feat: update Node.js to 24.13 (#7492)

.changeset/great-bags-kiss.md

@@ -0,0 +1,5 @@
+---
+'hive': major
+---
+
+Bump Node.js version to `v24.13.0`.

.github/workflows/release-alpha.yaml

@@ -13,6 +13,7 @@ jobs:
       npmTag: alpha
       buildScript: build:libraries
       packageManager: pnpm
+      nodeVersion: '24.13'
     secrets:
       githubToken: ${{ secrets.GITHUB_TOKEN }}
       npmToken: ${{ secrets.NPM_TOKEN }}
@@ -58,17 +59,11 @@ jobs:
           name: hive-cli-win-x64
           path: ./packages/libraries/cli/dist/*-win32-x64.tar.gz
 
-      - name: upload win x86
+      - name: upload linux arm64
         uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
         with:
-          name: hive-cli-win-x86
-          path: ./packages/libraries/cli/dist/*-win32-x86.tar.gz
-
-      - name: upload linux arm
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
-        with:
-          name: hive-cli-linux-arm
-          path: ./packages/libraries/cli/dist/*-linux-arm.tar.gz
+          name: hive-cli-linux-arm64
+          path: ./packages/libraries/cli/dist/*-linux-arm64.tar.gz
 
       - name: upload linux x64
         uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4

.node-version

@@ -1 +1 @@
-22.13
+24.13

cypress/e2e/laboratory-preflight.cy.ts

@@ -197,18 +197,6 @@ throw new TypeError('Test')`,
       'log: d5b51e79e4be0c4f4d6b9a14e16ca864de96afe68459e60a794e80393a4809e8',
     );
   });
-
-  it('scripts can not use `eval`', () => {
-    setEditorScript('eval()');
-    cy.dataCy('preflight-modal-submit').click();
-    cy.get('body').contains('Usage of dangerous statement like eval() or Function("").');
-  });
-
-  it('invalid code is rejected and can not be saved', () => {
-    setEditorScript('🐝');
-    cy.dataCy('preflight-modal-submit').click();
-    cy.get('body').contains("[1:1]: Illegal character '}");
-  });
 });
 
 describe('Execution', () => {

docker/cli.dockerfile

@@ -1,4 +1,4 @@
-FROM node:22.13.0-slim
+FROM node:24.13.0-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates git && rm -rf /var/lib/apt/lists/*
 

docker/migrations.dockerfile

@@ -1,4 +1,4 @@
-FROM node:22.13.0-slim
+FROM node:24.13.0-slim
 
 RUN apt-get update && apt-get install -y ca-certificates
 

docker/services.dockerfile

@@ -1,4 +1,4 @@
-FROM node:22.13.0-slim
+FROM node:24.13.0-slim
 
 RUN apt-get update && apt-get install -y wget ca-certificates && rm -rf /var/lib/apt/lists/*
 

integration-tests/docker-compose.integration.yaml

@@ -12,7 +12,7 @@ networks:
 
 services:
   local_cdn:
-    image: node:22.13.0-alpine3.20
+    image: node:24.13.0-alpine3.23
     working_dir: /app
     command: ['node', 'index.js']
     networks:
@@ -38,7 +38,7 @@ services:
       S3_BUCKET_NAME: artifacts
 
   local_broker:
-    image: node:22.13.0-alpine3.20
+    image: node:24.13.0-alpine3.23
     working_dir: /app
     command: ['node', 'broker.js']
     networks:
@@ -90,7 +90,7 @@ services:
       SECRET: '${EXTERNAL_COMPOSITION_SECRET}'
 
   external_composition:
-    image: node:22.13.0-alpine3.20
+    image: node:24.13.0-alpine3.23
     working_dir: /app
     command: ['node', 'example.mjs']
     networks:
@@ -289,10 +289,10 @@ services:
 
   # It's not part of integration tests
   app:
-    image: node:22.13.0-alpine3.20
+    image: node:24.13.0-alpine3.23
     command: ['npx', 'http-server']
 
