yahoojapan · ggtakec · Jul 3, 2026 · Jul 3, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -30,12 +30,18 @@ on:
     tags:
       - '*'
   pull_request:
+
   #
   # CRON event is fire on every sunday(UTC).
   #
   schedule:
     - cron: '0 15 * * 0'
 
+  #
+  # Manually triggering a workflow
+  #
+  workflow_dispatch:
+
 #
 # Npm Trusted Publishing + OIDC
 #
@@ -69,6 +75,7 @@ jobs:
           - rockylinux:8
           - fedora:44
           - fedora:43
+          - alpine:3.24
           - alpine:3.23
           - alpine:3.22
           - alpine:3.21
@@ -135,6 +142,35 @@ jobs:
           echo "ENV_PACKAGECLOUD_DOWNLOAD_REPO=${{ secrets.PACKAGECLOUD_DOWNLOAD_REPO }}" >> "${GITHUB_ENV}"
           echo "ENV_NPM_TOKEN=${{ secrets.NPM_TOKEN }}"                                   >> "${GITHUB_ENV}"
 
+      #
+      # Set environments from special variables
+      #
+      # This is the only way to control "min-release-age" when running GitHub Actions,
+      # and it is required only for forked repositories or emergency pull requests.
+      #
+      # [Not PRs]
+      # For operations other than PRs, the value of the "FORCE_MIN_RELEASE_AGE" Github
+      # Actions Variable configured in the repository is referenced.
+      # If this variable is not defined, the default value is used as the "min-release-age".
+      #
+      #    FORCE_MIN_RELEASE_AGE      : Specify a value for the min-release-age setting.
+      #                                 However, do not configure this value unless there
+      #                                 is a special circumstance.
+      #
+      # [PRs]
+      # In the case of a PR, only repository owners and members can bypass the 
+      # "min-release-age" setting.
+      # However, this applies only when a specific keyword is included in the PR body.
+      #
+      - name: Control npm minimum release age
+        run: |
+          ASSOC="${{ github.event.pull_request.author_association }}"
+          if [ "${{ github.event_name }}" = "pull_request" ] && { [ "$ASSOC" = "OWNER" ] || [ "$ASSOC" = "MEMBER" ]; } && echo "${{ github.event.pull_request.body }}" | grep -q "/skip-package-age-limit"; then
+            echo "ENV_FORCE_MIN_RELEASE_AGE=0"                                 >> "${GITHUB_ENV}"
+          else
+            echo "ENV_FORCE_MIN_RELEASE_AGE=${{ vars.FORCE_MIN_RELEASE_AGE }}" >> "${GITHUB_ENV}"
+          fi
+
       #
       # Run building and packaging helper
       #

diff --git a/.github/workflows/nodejs_addon_helper.sh b/.github/workflows/nodejs_addon_helper.sh
@@ -81,6 +81,8 @@ CI_PUBLISH_TAG_NAME=""
 CI_DO_BINARY_PUBLISH=0
 CI_DO_NPM_PUBLISH=0
 
+CI_FORCE_MIN_RELEASE_AGE=""
+
 PATH_PACKAGE_JSON="${SRCTOP}/package.json"
 
 #
@@ -562,6 +564,7 @@ func_usage()
 	echo "    ENV_USE_PACKAGECLOUD_REPO                 use packagecloud.io repository: true/false                ( same as option '--use-packagecloudio-repo(-usepc)' and '--not-use-packagecloudio-repo(-notpc)' )"
 	echo "    ENV_PACKAGECLOUD_OWNER                    owner name for uploading to packagecloud.io               ( same as option '--packagecloudio-owner(-pcowner)' )"
 	echo "    ENV_PACKAGECLOUD_DOWNLOAD_REPO            repository name of installing packages in packagecloud.io ( same as option '--packagecloudio-download-repo(-pcdlrepo)' )"
+	echo "    ENV_FORCE_MIN_RELEASE_AGE                 a value for the min-release-age setting."
 	echo "    ENV_NPM_TOKEN                             [Deprecated] currently use automation NPM token."
 	echo ""
 	echo "  Note:"
@@ -1343,6 +1346,18 @@ elif [ -n "${ENV_NPM_OIDC_EXCHANGE_URL}" ]; then
 	CI_NPM_OIDC_EXCHANGE_URL="${ENV_NPM_OIDC_EXCHANGE_URL}"
 fi
 
