fix: build ARM64 upgrade bundles on native runners (#3110)

* build: unify container Node 24 and drop Debian armv7

* fix: use s390x-capable Python bases for Debian Node stages

* build: install Debian Node archives on build platform

back/shared/runtimeBuild.ts

@@ -28,7 +28,7 @@ const backend = read(path.resolve(__dirname, '../app.js'));
 const root = process.env.QL_DIR || path.resolve(__dirname, '../../..');
 const version = read(path.join(root, 'version.yaml'))
   ?.toString()
-  .match(/^\uFEFF?version:\s*["']?(\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?)/m)?.[1];
+  .match(/^\uFEFF?version:\s*["']?(\d+\.\d+\.\d+)/m)?.[1];
 
 export const runtimeBuild = Object.freeze({
   instanceId: randomUUID(),

cli/src/internal/maintenance/panelUpgrade.cjs

@@ -61,9 +61,7 @@ async function withPanelLifecycle(root, tmp, env, operation, signal) {
 
 async function targetVersion(source) {
   const text = await fs.readFile(path.join(source, 'version.yaml'), 'utf8');
-  const version = text.match(
-    /^\uFEFF?version:\s*["']?(\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?)/m,
-  )?.[1];
+  const version = text.match(/^\uFEFF?version:\s*["']?(\d+\.\d+\.\d+)/m)?.[1];
   if (!version) throw new Error('Invalid update version');
   return version;
 }

cli/src/internal/maintenance/upgradePrestart.cjs

@@ -92,9 +92,7 @@ async function prestartBackend(
       .digest('hex');
     const version = (
       await fs.readFile(path.join(selected.source, 'version.yaml'), 'utf8')
-    ).match(
-      /^\uFEFF?version:\s*["']?(\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?)/m,
-    )?.[1];
+    ).match(/^\uFEFF?version:\s*["']?(\d+\.\d+\.\d+)/m)?.[1];
     // An allowlist prevents NODE_OPTIONS, startup hooks, real data paths and
     // package-manager settings from escaping into the disposable backend.
     const env = {