   # Redpand is used for integration tests, instead of Kafka. Zookeeper is no longer needed
   zookeeper:
-    image: node:22.13.0-alpine3.20
+    image: node:24.13.0-alpine3.23
     command: ['npx', 'http-server']

package.json

@@ -14,7 +14,7 @@
   "private": true,
   "packageManager": "pnpm@10.18.3+sha512.bbd16e6d7286fd7e01f6b3c0b3c932cda2965c06a908328f74663f10a9aea51f1129eea615134bf992831b009eabe167ecb7008b597f40ff9bc75946aadfb08d",
   "engines": {
-    "node": ">=22.13",
+    "node": ">=24.13",
     "pnpm": ">=10.16.0"
   },
   "scripts": {

packages/libraries/cli/package.json

@@ -57,9 +57,9 @@
     "@graphql-tools/url-loader": "~8.0.0",
     "@graphql-tools/utils": "10.9.1",
     "@graphql-typed-document-node/core": "3.2.0",
-    "@oclif/core": "^3.26.6",
-    "@oclif/plugin-help": "6.0.22",
-    "@oclif/plugin-update": "4.2.13",
+    "@oclif/core": "3.26.6",
+    "@oclif/plugin-help": "6.2.36",
+    "@oclif/plugin-update": "4.7.16",
     "@theguild/federation-composition": "0.21.2",
     "cli-table3": "0.6.5",
     "colors": "1.4.0",
@@ -72,7 +72,7 @@
   "devDependencies": {
     "@types/env-ci": "3.1.4",
     "graphql": "16.9.0",
-    "oclif": "4.13.6",
+    "oclif": "4.22.65",
     "rimraf": "4.4.1",
     "tsx": "4.19.2",
     "typescript": "5.7.3"

packages/services/api/package.json

@@ -27,8 +27,6 @@
     "@hive/usage-common": "workspace:*",
     "@hive/usage-ingestor": "workspace:*",
     "@hive/workflows": "workspace:*",
-    "@nodesecure/i18n": "^4.0.1",
-    "@nodesecure/js-x-ray": "8.0.0",
     "@octokit/app": "15.1.4",
     "@octokit/core": "6.1.4",
     "@octokit/plugin-retry": "7.1.4",

packages/services/api/src/modules/lab/providers/preflight-script.provider.ts

@@ -1,8 +1,6 @@
 import { Inject, Injectable, Scope } from 'graphql-modules';
 import { sql, type DatabasePool } from 'slonik';
 import { z } from 'zod';
-import { getLocalLang, getTokenSync } from '@nodesecure/i18n';
-import * as jsxray from '@nodesecure/js-x-ray';
 import type { Target } from '../../../shared/entities';
 import { AuditLogRecorder } from '../../audit-logs/providers/audit-log-recorder';
 import { Session } from '../../auth/lib/authz';
@@ -15,20 +13,7 @@ const SourceCodeModel = z.string().max(5_000);
 
 const UpdatePreflightScriptModel = z.strictObject({
   // Use validation only on insertion
-  sourceCode: SourceCodeModel.superRefine((val, ctx) => {
-    try {
-      const { warnings } = scanner.analyse(val);
-      for (const warning of warnings) {
-        const message = getTokenSync(jsxray.warnings[warning.kind].i18n);
-        throw new Error(message);
-      }
-    } catch (error) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: error instanceof Error ? error.message : String(error),
-      });
-    }
-  }),
+  sourceCode: SourceCodeModel,
 });
 
 const PreflightScriptModel = z.strictObject({
@@ -42,9 +27,6 @@ const PreflightScriptModel = z.strictObject({
 
 type PreflightScript = z.TypeOf<typeof PreflightScriptModel>;
 
-const scanner = new jsxray.AstAnalyser();
-await getLocalLang();
-
 @Injectable({
   global: true,
   scope: Scope.Operation,
@@ -142,7 +124,7 @@ export class PreflightScriptProvider {
         , ${targetId}
         , ${currentUser.id}
       )
-      ON CONFLICT ("target_id") 
+      ON CONFLICT ("target_id")
       DO UPDATE
         SET
           "source_code" = EXCLUDED."source_code"

packages/web/docs/public/install.ps1

@@ -1,5 +1,12 @@
 #!/usr/bin/env pwsh
 
+# Check for x86 architecture and exit if found
+if (![Environment]::Is64BitOperatingSystem) {
+  Write-Host "Unsupported architecture: x86" -ForegroundColor Red
+  Write-Host "GraphQL Hive CLI is only available for x64 systems." -ForegroundColor Red
+  exit 1
+}
+
 $version = if (Test-Path env:HIVE_CLI_VERSION) {
   $Env:HIVE_CLI_VERSION
 } else {
@@ -29,12 +36,7 @@ function ComputeDownloadLink() {
     "https://cli.graphql-hive.com/versions/$version/hive-v$version-win32"
   }
 
-  # Detect if the system is x86 or x64
-  $arch = if ([Environment]::Is64BitOperatingSystem) {
-    "x64"
-  } else {
-    "x86"
-  }
+  $arch = "x64"
 
