Node.js 24.14.0 carries CVE-2026-111497 ("Node2Shell"), an out-of-bounds
write in the bundled Brotli decoder that can lead to remote code
execution, plus several high-severity DNS, TLS and URL-parsing fixes.
24.22.1 is the first patched 24.x release.
- Dockerfile: node:24.22.1-slim, digest re-pinned to the multi-arch index
- CI: 24.22.1 in the verify matrix and the other two jobs; the
allocation-gate requirement now keys on 24.22.1
- Docs: contributor setup and the dependency baseline name 24.22.1
The engines floor and the setup doctor are unchanged.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
stopScene now supersedes seeks through _bumpSceneSeekGeneration; the
bhoteKoshiLocator Stop test calls stopScene on a plain object, so it
needs the method too. Without it four tests throw at the PR head.
- Superseding a seek aborts only the seek's own layer reconcile, so a
loadShot that is later rejected (shot-not-found) no longer cancels an
in-flight LOAD. Stop still aborts any LOAD.
- A refused seek rolls back to each layer's effective intent, so a manual
toggle still in flight is kept.
- A cancelled seek leaves layers to whatever superseded it, as a cancelled
LOAD does; only refusal rolls back.
- Move the _seekLoadedShot JSDoc back onto its method.
The route proxy also refuses with 'routing busy — too many routes at once'
(429) and 'route proxy error'; both showed in English in every locale.
Mark them in ROUTING_REFUSALS and add es, ru, zh-CN and zh-Hant entries.
errorText is now cleared on a new connection, a mode switch and stop(), so
it never outlives the error it describes. Tests cover the two refusals,
'Routing failed: rate limited' (pattern order) and the stop() reset.
When several candidates fit a "place, region" query, take a settlement or
administrative area over a POI of the same name, so a cafe called "Paris"
in Lyon cannot win "Paris, France" from the nearby pass.
Tests: region queries without a camera bias, whole-word and every-word
region matching, city and county regions, the nearby whole-name answer when
the unbiased request fails, and the settlement preference. The new tests sit
with the other Paris, Texas tests. The station fixture uses its real city.
CURRENT-STATE now describes the order the code applies.
A Retry-After longer than the 10 s retry budget used to sleep the whole
budget out and then give up, so the proxy's 429 pause started 10 s late
and every new-point poll in that window still went upstream and logged.
The retry loop now stops at once in that case.
Tests: the retry loop no longer sleeps for an unreachable Retry-After;
fully cached points, including stale ones, are served during the pause
with no upstream call; a 503 does not pause; a shorter concurrent
Retry-After never cuts the pause short. CURRENT-STATE now says which
requests are still served and which log.
Correct 年曆史 → 年歷史, 下遊 → 下游, 並道 → 併道 and 發佈 → 發布,
and list these fixes for future reconversions from zh-CN.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rebuild the zh-Hant catalog from zh-CN with OpenCC s2tw glyph
conversion, so wording and terminology match zh-CN and only the
script differs. Drop Taiwan-specific vocabulary and wording notes;
zh-TW/HK/MO browser tags still select zh-Hant.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The Street Level viewer caption rounded the photo's bearing without
wrapping, so a view facing 359.5° or more read "360°". The rounded
bearing now wraps to 0°.