docs/development/platform-upgrade-bundles.md

@@ -14,7 +14,7 @@ CI 从同次构建的不可变镜像摘要导出完整 tar.gz，包含源码中
 gh workflow run build-docker-image.yml --ref develop
 ```
 
-开发包更新共用的 `upgrade-develop/latest.json`。`develop` 和 `debian-dev` 镜像都使用该索引，按实际 Node 架构和 musl/glibc 选择包，无需设置测试专用下载源。开发批次位于 `upgrade-build-develop-<run-id>-<run-attempt>`，tag 不带版本号；索引中仍保留开发版本供客户端判断更新。开发批次不会改写正式版本或 `upgrade-master`。同一开发渠道的镜像构建和包发布串行执行，与 master 独立。
+开发包更新共用的 `upgrade-develop/latest.json`。`develop` 和 `debian-dev` 镜像都使用该索引，按实际 Node 架构和 musl/glibc 选择包，无需设置测试专用下载源。开发批次位于 `upgrade-build-develop-v<version>-<run-id>-<run-attempt>`，不会改写正式版本或 `upgrade-master`。同一开发渠道的镜像构建和包发布串行执行，与 master 独立。
 
 开发包只保留最新一个已验证批次：所有平台资产和渠道索引的大小、SHA256 校验成功后，删除其他名称匹配的开发构建 prerelease；不删除正式包、渠道索引或无法分类的旧 release。构建或上传失败不会删除上一套可用包。旧批次被删除后，已选中旧索引但尚未下载完的客户端可能需要重新发起下载；准备失败仍保留旧服务和数据。
 

docs/releases/2.24.0-dev.0.md

@@ -1,11 +0,0 @@
-# 青龙 2.24.0-dev.0 开发候选
-
-这是 `develop` 渠道的开发构建，上一正式版本为 2.23.0。此版本尚未正式发布。
-
-## 本轮变化
-
-- Alpine 与 Debian 镜像统一使用 Node.js 24；SQLite 依赖升级至 1.1.4。
-- Alpine 镜像保留 arm/v6 和 arm/v7，Debian 镜像暂不提供 arm/v7。
-- ARM64 升级包改用原生 runner 构建，避免在 x64 QEMU 下归档时发生异常。
-
-升级前请备份完整持久化数据，并在目标设备验证脚本、依赖和通知。正式发布说明将在候选验收后整理。

package.json

@@ -1,7 +1,7 @@
 {
   "name": "@whyour/qinglong",
   "packageManager": "pnpm@8.3.1",
-  "version": "2.24.0-dev.0",
+  "version": "2.23.0",
   "description": "Timed task management platform supporting Python3, JavaScript, Shell, Typescript",
   "repository": {
     "type": "git",

scripts/publish-upgrade-bundles.cjs

@@ -75,9 +75,9 @@ function publishBundles({
   // unchanged. Only the version/channel pointer is overwritten, never bytes
   // that an in-flight download has already selected by hash.
   const development = branch === 'develop';
-  const tag = development
-    ? `upgrade-build-develop-${buildId}`
-    : `upgrade-build-v${version}-${buildId}`;
+  const tag = `upgrade-build-${
+    development ? 'develop-' : ''
+  }v${version}-${buildId}`;
   const index = {
     ...releaseIndex(directory, commit, repository, {
       version,
@@ -113,7 +113,7 @@ function publishBundles({
     }
   };
   const notes =
-    `${development ? 'Development' : 'Verified'} platform bundles for v${version}, source ${commit}, build ${buildId}. Existing Node runtime is retained.\n\n` +
+    `Verified platform bundles for v${version}, source ${commit}, build ${buildId}. Existing Node runtime is retained.\n\n` +
     Object.entries(index.packages)
       .map(([target, entry]) => `- [${target}](${entry.url})`)
       .join('\n') +
@@ -147,12 +147,7 @@ function publishBundles({
     console.log('Newer source exists; leaving version and channel unchanged');
     return false;
   }
-  ensureRelease(
-    tag,
-    development
-      ? `Development platform upgrade (${buildId})`
-      : `Platform upgrade v${version} (${buildId})`,
-  );
+  ensureRelease(tag, `Platform upgrade v${version} (${buildId})`);
   const assets = platforms
     .flatMap((target) => {
       const archive = path.join(
@@ -245,7 +240,7 @@ function publishBundles({
     for (const release of pages.flat()) {
       if (
         release.tag_name !== tag &&
-        /^upgrade-build-develop-(?:v\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?-)?\d+-\d+$/.test(
+        /^upgrade-build-develop-v\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?-\d+-\d+$/.test(
           release.tag_name,
         ) &&
         release.prerelease === true &&

test/back/panel-upgrade.test.cjs

@@ -19,7 +19,7 @@ const {
   sourceCommit,
 } = require('../helpers/upgrade-fixture.cjs');
 
-async function fixture(t, targetVersion = '2.24.0') {
+async function fixture(t) {
   const base = await fs.mkdtemp(path.join(os.tmpdir(), 'ql-panel-job-'));
   const root = path.join(base, 'panel'),
     tmp = path.join(root, '.tmp');