   # append the arch to the url
   return "$base_url-$arch.tar.gz"
@@ -90,7 +92,7 @@ if (![System.IO.Directory]::Exists($hivePath)) {[void][System.IO.Directory]::Cre
 cd $hivePath
 Write-Output "Extracting hive to $hivePath..."
 $argumentList ="-xf $gunzippedfile"
-Start-Process -FilePath "tar.Exe" -NoNewWindow -Wait -RedirectStandardError "./NUL" -ArgumentList $argumentList 
+Start-Process -FilePath "tar.Exe" -NoNewWindow -Wait -RedirectStandardError "./NUL" -ArgumentList $argumentList
 
 # delete hive temp directory
 Remove-Item -LiteralPath $hiveTmpDir -Force -Recurse

packages/web/docs/public/install.sh

@@ -73,18 +73,10 @@
           ARCH=x64
         elif [ "\$ARCH" = "amd64" ]; then
           ARCH=x64
-        elif [ "\$ARCH" = "arm64" ]; then
-          if [ "\$OS" = "darwin" ]; then
-            ARCH=arm64
-          else
-            ARCH=arm
-          fi
-        elif starts_with "aarch" "\$ARCH"; then
-          if [ "\$ARCH" = "aarch64" ]; then
-            ARCH=arm64
-          else
-            ARCH=arm
-          fi
+        elif [ "\$OS" = "darwin" ]; then
+          ARCH=arm64
+        elif [ "\$ARCH" = "aarch64" ]; then
+          ARCH=arm64
         else
          unsupported_arch "\$OS / \$ARCH"
         fi

