. Update @types/node to latest compatible version
-          3. Try Node 20 specific @types/node version if needed
-          4. Clean reinstall dependencies if conflicts persist
-          5. Update TypeScript compiler if necessary
-
-          ---
-
-          Autogenerated by [NPM Audit Fix with TypeScript Auto-Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit-ts-fix.yml)
-          EOF
-            else
-              cat > pr_body.txt << EOF
-          Automated npm audit fix with TypeScript auto-repair for hashFiles dependencies.
-
-          **Build Status**: ✅ Build passes
-          $audit_status_msg
-
-          This workflow attempts to automatically fix TypeScript compatibility issues that may arise from npm audit fixes.
-
-          ✅ **Ready to Merge**: All automated fixes were successful and the build passes.
-
-          **Automated Fix Strategy**:
-          1. Run npm audit fix with proper error handling
-          2. Update @types/node to latest compatible version
-          3. Try Node 20 specific @types/node version if needed
-          4. Clean reinstall dependencies if conflicts persist
-          5. Update TypeScript compiler if necessary
-
-          ---
-
-          Autogenerated by [NPM Audit Fix with TypeScript Auto-Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit-ts-fix.yml)
-          EOF
-            fi
-            
-            if [ -n "$fixes_applied" ]; then
-              # Add the fixes applied section to the file
-              sed -i "/This workflow attempts/a\\
-          \\
-          **Automated Fixes Applied**:$fixes_applied" pr_body.txt
-            fi
-            
-            # Create PR with appropriate labels
-            labels="dependency,typescript"
-            if [[ "$build_status" == *"fails"* ]]; then
-              labels="dependency,typescript,needs-manual-review"
-            fi
-            
-            # Create PR
-            gh pr create -B main -H "$branch_name" \
-              --title "chore: npm audit fix with TypeScript auto-repair" \
-              --label "$labels" \
-              --body-file pr_body.txt
-          else
-            echo "No changes to commit"
-          fi

.github/workflows/npm-audit.yml

@@ -1,132 +0,0 @@
-name: NPM Audit Fix
-
-on:
-  schedule:
-    - cron: "0 7 * * 1" # Weekly on Monday at 7 AM UTC
-  workflow_dispatch:
-
-jobs:
-  npm-audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          
-      - name: NPM install and audit fix
-        working-directory: src/Misc/expressionFunc/hashFiles
-        run: |
-          npm install
-          
-          # Check what vulnerabilities exist
-          echo "=== Checking current vulnerabilities ==="
-          npm audit || true
-          
-          # Apply audit fix --force to get security updates
-          echo "=== Applying npm audit fix --force ==="
-          npm audit fix --force
-          
-          # Test if build still works and set status
-          echo "=== Testing build compatibility ==="
-          if npm run all; then
-            echo "✅ Build successful after audit fix"
-            echo "AUDIT_FIX_STATUS=success" >> $GITHUB_ENV
-          else
-            echo "❌ Build failed after audit fix - will create PR with fix instructions"
-            echo "AUDIT_FIX_STATUS=build_failed" >> $GITHUB_ENV
-          fi
-          
-      - name: Create PR if changes exist
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Check if there are any changes
-          if [ -n "$(git status --porcelain)" ]; then
-            # Configure git
-            git config --global user.name "github-actions[bot]"
-            git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-            
-            # Create branch and commit changes
-            branch_name="chore/npm-audit-fix-$(date +%Y%m%d)"
-            git checkout -b "$branch_name"
-            git add .
-            git commit -m "chore: npm audit fix for hashFiles dependencies" --no-verify
-            git push origin "$branch_name"
-            
-            # Create PR body based on what actually happened
-            if [ "$AUDIT_FIX_STATUS" = "success" ]; then
-              cat > pr_body.txt << 'EOF'
-          Automated npm audit fix for security vulnerabilities in hashFiles dependencies.
-          
-          **✅ Full Fix Applied Successfully**
-          This update addresses npm security advisories and ensures dependencies are secure and up-to-date.
-          
-          **Changes made:**
-          - Applied `npm audit fix --force` to resolve security vulnerabilities
-          - Updated package-lock.json with security patches
-          - Verified build compatibility with `npm run all`
-          
-          **Next steps:**
-          - Review the dependency changes  
-          - Verify the hashFiles functionality still works as expected
-          - Merge when ready
-          
-          ---
-          
-          Autogenerated by [NPM Audit Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit.yml)
-          EOF
-            elif [ "$AUDIT_FIX_STATUS" = "build_failed" ]; then
-              cat > pr_body.txt << 'EOF'
-          Automated npm audit fix for security vulnerabilities in hashFiles dependencies.
-          
-          **⚠️ Security Fixes Applied - Build Issues Need Manual Resolution**
-          This update applies important security patches but causes build failures that require manual fixes.
-          
-          **Changes made:**
-          - Applied `npm audit fix --force` to resolve security vulnerabilities
-          - Updated package-lock.json with security patches
-          
-          **⚠️ Build Issues Detected:**
-          The build fails after applying security fixes, likely due to TypeScript compatibility issues with updated `@types/node`.
-          
-          **Required Manual Fixes:**
-          1. Review TypeScript compilation errors in the build output
-          2. Update TypeScript configuration if needed
-          3. Consider pinning `@types/node` to a compatible version
-          4. Run `npm run all` locally to verify fixes
-          
-          **Next steps:**
-          - **DO NOT merge until build issues are resolved**
-          - Apply manual fixes for TypeScript compatibility
-          - Test the hashFiles functionality still works as expected
-          - Merge when build passes
-          
-          ---
-          
-          Autogenerated by [NPM Audit Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit.yml)
-          EOF
-            else
-              # Fallback case
-              cat > pr_body.txt << 'EOF'
-          Automated npm audit attempted for security vulnerabilities in hashFiles dependencies.
-          
-          **ℹ️ No Changes Applied**
-          No security vulnerabilities were found or no changes were needed.
-          
-          ---
-          
-          Autogenerated by [NPM Audit Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit.yml)
-          EOF
-            fi
-            
-            # Create PR
-            gh pr create -B main -H "$branch_name" \
-              --title "chore: npm audit fix for hashFiles dependencies" \
-              --label "dependencies" \
-              --body-file pr_body.txt
-          else
-            echo "✅ No changes to commit - npm audit fix did not modify any files"
-          fi