@@ -30,10 +30,7 @@ async function fixture(t, targetVersion = '2.24.0') {
     await fs.writeFile(name, contents);
   };
   for (const dir of [root, source]) {
-    await write(
-      path.join(dir, 'package.json'),
-      JSON.stringify({ version: targetVersion }),
-    );
+    await write(path.join(dir, 'package.json'), '{"version":"2.24.0"}');
     await write(path.join(dir, 'pnpm-lock.yaml'), 'lock');
     await write(path.join(dir, 'sample/config.sample.sh'), '# config');
   }
@@ -42,7 +39,7 @@ async function fixture(t, targetVersion = '2.24.0') {
     'installed dependency',
   );
   await write(path.join(root, 'version.yaml'), 'version: 2.23.0');
-  await write(path.join(source, 'version.yaml'), `version: ${targetVersion}`);
+  await write(path.join(source, 'version.yaml'), 'version: 2.24.0');
   await write(path.join(staticRoot, 'build/app.js'), 'new backend');
   writeManifest(source, staticRoot);
   for (const repo of ['qinglong', 'qinglong-static'])
@@ -84,7 +81,7 @@ fs.writeFileSync(args[args.indexOf('--output') + 1], buffer);
   );
   await fs.chmod(path.join(base, 'bin/curl'), 0o700);
   const runtime = {
-    version: targetVersion,
+    version: '2.24.0',
     sourceCommit,
     instanceId: 'after-restart',
     parentPid: 100002,
@@ -189,21 +186,6 @@ test('detached download survives its initiating request and is idempotent; apply
   );
 });
 
-test('prerelease version is retained through download and restart verification', async (t) => {
-  const f = await fixture(t, '2.24.0-dev.0');
-  await startJob(f, 'download');
-  const ready = await finished(f.tmp);
-  assert.equal(ready.status, 'ready', ready.log);
-  assert.equal(ready.version, '2.24.0-dev.0');
-  await startJob(f, 'apply');
-  const complete = await finished(f.tmp);
-  assert.equal(complete.status, 'completed', complete.log);
-  assert.equal(
-    await fs.readFile(path.join(f.root, 'version.yaml'), 'utf8'),
-    'version: 2.24.0-dev.0',
-  );
-});
-
 test('invalid staged payload fails asynchronously before stopping the panel', async (t) => {
   const f = await fixture(t);
   await startJob(f, 'download');

test/back/publish-upgrade-bundles.test.cjs

@@ -337,23 +337,20 @@ test('existing master clients can migrate from indexes without version/build met
   assert.equal(f.index().buildId, '100-2');
 });
 
-test('automatic development publication keeps its prerelease version separate from production assets', (t) => {
+test('automatic development publication shares musl/glibc packages without changing version or latest production assets', (t) => {
   const f = fixture(t);
   f.publish();
   const production = f.index();
-  const developmentVersion = '2.24.0-dev.0';
-  f.write(f.state.developHead, 'development', developmentVersion);
+  f.write(f.state.developHead, 'development');
   assert.equal(
     f.publish({
       branch: 'develop',
       commit: f.state.developHead,
-      version: developmentVersion,
     }),
     true,
   );
   const development = f.index('upgrade-develop');
   assert.equal(development.channel, 'develop');
-  assert.equal(development.version, developmentVersion);
   assert.equal(development.sourceCommit, f.state.developHead);
   assert.equal(Object.keys(development.packages).length, 11);
   assert.ok(development.packages['linux-x64-musl']);
@@ -366,22 +363,12 @@ test('automatic development publication keeps its prerelease version separate fr
     ...Object.values(development.packages),
     development.installer,
   ])
-    assert.ok(entry.url.includes('/upgrade-build-develop-100-1/'));
-  assert.ok(
-    f.state.calls.some(
-      (args) =>
-        args[0] === 'release' &&
-        args[1] === 'create' &&
-        args[2] === 'upgrade-build-develop-100-1' &&
-        args[args.indexOf('--title') + 1] ===