patches/oclif.patch

@@ -1,8 +1,8 @@
 diff --git a/lib/commands/pack/macos.js b/lib/commands/pack/macos.js
-index 2d571cac7e01f4e89bf516f44419439b6ab689a3..381b2287767a61e4fa09d8340e6eedefac078075 100644
+index 159823f3577fc8aa22bd314dc3b496852a2eaa43..fa51747214059cb1e37d256a449a759c719af76e 100644
 --- a/lib/commands/pack/macos.js
 +++ b/lib/commands/pack/macos.js
-@@ -202,7 +202,6 @@ the CLI should already exist in a directory named after the CLI that is the root
+@@ -219,7 +219,6 @@ the CLI should already exist in a directory named after the CLI that is the root
              const templateKey = (0, upload_util_1.templateShortKey)('macos', {
                  arch,
                  bin: config.bin,
@@ -11,10 +11,10 @@ index 2d571cac7e01f4e89bf516f44419439b6ab689a3..381b2287767a61e4fa09d8340e6eedef
              });
              const dist = buildConfig.dist(`macos/${templateKey}`);
 diff --git a/lib/commands/pack/win.js b/lib/commands/pack/win.js
-index ef7f90ef1cc4b166d3d1df74228e92b86ad9234e..2ed38f1971727530243b412d3af87fe337307c4d 100644
+index 9a255a011cbbfb34a337f67bcbabbbffdaf65c11..cdceb97f180710b1ff3f754ca8cd06357f233aff 100644
 --- a/lib/commands/pack/win.js
 +++ b/lib/commands/pack/win.js
-@@ -310,7 +310,6 @@ the CLI should already exist in a directory named after the CLI that is the root
+@@ -336,7 +336,6 @@ the CLI should already exist in a directory named after the CLI that is the root
              const templateKey = (0, upload_util_1.templateShortKey)('win32', {
                  arch,
                  bin: config.bin,
@@ -23,19 +23,19 @@ index ef7f90ef1cc4b166d3d1df74228e92b86ad9234e..2ed38f1971727530243b412d3af87fe3
              });
              const o = buildConfig.dist(`win32/${templateKey}`);
 diff --git a/lib/commands/promote.js b/lib/commands/promote.js
-index 0ea8c249f1b2fa889671c66b401862f24cf6680b..79ef2f2d2667fb8d376aada327e1e31193749209 100644
+index 680417fe220d77f81ae239130c4ba55602b09497..32dfc48f80c17479de36f56ca8acf228b26290e3 100644
 --- a/lib/commands/promote.js
 +++ b/lib/commands/promote.js
-@@ -66,7 +66,7 @@ class Promote extends core_1.Command {
+@@ -86,7 +86,7 @@ class Promote extends core_1.Command {
              CacheControl: indexDefaults.maxAge,
              MetadataDirective: client_s3_1.MetadataDirective.REPLACE,
          };
--        const cloudBucketCommitKey = (shortKey) => path.join(s3Config.bucket, (0, upload_util_1.commitAWSDir)(flags.version, flags.sha, s3Config), shortKey);
-+        const cloudBucketCommitKey = (shortKey) => path.join(s3Config.bucket, (0, upload_util_1.commitAWSDir)(flags.version, s3Config), shortKey);
-         const cloudChannelKey = (shortKey) => path.join((0, upload_util_1.channelAWSDir)(flags.channel, s3Config), shortKey);
+-        const cloudBucketCommitKey = (shortKey) => node_path_1.default.posix.join(s3Config.bucket, (0, upload_util_1.commitAWSDir)(flags.version, flags.sha, s3Config), shortKey);
++        const cloudBucketCommitKey = (shortKey) => node_path_1.default.posix.join(s3Config.bucket, (0, upload_util_1.commitAWSDir)(flags.version, s3Config), shortKey);
+         const cloudChannelKey = (shortKey) => node_path_1.default.posix.join((0, upload_util_1.channelAWSDir)(flags.channel, s3Config), shortKey);
          // copy tarballs manifests
-         if (buildConfig.targets.length > 0)
-@@ -76,11 +76,10 @@ class Promote extends core_1.Command {
+         const promoteManifest = async (target) => {
+@@ -94,7 +94,6 @@ class Promote extends core_1.Command {
                  arch: target.arch,
                  bin: config.bin,
                  platform: target.platform,
@@ -43,12 +43,7 @@ index 0ea8c249f1b2fa889671c66b401862f24cf6680b..79ef2f2d2667fb8d376aada327e1e311
                  version: flags.version,
              });
              // strip version & sha so update/scripts can point to a static channel manifest
--            const unversionedManifest = manifest.replace(`-v${flags.version}-${flags.sha}`, '');
