routine 2026-10-08: ship #15, Nuxt 4.6.0, shell-quote advisory, Node 24 CI actions

[physics515]

Run started 09:13 CDT 2026-10-08. This was a rerun ("try again"). The previous run's lock was stale, and its PR #15 was green and clean but had never been merged, released or deployed.

0. Shipped the previous run's work (#15)

• Merged routine 2026-10-05 (2): README rendering can't stall the server, copy buttons that speak and fail loudly, client-bundle audit, header hardening, 404s that say who asked #15 (squash, 40c9ca4). CI was green: build, onion gateway, image builds.
• Verified merged main before deploying:
  • Typecheck clean, 236 tests, build green.
  • Real server: /healthz, /, /projects 200. All 8 /projects/<slug> 301. Every /about and /blog 200.
  • /projects/no-such-project, /no-such-page, /api/projects/nope 404. Every onion-marked /admin probe 404. /onion-frame 503 (no gateway locally).
  • Headless screenshots: home, Skidbladnir, Nisaba at 1280 and 390 px. I looked at them: no overflow, flat background intact.
• Released nightly-2026-10-05-2 (prerelease).
• Deployed: the prior image is kept as basicautomation-site:previous. The container reported healthy.
• Live gate:
  • https://basicautomation.io/ 200, title basic automation — software for the productive.
  • /projects/skidbladnir/about 200. /healthz 200: 16 live resolutions, 0 snapshot.
  • The new cross-origin-opener-policy: same-origin header is live, and x-powered-by is gone.
• Live logs since the deploy: no warn or error lines.

1. Nuxt 4.6.0 — feat(deps) (9f8596c)

Roadmap: "Move to Nuxt 4.6 once it has had a few days" → [x].

Files: package.json, package-lock.json, ROADMAP.md.

It has now had 2½ days in the wild, which meets the soak condition. There is no 4.6.1 yet. I read the open 4.6.0 regressions: config.cjs missing from the tarball for require (#36514), page-transition and scroll-reset edge cases, and nuxt/server typing. None of them touch what this site uses. The security fixes (internal error route, error data, error-render recursion) are the reason to take it.

Checks:

• Typecheck clean, 236 tests, build green.
• audit:runtime: 79 packages, clean.
• check: 19 pages, 74 URLs, no problems. Its one warning is the known upstream onyums anchor.
• a11y: 21 pages, clean.
• a11y:browser: 21 pages at 1280 and 390 px, no violations and no console errors.
• Real server: all 42 routes in verify.sh answer exactly as on 4.5.2, and every page body is the same size.
• /__nuxt_error?... probes answer 404 on 4.6 and on the live 4.5.2.
• The image builds; the runtime is node 24.21.0.
• Headless screenshots of home, Skidbladnir and Nisaba at desktop and mobile. I looked at them and they are intact.

2. shell-quote 1.12.0 — fix(deps) (de23e0c)

Files: package-lock.json, ROADMAP.md (the devtools upstream item).

npm audit flagged shell-quote 1.10.0 as critical (GHSA-pqg4-j6r4-53mv). Only devtools' launch-editor pulls it in, and devtools is disabled and never ships. 1.12.0 is in range, so this is a lockfile-only patch.

braces and node-forge have no patched release at all. Both are build or dev-server only, and the roadmap now records them.

Checks: typecheck, build and audit:runtime clean; all routes answer as before.

3. CI actions off the Node 20 runtime — ci (latest commit)

Files: .github/workflows/{ci,release,links}.yml, ROADMAP.md (a Phase 3 [x]).

The first CI run of this PR annotated every job with GitHub's Node 20 deprecation. I moved each action to its first Node 24 major:

• checkout v5, setup-node v5
• build-push-action v7, setup-buildx-action v4
• login-action v4, metadata-action v6

I read each major's release notes. The breaking changes are the runtime, inputs this repo never set, and setup-node's automatic cache, which only applies with a packageManager field that package.json lacks.

Checks:

• CI run 37793683219 is green on all three jobs (build, onion gateway, image builds), and the Node 20 annotation is gone.
• release.yml (login and metadata) first runs on this run's release; see the deploy section of this PR's merge.
• links.yml uses only checkout and setup-node, the same pair ci.yml just proved.

Snapshot

npm run sync: crate download counts moved (66ee3fa).

Research

• vue-router 5.4.0 (2026-10-07) is a direct dependency. It changes client-side defaults: hashes and the top of the page are restored by default, and obsolete scroll positions are invalidated. I held it back for the same soak reason as Nuxt, and added a [ ] saying to land it with a browser check. https://github.com/vuejs/router/releases/tag/v5.4.0
• Nuxt 4.6.0 open regressions, read for routine: 16 increments — Phase 2 complete, release strips, social cards, operations, and the onion gateway's first slice #1: 4.6.0: published package.json exports "require": "./config.cjs" but config.cjs is not in the tarball nuxt/nuxt#36514
• GitHub: Node 20 actions are deprecated and forced to Node 24 (acted on, routine: 4 increments — token-speed refresh, shell-free image, gateway SIGTERM fix, onion reachability in /healthz #3): https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
• ubuntu-latest moves to Ubuntu 26 from 2026-10-19 (CI annotation). Nothing here pins Ubuntu 24 specifics. Watch the first run after that date; no task was filed. [Ubuntu] ubuntu-latest label will use Ubuntu 26.04 in November 2026 actions/runner-images#14748
• No new signal from Tailwind (still 4.3.3), Nitro 3 (beta), marked (18.1.0, already landed) or Vue (3.6 still RC).

Done vs open

• Three increments landed, plus the shipping of routine 2026-10-05 (2): README rendering can't stall the server, copy buttons that speak and fail loudly, client-bundle audit, header hardening, 404s that say who asked #15 and the snapshot refresh. One [ ] was added (vue-router 5.4).
• Still owner-gated: the site token, distroless/healthcheck, Onion-Location, HSTS, basic-automation.github.io, and contrast.
• Blocked: Nisaba and Enlil screenshots.
• Upstream: the Skidbladnir x265 link, the onyums anchor, devtools/simple-git and TypeScript 7.1. The two README fixes live in other repos, which this routine has no authority to push to.

STOP REASON: no workable next item, about 30 min into the run (09:13 → 09:40 CDT), far short of the 4 h bar. Every remaining [ ] is owner-gated, blocked, upstream or deliberately soaking (vue-router 5.4, one day old). The Skidbladnir screenshot is current (shot:check ✓). I didn't make up work to fill the clock.

Recommended next step

1. Land vue-router 5.4 once it has a few days, with a browser pass over README anchors and back/forward.
2. Owner: decide one of the gated items. Each of them would unblock real work for this routine.
3. Owner: push the two one-line README fixes (Skidbladnir's x265 link, onyums' anchor) in their own repos.

🤖 Generated with Claude Code