+# [NOTE]
+# ENV_FORCE_MIN_RELEASE_AGE cannot be configured via options,
+# and only numeric values are permitted.
+#
+if [ -n "${ENV_FORCE_MIN_RELEASE_AGE}" ]; then
+	if echo "${ENV_FORCE_MIN_RELEASE_AGE}" | grep -q '[^0-9]'; then
+		PRNWARN "ENV_FORCE_MIN_RELEASE_AGE(=${ENV_FORCE_MIN_RELEASE_AGE}) enviroment value is wrong, so skip tp set it."
+	else
+		CI_FORCE_MIN_RELEASE_AGE="${ENV_FORCE_MIN_RELEASE_AGE}"
+	fi
+fi
+
 #
 # Check running as root user
 #
@@ -1522,6 +1537,7 @@ echo "  CI_FORCE_NOT_PUBLISHER        = ${CI_FORCE_NOT_PUBLISHER}"
 echo "  CI_PUBLISH_TAG_NAME           = ${CI_PUBLISH_TAG_NAME}"
 echo "  CI_DO_BINARY_PUBLISH          = ${CI_DO_BINARY_PUBLISH}"
 echo "  CI_DO_NPM_PUBLISH             = ${CI_DO_NPM_PUBLISH}"
+echo "  CI_FORCE_MIN_RELEASE_AGE      = ${CI_FORCE_MIN_RELEASE_AGE}"
 echo ""
 echo "  INSTALLER_BIN                 = ${INSTALLER_BIN}"
 echo "  UPDATE_CMD                    = ${UPDATE_CMD}"

diff --git a/.github/workflows/nodejstypevars.sh b/.github/workflows/nodejstypevars.sh
@@ -347,6 +347,23 @@ elif echo "${CI_OSTYPE}" | grep -q -i "fedora:43"; then
 
 	IS_OS_FEDORA=1
 
+elif echo "${CI_OSTYPE}" | grep -q -i "alpine:3.24"; then
+	INSTALLER_BIN="apk"
+	UPDATE_CMD="update"
+	UPDATE_CMD_ARG="--no-progress"
+	INSTALL_CMD="add"
+	INSTALL_CMD_ARG="--no-progress --no-cache"
+	INSTALL_AUTO_ARG=""
+	INSTALL_QUIET_ARG="-q"
+	INSTALL_PKG_LIST="bash sudo git build-base util-linux-misc musl-locales tar procps yaml-dev k2hdkc-dev chmpx-dev k2hash-dev openssl-dev"
+	NODEJS_PKG_LIST="nodejs npm python3 icu-data-full"
+
+	IS_OS_ALPINE=1
+
+	if [ "${CI_NODEJS_MAJOR_VERSION}" != "24" ]; then
+		NOT_PROVIDED_NODEVER=1
+	fi
+
 elif echo "${CI_OSTYPE}" | grep -q -i "alpine:3.23"; then
 	INSTALLER_BIN="apk"
 	UPDATE_CMD="update"
@@ -460,6 +477,7 @@ fi
 #	RUN_PUBLISH				1
 #	RUN_POST_PUBLISH		1
 #
+RUN_PRE_INSTALL=1
 
 #---------------------------------------------------------------
 # Variables for each process
@@ -499,7 +517,7 @@ fi
 # and PRNINFO defined in nodejs_addon_helper.sh.
 #
 #	<function name>		<which processing>			<implemented or not>
-#	run_pre_install		: before installing npm packages	no
+#	run_pre_install		: before installing npm packages	yes
 #	run_install			: installing npm packages			yes
 #	run_post_install	: after installing npm packages		no
 #	run_pre_audit		: before audit checking				no
@@ -519,6 +537,71 @@ fi
 #	run_post_publish	: after publishing package			yes
 #
 