-+            const unversionedManifest = manifest.replace(`-v${flags.version}`, '');
-             await aws_1.default.s3.copyObject({
-                 ...awsDefaults,
-                 CopySource: cloudBucketCommitKey(manifest),
-@@ -93,12 +92,11 @@ class Promote extends core_1.Command {
+@@ -115,12 +114,11 @@ class Promote extends core_1.Command {
                  bin: config.bin,
                  ext: '.tar.gz',
                  platform: target.platform,
@@ -62,7 +57,7 @@ index 0ea8c249f1b2fa889671c66b401862f24cf6680b..79ef2f2d2667fb8d376aada327e1e311
              const unversionedTarGzKey = cloudChannelKey(unversionedTarGzName);
              await Promise.all([
                  aws_1.default.s3.copyObject({
-@@ -117,12 +115,11 @@ class Promote extends core_1.Command {
+@@ -150,12 +148,11 @@ class Promote extends core_1.Command {
                  bin: config.bin,
                  ext: '.tar.xz',
                  platform: target.platform,
@@ -76,8 +71,8 @@ index 0ea8c249f1b2fa889671c66b401862f24cf6680b..79ef2f2d2667fb8d376aada327e1e311
              const unversionedTarXzKey = cloudChannelKey(unversionedTarXzName);
              await Promise.all([
                  aws_1.default.s3.copyObject({
-@@ -139,10 +136,10 @@ class Promote extends core_1.Command {
-             this.log(`Promoting macos pkgs to ${flags.channel}`);
+@@ -182,10 +179,10 @@ class Promote extends core_1.Command {
+         const promoteMacInstallers = async () => {
              const arches = (0, util_1.uniq)(buildConfig.targets.filter((t) => t.platform === 'darwin').map((t) => t.arch));
              await Promise.all(arches.map(async (arch) => {
 -                const darwinPkg = (0, upload_util_1.templateShortKey)('macos', { arch, bin: config.bin, sha: flags.sha, version: flags.version });
@@ -89,8 +84,8 @@ index 0ea8c249f1b2fa889671c66b401862f24cf6680b..79ef2f2d2667fb8d376aada327e1e311
                  await Promise.all([
                      aws_1.default.s3.copyObject({
                          ...awsDefaults,
-@@ -160,10 +157,10 @@ class Promote extends core_1.Command {
-             this.log(`Promoting windows exe to ${flags.channel}`);
+@@ -213,10 +210,10 @@ class Promote extends core_1.Command {
+             // copy win exe
              const arches = buildConfig.targets.filter((t) => t.platform === 'win32').map((t) => t.arch);
              await Promise.all(arches.map(async (arch) => {
 -                const winPkg = (0, upload_util_1.templateShortKey)('win32', { arch, bin: config.bin, sha: flags.sha, version: flags.version });
@@ -103,10 +98,10 @@ index 0ea8c249f1b2fa889671c66b401862f24cf6680b..79ef2f2d2667fb8d376aada327e1e311
                      aws_1.default.s3.copyObject({
                          ...awsDefaults,
 diff --git a/lib/commands/upload/deb.js b/lib/commands/upload/deb.js
-index b9aaf097275cc8caa13603d7bd09e41e9bea7dee..d375d11272bf8ff3e2a32fcbd5bb86ce548c40b4 100644
+index 0c5676ce2e1223b3a5985cefc916dc0e56a98713..019316c67a26f9ab1fa811972ef6d1a77a4173b5 100644
 --- a/lib/commands/upload/deb.js
 +++ b/lib/commands/upload/deb.js
-@@ -51,7 +51,7 @@ class UploadDeb extends core_1.Command {
+@@ -66,7 +66,7 @@ class UploadDeb extends core_1.Command {
              this.error('Cannot find debian artifacts', {
                  suggestions: ['Run "oclif pack deb" before uploading'],
              });
@@ -114,8 +109,8 @@ index b9aaf097275cc8caa13603d7bd09e41e9bea7dee..d375d11272bf8ff3e2a32fcbd5bb86ce
 +        const cloudKeyBase = (0, upload_util_1.commitAWSDir)(config.pjson.version, s3Config);
          const upload = (file) => {
              const cloudKey = `${cloudKeyBase}/apt/${file}`;
-             return aws_1.default.s3.uploadFile(dist(file), { ...S3Options, CacheControl: 'max-age=86400', Key: cloudKey });
-@@ -88,7 +88,7 @@ class UploadDeb extends core_1.Command {
+             return aws_1.default.s3.uploadFile(dist(file), { ...S3Options, CacheControl: 'max-age=86400', Key: cloudKey }, {
