Merge branch 'develop'

Author: Etherpad Release Bot

.github/workflows/backend-tests.yml

@@ -27,8 +27,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # PRs: test on latest Node only. Push to develop: full matrix.
-        node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[22, 24, 25]') }}
+        # Etherpad requires Node >= 24 (see package.json engines.node).
+        node: ${{ fromJSON('[24]') }}
     steps:
       -
         name: Checkout repository
@@ -66,7 +66,24 @@ jobs:
         run: pnpm build
       -
         name: Run the backend tests
-        run: pnpm test
+        env:
+          # --report-on-fatalerror and friends write a Node diagnostic report
+          # (V8 stack, libuv handles, OS info) on fatal errors that bypass JS
+          # handlers — the failure mode we've been chasing on Windows + Node
+          # 24 since PR #7663. Reports land in node-report/ and are uploaded
+          # as an artifact if the step fails.
+          NODE_OPTIONS: "--report-on-fatalerror --report-uncaught-exception --report-on-signal --report-compact --report-directory=${{ github.workspace }}/node-report"
+        run: |
+          mkdir -p "${{ github.workspace }}/node-report"
+          pnpm test
+      - name: Upload Node diagnostic reports on failure
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: node-diagnostic-report-${{ runner.os }}-node${{ matrix.node }}-${{ github.job }}
+          path: node-report/
+          if-no-files-found: ignore
+          retention-days: 7
       - name: Run the new vitest tests
         working-directory: src
         run: pnpm run test:vitest
@@ -84,7 +101,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[22, 24, 25]') }}
+        node: ${{ fromJSON('[24]') }}
     steps:
       -
         name: Checkout repository
@@ -136,7 +153,19 @@ jobs:
           ep_table_of_contents
       -
         name: Run the backend tests
-        run: pnpm test
+        env:
+          NODE_OPTIONS: "--report-on-fatalerror --report-uncaught-exception --report-on-signal --report-compact --report-directory=${{ github.workspace }}/node-report"
+        run: |
+          mkdir -p "${{ github.workspace }}/node-report"
+          pnpm test
+      - name: Upload Node diagnostic reports on failure
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: node-diagnostic-report-${{ runner.os }}-node${{ matrix.node }}-${{ github.job }}
+          path: node-report/
+          if-no-files-found: ignore
+          retention-days: 7
       - name: Run the new vitest tests
         working-directory: src
         run: pnpm run test:vitest
@@ -150,7 +179,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: [22, 24, 25]
+        # Etherpad requires Node >= 24 (see package.json engines.node).
+        node: ${{ fromJSON('[24]') }}
     name: Windows without plugins
     runs-on: windows-latest
     steps:
@@ -186,8 +216,25 @@ jobs:
           powershell -Command "(gc settings.json.holder) -replace '\"points\": 10', '\"points\": 1000' | Out-File -encoding ASCII settings.json"
       -
         name: Run the backend tests
+        shell: bash
         working-directory: src
-        run: pnpm test
+        env:
+          NODE_OPTIONS: "--report-on-fatalerror --report-uncaught-exception --report-on-signal --report-compact --report-directory=${{ github.workspace }}/node-report"
+        run: |
+          mkdir -p "${{ github.workspace }}/node-report"
+          # --exit forces process.exit(failures) after the suite completes,
+          # closing the post-suite event-loop drain window where Windows +
+          # Node 24 hard-kills the process. Scoped to Windows so Linux/local
+          # runs still surface real handle leaks via natural drain.
+          pnpm test -- --exit
+      - name: Upload Node diagnostic reports on failure
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: node-diagnostic-report-${{ runner.os }}-node${{ matrix.node }}-${{ github.job }}
+          path: node-report/
+          if-no-files-found: ignore
+          retention-days: 7
       - name: Run the new vitest tests
         working-directory: src
         run: pnpm run test:vitest
@@ -200,7 +247,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: [22, 24, 25]
+        # Etherpad requires Node >= 24 (see package.json engines.node).
+        node: ${{ fromJSON('[24]') }}
     name: Windows with Plugins
     runs-on: windows-latest
 
@@ -265,8 +313,25 @@ jobs:
           powershell -Command "(gc settings.json.holder) -replace '\"points\": 10', '\"points\": 1000' | Out-File -encoding ASCII settings.json"
       -
         name: Run the backend tests
+        shell: bash
         working-directory: src
-        run: pnpm test
+        env:
+          NODE_OPTIONS: "--report-on-fatalerror --report-uncaught-exception --report-on-signal --report-compact --report-directory=${{ github.workspace }}/node-report"
+        run: |
+          mkdir -p "${{ github.workspace }}/node-report"
+          # --exit forces process.exit(failures) after the suite completes,
+          # closing the post-suite event-loop drain window where Windows +
+          # Node 24 hard-kills the process. Scoped to Windows so Linux/local
+          # runs still surface real handle leaks via natural drain.
+          pnpm test -- --exit
+      - name: Upload Node diagnostic reports on failure
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: node-diagnostic-report-${{ runner.os }}-node${{ matrix.node }}-${{ github.job }}
+          path: node-report/
+          if-no-files-found: ignore
+          retention-days: 7
       - name: Run the new vitest tests
         working-directory: src
         run: pnpm run test:vitest