+#
+# Override pre-install
+#
+# Set min-release-age(=3) to prevent risks immediately after release.
+# To achieve this, set RUN_PRE_INSTALL=1 as described above, and then
+# override the run_pre_install function here.
+#
+run_pre_install()
+{
+	#
+	# Check npm version
+	#
+	# Use the npm `min-release-age` option to protect against supply chain attacks.
+	# To use this option, npm version 11.10.0 or later is required.
+	# Notably, the default npm version included with Node.js v22 is older than this,
+	# so an upgrade is necessary.
+	#
+	_NPMVER_MAJOR=$(npm -v 2>&1 | awk -F'\.' '{print $1}' 2>&1)
+	_NPMVER_MINOR=$(npm -v 2>&1 | awk -F'\.' '{print $2}' 2>&1)
+	_NPMVER_PATCH=$(npm -v 2>&1 | awk -F'\.' '{print $3}' 2>&1)
+	_NEED_NPM_UPGRADE=0
+
+	if [ -z "${_NPMVER_MAJOR}" ]; then
+		_NEED_NPM_UPGRADE=1
+	elif [ "${_NPMVER_MAJOR}" -eq 11 ]; then
+		if [ -z "${_NPMVER_MINOR}" ]; then
+			_NEED_NPM_UPGRADE=1
+		elif [ "${_NPMVER_MINOR}" -lt 10 ]; then
+			_NEED_NPM_UPGRADE=1
+		fi
+	elif [ "${_NPMVER_MAJOR}" -lt 11 ]; then
+		_NEED_NPM_UPGRADE=1
+	fi
+
+	if [ "${_NEED_NPM_UPGRADE}" -eq 1 ]; then
+		PRNINFO "The npm is v${_NPMVER_MAJOR}.${_NPMVER_MINOR}.${_NPMVER_PATCH}, so it will be upgraded."
+
+		if ! /bin/sh -c "npm install -g npm@latest"; then
+			PRNERR "Failed to upgrade npm."
+			return 1
+		fi
+		PRNINFO "Succeed to upgrade npm."
+	fi
+
+	# [NOTE]
+	# If CI_FORCE_MIN_RELEASE_AGE is set, min-release-age is executed using that value.
+	# If it is not set, the default is 3 days.
+	#
+	MIN_RELEASE_AGE_VALUE=3
+	if [ -n "${CI_FORCE_MIN_RELEASE_AGE}" ]; then
+		MIN_RELEASE_AGE_VALUE="${CI_FORCE_MIN_RELEASE_AGE}"
+	fi
+	if [ "${MIN_RELEASE_AGE_VALUE}" -ne 0 ]; then
+		if ! /bin/sh -c "npm config set min-release-age ${MIN_RELEASE_AGE_VALUE}"; then
+			PRNERR "Failed to run \"npm config set min-release-age ${MIN_RELEASE_AGE_VALUE}\"."
+			return 1
+		fi
+		PRNINFO "Finished to run \"npm config set min-release-age ${MIN_RELEASE_AGE_VALUE}\"."
+	else
+		PRNINFO "The min-release-age value is specified 0, so skip to check minimun release age."
+	fi
+
+	return 0
+}
+
 #
 # Override Audit
 #