+@@ -107,7 +107,7 @@ class UploadDeb extends core_1.Command {
              ...(fs.existsSync(dist('InRelease')) ? [upload('InRelease'), uploadWorkaround('InRelease')] : []),
              ...(fs.existsSync(dist('Release.gpg')) ? [upload('Release.gpg'), uploadWorkaround('Release.gpg')] : []),
          ]);
@@ -125,10 +120,10 @@ index b9aaf097275cc8caa13603d7bd09e41e9bea7dee..d375d11272bf8ff3e2a32fcbd5bb86ce
  }
  exports.default = UploadDeb;
 diff --git a/lib/commands/upload/macos.js b/lib/commands/upload/macos.js
-index fb271df255f5df66401a7a172e7f49d23d3742e3..ff042ee310dd691625b7a95a7462ba0363576de4 100644
+index 2337c4e2f4783a51a508dc27cde056076a11d057..0dd351d3e27445ee9c4a964076a158c471efbd41 100644
 --- a/lib/commands/upload/macos.js
 +++ b/lib/commands/upload/macos.js
-@@ -50,12 +50,11 @@ class UploadMacos extends core_1.Command {
+@@ -65,12 +65,11 @@ class UploadMacos extends core_1.Command {
              ACL: s3Config.acl || 'public-read',
              Bucket: s3Config.bucket,
          };
@@ -142,7 +137,7 @@ index fb271df255f5df66401a7a172e7f49d23d3742e3..ff042ee310dd691625b7a95a7462ba03
                  version: config.version,
              });
              const cloudKey = `${cloudKeyBase}/${templateKey}`;
-@@ -69,7 +68,7 @@ class UploadMacos extends core_1.Command {
+@@ -86,7 +85,7 @@ class UploadMacos extends core_1.Command {
          };
          const arches = (0, util_1.uniq)(buildConfig.targets.filter((t) => t.platform === 'darwin').map((t) => t.arch));
          await Promise.all(arches.map((a) => upload(a)));
@@ -152,10 +147,10 @@ index fb271df255f5df66401a7a172e7f49d23d3742e3..ff042ee310dd691625b7a95a7462ba03
  }
  exports.default = UploadMacos;
 diff --git a/lib/commands/upload/tarballs.js b/lib/commands/upload/tarballs.js
-index dd732e93883a61dd491f797e2576eea432500b51..4e9f087de4e52c5777a80b42f5b45bfcde9a9bc7 100644
+index 1ee76bdc4297e515879ebe6489ad42af632bb6f4..bd3a6f426c8e75c25d7e7b9a295f98001f21fba6 100644
 --- a/lib/commands/upload/tarballs.js
 +++ b/lib/commands/upload/tarballs.js
-@@ -50,7 +50,6 @@ class UploadTarballs extends core_1.Command {
+@@ -67,7 +67,6 @@ class UploadTarballs extends core_1.Command {
              const tarball = dist((0, upload_util_1.templateShortKey)('versioned', {
                  bin: config.bin,
                  ext: '.tar.gz',
@@ -163,25 +158,16 @@ index dd732e93883a61dd491f797e2576eea432500b51..4e9f087de4e52c5777a80b42f5b45bfc
                  version: config.version,
                  ...target,
              }));
-@@ -75,7 +74,7 @@ class UploadTarballs extends core_1.Command {
+@@ -104,7 +103,7 @@ class UploadTarballs extends core_1.Command {
              };
-             const releaseTarballs = async (ext) => {
-                 const localKey = (0, upload_util_1.templateShortKey)('versioned', { ...shortKeyInputs, ext });
--                const cloudKey = `${(0, upload_util_1.commitAWSDir)(config.version, buildConfig.gitSha, s3Config)}/${localKey}`;
-+                const cloudKey = `${(0, upload_util_1.commitAWSDir)(config.version, s3Config)}/${localKey}`;
-                 await aws_1.default.s3.uploadFile(dist(localKey), {
-                     ...S3Options,
-                     CacheControl: 'max-age=604800',
-@@ -84,7 +83,7 @@ class UploadTarballs extends core_1.Command {
-                 });
-             };
-             const manifest = (0, upload_util_1.templateShortKey)('manifest', shortKeyInputs);
--            const cloudKey = `${(0, upload_util_1.commitAWSDir)(config.version, buildConfig.gitSha, s3Config)}/${manifest}`;
-+            const cloudKey = `${(0, upload_util_1.commitAWSDir)(config.version, s3Config)}/${manifest}`;
-             await Promise.all([
-                 releaseTarballs('.tar.gz'),
-                 aws_1.default.s3.uploadFile(dist(manifest), {
-@@ -99,7 +98,7 @@ class UploadTarballs extends core_1.Command {
+             const maybeUploadManifest = async () => {