-          'Development platform upgrade (100-1)',
-    ),
-  );
+    assert.ok(entry.url.includes('/upgrade-build-develop-v2.24.0-100-1/'));
   assert.deepEqual(f.index(), production);
   assert.deepEqual(f.index('upgrade-v2.24.0'), production);
   assert.equal(f.state.releases.get('upgrade-build-v2.24.0-100-1').size, 24);
   assert.equal(
-    f.state.releases.get('upgrade-build-develop-100-1').size,
+    f.state.releases.get('upgrade-build-develop-v2.24.0-100-1').size,
     24,
   );
 });
@@ -433,16 +420,14 @@ for (const fault of [
     const options = { branch: 'develop', commit: f.state.developHead };
     f.write(options.commit, 'development');
     f.publish(options);
-    const oldTag = 'upgrade-build-develop-100-1';
-    const legacyTag = 'upgrade-build-develop-v2.24.0-99-1';
-    f.state.releases.set(legacyTag, new Map());
+    const oldTag = 'upgrade-build-develop-v2.24.0-100-1';
     // Never prune production, channel aliases, legacy/unclassified releases,
     // drafts or a non-prerelease even when its name resembles a dev build.
     const protectedTags = [
       'upgrade-86c37f426a5ba9945d6af1910a7885a26f77e4bc',
       'v2.24.0',
-      'upgrade-build-develop-10-1',
-      'upgrade-build-develop-11-1',
+      'upgrade-build-develop-v2.24.0-10-1',
+      'upgrade-build-develop-v2.24.0-11-1',
     ];
     for (const tag of protectedTags) f.state.releases.set(tag, new Map());
     f.state.releaseMetadata = {
@@ -474,10 +459,9 @@ for (const fault of [
               a[0] === 'api' && a[1].includes('/releases/tags/upgrade-develop'),
           ),
       );
-      assert.ok(f.state.releases.has('upgrade-build-develop-101-1'));
+      assert.ok(f.state.releases.has('upgrade-build-develop-v2.24.0-101-1'));
     }
     assert.equal(f.state.releases.has(oldTag), Boolean(fault));
-    assert.equal(f.state.releases.has(legacyTag), Boolean(fault));
     for (const tag of protectedTags) assert.ok(f.state.releases.has(tag));
     assert.deepEqual(f.index(), production);
     assert.deepEqual(f.index('upgrade-v2.24.0'), production);
@@ -494,11 +478,11 @@ test('failed development cleanup is retryable without overwriting immutable asse
     /Delete unavailable/,
   );
   assert.equal(f.index('upgrade-develop').buildId, '101-1');
-  assert.ok(f.state.releases.has('upgrade-build-develop-100-1'));
+  assert.ok(f.state.releases.has('upgrade-build-develop-v2.24.0-100-1'));
   f.state.failDelete = false;
   f.publish({ ...options, buildId: '101-1' });
-  assert.ok(!f.state.releases.has('upgrade-build-develop-100-1'));
-  assert.ok(f.state.releases.has('upgrade-build-develop-101-1'));
+  assert.ok(!f.state.releases.has('upgrade-build-develop-v2.24.0-100-1'));
+  assert.ok(f.state.releases.has('upgrade-build-develop-v2.24.0-101-1'));
 });
 
 test('a newer development commit during upload preserves the published channel and its old package', (t) => {
@@ -510,7 +494,7 @@ test('a newer development commit during upload preserves the published channel a
   f.state.changeDevelopHeadAfterUpload = true;
   assert.equal(f.publish({ ...options, buildId: '101-1' }), false);
   assert.deepEqual(f.index('upgrade-develop'), before);
-  assert.ok(f.state.releases.has('upgrade-build-develop-100-1'));
+  assert.ok(f.state.releases.has('upgrade-build-develop-v2.24.0-100-1'));
   assert.ok(
     !f.state.calls.some((a) => a[0] === 'release' && a[1] === 'delete'),
   );

test/back/runtime-build.test.cjs

@@ -32,7 +32,7 @@ test('a running process retains its own build identity when installed files chan
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ql-runtime-build-'));
   t.after(() => fs.rmSync(root, { recursive: true, force: true }));
   fs.mkdirSync(path.join(root, 'static/build'), { recursive: true });