.github/workflows/release.yml

@@ -334,8 +334,9 @@ jobs:
           push: true
           labels: |
             org.opencontainers.image.source=${{github.server_url}}/${{github.repository}}
-            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
             org.opencontainers.image.licenses=MIT
+          annotations: |
+            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
 
       - name: Generate attestation
         uses: actions/attest-build-provenance@v3

images/Dockerfile

@@ -1,12 +1,12 @@
 # Source: https://github.com/dotnet/dotnet-docker
-FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy AS build
+FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-noble AS build
 
 ARG TARGETOS
 ARG TARGETARCH
 ARG RUNNER_VERSION
 ARG RUNNER_CONTAINER_HOOKS_VERSION=0.7.0
-ARG DOCKER_VERSION=28.4.0
-ARG BUILDX_VERSION=0.28.0
+ARG DOCKER_VERSION=28.3.3
+ARG BUILDX_VERSION=0.27.0
 
 RUN apt update -y && apt install curl unzip -y
 
@@ -32,12 +32,12 @@ RUN export RUNNER_ARCH=${TARGETARCH} \
         "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-${TARGETARCH}" \
     && chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx
 
-FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy
+FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-noble
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV RUNNER_MANUALLY_TRAP_SIG=1
 ENV ACTIONS_RUNNER_PRINT_LOG_TO_STDOUT=1
-ENV ImageOS=ubuntu22
+ENV ImageOS=ubuntu24
 
 # 'gpg-agent' and 'software-properties-common' are needed for the 'add-apt-repository' command that follows
 RUN apt update -y \

src/Misc/externals.sh

@@ -6,8 +6,8 @@ NODE_URL=https://nodejs.org/dist
 NODE_ALPINE_URL=https://github.com/actions/alpine_nodejs/releases/download
 # When you update Node versions you must also create a new release of alpine_nodejs at that updated version.
 # Follow the instructions here: https://github.com/actions/alpine_nodejs?tab=readme-ov-file#getting-started
-NODE20_VERSION="20.19.5"
-NODE24_VERSION="24.7.0"
+NODE20_VERSION="20.19.4"
+NODE24_VERSION="24.5.0"
 
 get_abs_path() {
   # exploits the fact that pwd will print abs path when no args