+                 const manifest = (0, upload_util_1.templateShortKey)('manifest', shortKeyInputs);
+-                const cloudKey = `${(0, upload_util_1.commitAWSDir)(config.version, buildConfig.gitSha, s3Config)}/${manifest}`;
++                const cloudKey = `${(0, upload_util_1.commitAWSDir)(config.version, s3Config)}/${manifest}`;
+                 const local = dist(manifest);
+                 (0, log_1.log)(`checking for buildmanifest at ${local}`);
+                 if (fs.existsSync(local)) {
+@@ -129,7 +128,7 @@ class UploadTarballs extends core_1.Command {
          if (buildConfig.targets.length > 0)
              (0, log_1.log)('uploading targets');
          await Promise.all(buildConfig.targets.map((t) => uploadTarball(t)));
@@ -191,10 +177,10 @@ index dd732e93883a61dd491f797e2576eea432500b51..4e9f087de4e52c5777a80b42f5b45bfc
  }
  exports.default = UploadTarballs;
 diff --git a/lib/commands/upload/win.js b/lib/commands/upload/win.js
-index 2769337ddf0effe5f397300972b989db20616b4a..d725cd670207e4c8b125eef8d74d0a5d43672905 100644
+index 919ee7d6273abd8fde7cea281d7ee1ed43b98130..b8a38ae426406f27f28fa6fd8cb53647409c5432 100644
 --- a/lib/commands/upload/win.js
 +++ b/lib/commands/upload/win.js
-@@ -51,7 +51,6 @@ class UploadWin extends core_1.Command {
+@@ -66,7 +66,6 @@ class UploadWin extends core_1.Command {
              const templateKey = (0, upload_util_1.templateShortKey)('win32', {
                  arch,
                  bin: config.bin,
@@ -202,7 +188,7 @@ index 2769337ddf0effe5f397300972b989db20616b4a..d725cd670207e4c8b125eef8d74d0a5d
                  version: config.version,
              });
              const localKey = dist(`win32/${templateKey}`);
-@@ -60,12 +59,11 @@ class UploadWin extends core_1.Command {
+@@ -75,12 +74,11 @@ class UploadWin extends core_1.Command {
                      suggestions: ['Run "oclif pack win" before uploading'],
                  });
          }
@@ -216,20 +202,20 @@ index 2769337ddf0effe5f397300972b989db20616b4a..d725cd670207e4c8b125eef8d74d0a5d
                  version: config.version,
              });
              const localExe = dist(`win32/${templateKey}`);
-@@ -74,7 +72,7 @@ class UploadWin extends core_1.Command {
-                 await aws_1.default.s3.uploadFile(localExe, { ...S3Options, CacheControl: 'max-age=86400', Key: cloudKey });
+@@ -91,7 +89,7 @@ class UploadWin extends core_1.Command {
+                 });
          };
-         await Promise.all([uploadWin('x64'), uploadWin('x86')]);
+         await Promise.all([uploadWin('x64'), uploadWin('x86'), uploadWin('arm64')]);
 -        (0, log_1.log)(`done uploading windows executables for v${config.version}-${buildConfig.gitSha}`);
 +        (0, log_1.log)(`done uploading windows executables for v${config.version}`);
      }
  }
  exports.default = UploadWin;
 diff --git a/lib/tarballs/bin.js b/lib/tarballs/bin.js
-index 5740bb13522fdad4c65554534bfa286b6dd94f11..79c43972b86773c0d28d1e159d1c0d284a66f7ef 100644
+index 2f48647d6fb50f4720ad5a340775565334f8ca0d..29fa61af7474350ebfed9c7aff96866599708319 100644
 --- a/lib/tarballs/bin.js
 +++ b/lib/tarballs/bin.js
-@@ -30,77 +30,43 @@ const path = __importStar(require("node:path"));
+@@ -43,77 +43,43 @@ const node_path_1 = __importDefault(require("node:path"));
  const node_util_1 = require("node:util");
  const exec = (0, node_util_1.promisify)(node_child_process_1.exec);
  async function writeBinScripts({ baseWorkspace, config, nodeOptions, nodeVersion, }) {
@@ -237,7 +223,7 @@ index 5740bb13522fdad4c65554534bfa286b6dd94f11..79c43972b86773c0d28d1e159d1c0d28
 -    const redirectedEnvVar = config.scopedEnvVarKey('REDIRECTED');
 -    const clientHomeEnvVar = config.scopedEnvVarKey('OCLIF_CLIENT_HOME');
      const writeWin32 = async (bin) => {
-         await fs.promises.writeFile(path.join(baseWorkspace, 'bin', `${bin}.cmd`), `@echo off
+         await fs.promises.writeFile(node_path_1.default.join(baseWorkspace, 'bin', `${bin}.cmd`), `@echo off
  setlocal enableextensions
  