-  fs.writeFileSync(path.join(root, 'version.yaml'), 'version: 2.24.0-dev.0');
+  fs.writeFileSync(path.join(root, 'version.yaml'), 'version: 2.24.0');
   fs.writeFileSync(path.join(root, 'static/build/app.js'), 'old backend');
   fs.writeFileSync(
     path.join(root, 'static/build-info.json'),
@@ -45,7 +45,7 @@ test('a running process retains its own build identity when installed files chan
     JSON.stringify({ sourceCommit: 'b'.repeat(40) }),
   );
   fs.writeFileSync(path.join(root, 'version.yaml'), 'version: 2.25.0');
-  assert.equal(running.version, '2.24.0-dev.0');
+  assert.equal(running.version, '2.24.0');
   assert.equal(running.sourceCommit, 'a'.repeat(40));
   assert.equal(
     running.backendSha256,

test/back/upgrade-prestart.test.cjs

@@ -10,12 +10,8 @@ const {
   repairDependencies,
 } = require('../../cli/src/internal/maintenance/upgradePrestart.cjs');
 
-for (const [version, exitCode] of [
-  ['2.23.0', 0],
-  ['2.23.0', 1],
-  ['2.24.0-dev.0', 0],
-])
-  test(`prestart ${version} exit ${exitCode} reaps children retaining output pipes before removing its workspace`, async (t) => {
+for (const exitCode of [0, 1])
+  test(`prestart exit ${exitCode} reaps children retaining output pipes before removing its workspace`, async (t) => {
     const root = await fs.mkdtemp(path.join(os.tmpdir(), 'ql-probe-exit-'));
     t.after(() => fs.rm(root, { recursive: true, force: true }));
     const source = path.join(root, 'source'),
@@ -23,7 +19,7 @@ for (const [version, exitCode] of [
       survivor = path.join(root, 'survivor');
     await fs.mkdir(path.join(source, 'node_modules'), { recursive: true });
     await fs.mkdir(path.join(statics, 'build/bootstrap'), { recursive: true });
-    await fs.writeFile(path.join(source, 'version.yaml'), `version: ${version}`);
+    await fs.writeFile(path.join(source, 'version.yaml'), 'version: 2.23.0');
     await fs.writeFile(path.join(statics, 'build/app.js'), 'backend');
     await fs.writeFile(
       path.join(statics, 'build-info.json'),
@@ -40,7 +36,7 @@ for (const [version, exitCode] of [
       )}],{stdio:'inherit'});
       process.send({type:'upgrade-probe',ok:${
         exitCode === 0
-      },message:'simulated prestart failure',build:{sourceCommit:'a'.repeat(40),version:${JSON.stringify(version)},backendSha256:crypto.createHash('sha256').update('backend').digest('hex')}},()=>process.exit(${exitCode}));
+      },message:'simulated prestart failure',build:{sourceCommit:'a'.repeat(40),version:'2.23.0',backendSha256:crypto.createHash('sha256').update('backend').digest('hex')}},()=>process.exit(${exitCode}));
     `,
     );
     const operation = prestartBackend(

version.yaml

@@ -1,9 +1,15 @@
-version: 2.24.0-dev.0
-changeLogLink: https://github.com/whyour/qinglong/blob/develop/docs/releases/2.24.0-dev.0.md
-publishTime: "2026-10-25 19:22:54"
+version: 2.23.0
+changeLogLink: https://github.com/whyour/qinglong/blob/master/docs/releases/2.23.0.md
+publishTime: "2026-10-11 12:27:02"
 changeLog: |
-  1. 开发候选 2.24.0-dev.0，尚未正式发布；以 2.23.0 为上一正式版本
-  2. Alpine 与 Debian 镜像统一使用 Node.js 24，升级 sqlite3 至 1.1.4
-  3. Alpine 保留 arm/v6 和 arm/v7；Debian 暂不提供 arm/v7 镜像
-  4. ARM64 升级包在原生 runner 构建，避免 x64 QEMU 下的归档异常
-  5. 升级前备份完整数据，并在目标设备验证脚本、依赖和通知
+  1. 新增脚本历史版本查看、对比与恢复，支持 CLI 和 OpenAPI；恢复前检查当前内容哈希，避免覆盖并发修改
+  2. 普通任务与订阅调度迁移到 node-cron，保留旧规则兼容及日期/星期 OR 语义，补充宏和夏令时说明
+  3. 修复已失效排队任务仍被执行的问题，完善任务进程超时、停止和 Shell 环境传递
+  4. 修复系统令牌主动续期与认证缓存并发更新；Shell API 遇到 401 时刷新令牌并重试一次
+  5. 降低任务启动开销，JS/Python 通知依赖改为首次调用时加载
+  6. 加固环境变量、订阅参数、文件访问和 SSH 配置输入，改善资源冲突与 CLI 错误反馈
+  7. 修复页面升级、ql update 与静态资源版本同步，完善离线备份和升级产物校验
+  8. 修复 Debian 依赖安装、通知与调度回归，补齐前端中英文翻译
+  9. 最小修补 HTTP 压缩、上传、gRPC、代理 IP、WebSocket 和 JSON 查询相关依赖漏洞
+  10. 远程 CLI 更新至 0.1.2，新增脚本历史命令，最低 Node.js 版本仍为 22.12
+  11. 本次为 Python 3.10 兼容镜像的最后一个版本，发布后停止维护；升级前备份完整数据并验证脚本、依赖和通知