diff --git a/package.json b/package.json
@@ -28,23 +28,23 @@
   ],
   "dependencies": {
     "bindings": "^1.5.0",
-    "node-addon-api": "^8.7.0",
+    "node-addon-api": "^8.9.0",
     "prebuild-install": "^7.1.3"
   },
   "devDependencies": {
-    "@rollup/plugin-commonjs": "^29.0.2",
+    "@rollup/plugin-commonjs": "^29.0.3",
     "@rollup/plugin-node-resolve": "^16.0.3",
     "@rollup/plugin-replace": "^6.0.3",
     "@rollup/plugin-terser": "^1.0.0",
     "@types/chai": "^5.2.3",
     "@types/mocha": "^10.0.10",
-    "@types/node": "^25.6.0",
+    "@types/node": "^26.1.0",
     "chai": "^6.2.2",
-    "mocha": "^11.7.5",
-    "node-gyp": "^12.3.0",
+    "mocha": "^11.7.6",
+    "node-gyp": "^13.0.0",
     "prebuild": "^13.0.1",
-    "rollup": "^4.60.2",
-    "typescript": "^5.9.3",
+    "rollup": "^4.62.2",
+    "typescript": "^6.0.3",
     "ts-node": "^10.9.2"
   },
   "scripts": {
@@ -71,7 +71,7 @@
     "test:smoke": "export NPM_CONFIG_LOGLEVEL=silent && echo '[START] Test:smoke' && npm run test:smoke:cjs && npm run test:smoke:esm && npm run test:smoke:ts && echo '-> [DONE] Test:smoke\n'",
     "test:smoke:cjs": "export NPM_CONFIG_LOGLEVEL=silent && echo '[START] Test:smoke:cjs' && node tests/smoke_test_cjs.js && echo '-> [DONE] Test:smoke:cjs\n'",
     "test:smoke:esm": "export NPM_CONFIG_LOGLEVEL=silent && echo '[START] Test:smoke:esm' && node tests/smoke_test_esm.mjs && echo '-> [DONE] Test:smoke:esm\n'",
-    "test:smoke:ts": "export NPM_CONFIG_LOGLEVEL=silent && echo '[START] Test:smoke:ts' && tsc --noEmit tests/smoke_test_ts.ts && echo '-> [DONE] Test:smoke:ts\n'",
+    "test:smoke:ts": "export NPM_CONFIG_LOGLEVEL=silent && echo '[START] Test:smoke:ts' && tsc --ignoreConfig --skipLibCheck --noEmit tests/smoke_test_ts.ts && echo '-> [DONE] Test:smoke:ts\n'",
     "test:k2hdkc": "export NPM_CONFIG_LOGLEVEL=silent && echo '[START] Test:k2hdkc' && tests/test.sh k2hdkc && echo '-> [DONE] Test:k2hdkc\n'"
   },
   "repository": {

diff --git a/tsconfig.cjs.json b/tsconfig.cjs.json
@@ -1,12 +1,7 @@
 {
   "extends": "./tsconfig.json",
   "compilerOptions": {
-    "target": "ES2019",
-    "module": "CommonJS",
-    "declaration": false,
-    "emitDeclarationOnly": false,
-    "outDir": "build/cjs",
-    "esModuleInterop": true
+    "outDir": "build/cjs"
   },
   "include": [
     "src/**/*"

diff --git a/tsconfig.esm.json b/tsconfig.esm.json
@@ -1,12 +1,7 @@
 {
   "extends": "./tsconfig.json",
   "compilerOptions": {
-    "target": "ES2019",
-    "module": "ESNext",
-    "declaration": false,
-    "emitDeclarationOnly": false,
-    "outDir": "build/esm",
-    "esModuleInterop": true
+    "outDir": "build/esm"
   },
   "include": [
     "src/**/*"

diff --git a/tsconfig.json b/tsconfig.json
@@ -1,7 +1,8 @@
 {
   "compilerOptions": {
     "target": "ES2019",
-    "module": "CommonJS",
+    "module": "node16",
+    "moduleResolution": "node16",
     "declaration": false,
     "declarationMap": false,
     "emitDeclarationOnly": false,
@@ -10,7 +11,6 @@
     "strict": true,
     "esModuleInterop": true,
     "skipLibCheck": true,
-    "moduleResolution": "node",
     "allowJs": false,
     "checkJs": false,
     "resolveJsonModule": true,

diff --git a/tsconfig.tests.json b/tsconfig.tests.json
@@ -5,10 +5,9 @@
     "rootDir": "tests",
     "sourceMap": false,
     "types": ["node", "mocha"],
-    "baseUrl": ".",
     "paths": {
-      "k2hdkc": ["types/index.d.ts"],
-      "k2hdkc/*": ["types/*"]
+      "k2hdkc": ["./types/index.d.ts"],
+      "k2hdkc/*": ["./types/*"]
     }
   },
   "include": [

diff --git a/tsconfig.types.json b/tsconfig.types.json
@@ -4,7 +4,6 @@
     "declaration": true,
     "emitDeclarationOnly": true,
     "outDir": "types-generated",
-    "rootDir": "src",
     "skipLibCheck": true
   },
   "include": [