 -if not "%${redirectedEnvVar}%"=="1" if exist "%LOCALAPPDATA%\\${bin}\\client\\bin\\${bin}.cmd" (
@@ -255,11 +241,11 @@ index 5740bb13522fdad4c65554534bfa286b6dd94f11..79c43972b86773c0d28d1e159d1c0d28
 -) else (
 -  node ${`${nodeOptions.join(' ')} `}"%~dp0..\\bin\\run" %*
 -)
-+"%~dp0..\\bin\\node.exe" ${`${nodeOptions.join(' ')} `}"%~dp0..\\bin\\run" %*
++%~dp0..\\bin\\node.exe" ${`${nodeOptions.join(' ')} `}"%~dp0..\\bin\\run" %*
  `);
      };
      const writeUnix = async () => {
-         const bin = path.join(baseWorkspace, 'bin', config.bin);
+         const bin = node_path_1.default.join(baseWorkspace, 'bin', config.bin);
 -        await fs.promises.writeFile(bin, `#!/usr/bin/env bash
 +        await fs.promises.writeFile(bin, `#!/usr/bin/env sh
  set -e
@@ -309,6 +295,7 @@ index 5740bb13522fdad4c65554534bfa286b6dd94f11..79c43972b86773c0d28d1e159d1c0d28
 -    echoerr ${binPathEnvVar}="\$${binPathEnvVar}" "\$NODE" ${`${nodeOptions.join(' ')} `}"\$DIR/run" "\$@"
 -  fi
 -  "\$NODE" ${`${nodeOptions.join(' ')} `}"\$DIR/run" "\$@"
+-fi
 +NODE="\$DIR/node"
 +if [ "\$DEBUG" = "1" ]; then
 +  echo "--DEBUG--"
@@ -317,29 +304,31 @@ index 5740bb13522fdad4c65554534bfa286b6dd94f11..79c43972b86773c0d28d1e159d1c0d28
 +  echo "list of files:"
 +  ls \$DIR
 +  echo "--DEBUG--"
- fi
++ fi
 +"\$NODE" ${`${nodeOptions.join(' ')} `}"\$DIR/run" "\$@"
  `, { mode: 0o755 });
      };
      await Promise.all([
 diff --git a/lib/tarballs/build.js b/lib/tarballs/build.js
-index 81ad0929e112195135c32f4d757fb5f68126ba92..cdc8c2152b5ee061ec5830da1d8cb2283e0e778d 100644
+index cbae61146324ef6ac0935c625b7858007ac238d1..d300803c09c6abc48d7c8138e318dbb319768815 100644
 --- a/lib/tarballs/build.js
 +++ b/lib/tarballs/build.js
-@@ -174,8 +174,10 @@ const addDependencies = async (c) => {
+@@ -166,9 +166,11 @@ const addDependencies = async (c) => {
      else {
-         const lockpath = (0, node_fs_1.existsSync)(path.join(c.root, 'package-lock.json'))
-             ? path.join(c.root, 'package-lock.json')
--            : path.join(c.root, 'npm-shrinkwrap.json');
--        await (0, fs_extra_1.copy)(lockpath, path.join(c.workspace(), path.basename(lockpath)));
+         const lockpath = (0, node_fs_1.existsSync)(node_path_1.default.join(c.root, 'package-lock.json'))
+             ? node_path_1.default.join(c.root, 'package-lock.json')
+-            : node_path_1.default.join(c.root, 'npm-shrinkwrap.json');
+-        await (0, fs_extra_1.copy)(lockpath, node_path_1.default.join(c.workspace(), node_path_1.default.basename(lockpath)));
+-        await exec('npm install --production', { cwd: c.workspace() });
 +            : null;
 +        if (lockpath) {
 +            await (0, fs_extra_1.copy)(lockpath, path.join(c.workspace(), path.basename(lockpath)));
 +        }
-         await exec('npm install --production', { cwd: c.workspace() });
++      await exec('npm install --production', { cwd: c.workspace() });
      }
  };
-@@ -230,8 +232,8 @@ const buildTarget = async (target, c, options) => {
+ const packCLI = async (c) => {
+@@ -225,8 +227,8 @@ const buildTarget = async (target, c, options) => {
      if (!c.updateConfig.s3?.host)
          return;
      const rollout = typeof c.updateConfig.autoupdate === 'object' && c.updateConfig.autoupdate.rollout;
@@ -351,24 +340,24 @@ index 81ad0929e112195135c32f4d757fb5f68126ba92..cdc8c2152b5ee061ec5830da1d8cb228
          (0, util_1.hash)('sha256', c.dist(gzLocalKey)),
          ...(c.xz ? [(0, util_1.hash)('sha256', c.dist(xzLocalKey))] : []),
 diff --git a/lib/upload-util.js b/lib/upload-util.js
-index 19298c77a203e70f451d31c70c92442a8a3d5137..905230e5f605346ae6a65e617230ef84fce73c0b 100644
+index 1b51bf1167e316ff332550053ffcf248aa4d8b87..e139322410815c3b24214b7389818e880f3e77f0 100644
 --- a/lib/upload-util.js
 +++ b/lib/upload-util.js
-@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
- exports.debVersion = exports.debArch = exports.templateShortKey = exports.channelAWSDir = exports.commitAWSDir = void 0;
+@@ -10,11 +10,11 @@ exports.debArch = debArch;
+ exports.debVersion = debVersion;
  const ejs_1 = require("ejs");
- const node_path_1 = require("node:path");
+ const node_path_1 = __importDefault(require("node:path"));
 -function commitAWSDir(version, sha, s3Config) {
 +function commitAWSDir(version, s3Config) {
      let s3SubDir = s3Config.folder || '';
      if (s3SubDir !== '' && s3SubDir.slice(-1) !== '/')
          s3SubDir = `${s3SubDir}/`;
--    return (0, node_path_1.join)(s3SubDir, 'versions', version, sha);
-+    return (0, node_path_1.join)(s3SubDir, 'versions', version);
+-    return node_path_1.default.posix.join(s3SubDir, 'versions', version, sha);
++    return node_path_1.default.posix.join(s3SubDir, 'versions', version);
  }
- exports.commitAWSDir = commitAWSDir;
  function channelAWSDir(channel, s3Config) {
-@@ -26,11 +26,11 @@ function templateShortKey(type, options) {
+     let s3SubDir = s3Config.folder || '';
+@@ -31,11 +31,11 @@ function templateShortKey(type, options) {
      const templates = {
          baseDir: '<%- bin %>',
          deb: '<%- bin %>_<%- versionShaRevision %>_<%- arch %>.deb',