.github/workflows/build-and-deploy-docs.yml

@@ -56,12 +56,11 @@ jobs:
         with:
           run_install: false
       # Pin Node so the build does not silently fall back to whatever the
-      # runner image ships with. vite 8 requires Node ^20.19.0 || >=22.12.0;
-      # the repo declares engines.node >=22.12.0 to match.
+      # runner image ships with. The repo declares engines.node >=24.0.0.
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
       - name: Setup Pages
         if: github.event_name == 'push'

.github/workflows/deb-package.yml

@@ -128,7 +128,7 @@ jobs:
         run: |
           set -eux
           # Ubuntu's default apt nodejs is 18 — too old for our
-          # `Depends: nodejs (>= 22)`. Add NodeSource's apt repo
+          # `Depends: nodejs (>= 24)`. Add NodeSource's apt repo
           # explicitly (key + sources.list) instead of `curl | sudo bash`
           # so we don't execute network-fetched code as root.
           NODE_MAJOR=24
@@ -137,7 +137,7 @@ jobs:
           # existing nodesource entries so the only Node candidate apt sees
           # is our node_24.x repo. Otherwise `apt-get install -y nodejs`
           # picks the higher-version 20.x build that's already cached and
-          # `dpkg -i` then fails on `Depends: nodejs (>= 22)`.
+          # `dpkg -i` then fails on `Depends: nodejs (>= 24)`.
           sudo rm -f /etc/apt/sources.list.d/nodesource.list \
                      /etc/apt/sources.list.d/nodesource.sources \
                      /etc/apt/preferences.d/nodesource \
@@ -172,10 +172,14 @@ jobs:
           sudo test -L /opt/etherpad/settings.json
           sudo test -L /opt/etherpad/var
           [ "$(sudo readlink /opt/etherpad/var)" = "/var/lib/etherpad/var" ]
-          sudo test -L /opt/etherpad/src/plugin_packages
-          [ "$(sudo readlink /opt/etherpad/src/plugin_packages)" = "/var/lib/etherpad/plugin_packages" ]
-          sudo test -d /var/lib/etherpad/plugin_packages
-          [ "$(sudo stat -c '%U' /var/lib/etherpad/plugin_packages)" = "etherpad" ]
+          # plugin_packages must stay in-tree -- Node.js resolves symlinks
+          # to realpath before walking node_modules, so symlinking it
+          # outside /opt broke require("ep_etherpad-lite/...") in
+          # admin-installed plugins (ether/ep_comments_page#416).
+          sudo test -d /opt/etherpad/src/plugin_packages
+          sudo test ! -L /opt/etherpad/src/plugin_packages
+          [ "$(sudo stat -c '%G' /opt/etherpad/src/plugin_packages)" = "etherpad" ]
+          [ "$(sudo stat -c '%a' /opt/etherpad/src/plugin_packages)" = "2775" ]
           [ "$(stat -c '%G' /opt/etherpad/src/node_modules)" = "etherpad" ]
           sudo test -f /var/lib/etherpad/var/installed_plugins.json
           sudo grep -q '"ep_etherpad-lite"' /var/lib/etherpad/var/installed_plugins.json
@@ -197,8 +201,71 @@ jobs:
             exit 1
           fi
           sudo systemctl stop etherpad
+          # Regression: simulate a pre-fix install (plugin_packages as a
+          # symlink to /var/lib/etherpad/plugin_packages, with a marker
+          # plugin inside) and re-run the postinst. The new postinst must
+          # migrate the contents back in-tree and drop the symlink so
+          # admin-installed plugins keep resolving ep_etherpad-lite
+          # (ether/ep_comments_page#416).
+          sudo rm -rf /opt/etherpad/src/plugin_packages
+          sudo mkdir -p /var/lib/etherpad/plugin_packages/.versions/ep_migration_marker
+          echo '{"name":"ep_migration_marker"}' | \
+            sudo tee /var/lib/etherpad/plugin_packages/.versions/ep_migration_marker/package.json >/dev/null
+          sudo chown -R etherpad:etherpad /var/lib/etherpad/plugin_packages
+          sudo ln -sfn /var/lib/etherpad/plugin_packages /opt/etherpad/src/plugin_packages
+          sudo dpkg-reconfigure etherpad
+          sudo test -d /opt/etherpad/src/plugin_packages
+          sudo test ! -L /opt/etherpad/src/plugin_packages
+          sudo test -f /opt/etherpad/src/plugin_packages/.versions/ep_migration_marker/package.json
+          [ "$(sudo stat -c '%a' /opt/etherpad/src/plugin_packages)" = "2775" ]
+
+          # Regression: stage the ep_layout_trip_wire test fixture into
+          # plugin_packages and confirm etherpad loads it. The fixture's
+          # index.js does the require('ep_etherpad-lite/...') calls that
+          # broke under the old symlinked layout (#416). If the layout
+          # ever regresses, the marker line never reaches the journal
+          # and this step fails.
+          PLUGIN_DIR=/opt/etherpad/src/plugin_packages
+          FIXTURE_DIR=$GITHUB_WORKSPACE/packaging/test-fixtures/ep_layout_trip_wire
+          sudo install -d -o etherpad -g etherpad -m 2775 "${PLUGIN_DIR}/.versions"
+          sudo cp -a "${FIXTURE_DIR}" "${PLUGIN_DIR}/.versions/ep_layout_trip_wire@1.0.0"
+          sudo ln -sfn .versions/ep_layout_trip_wire@1.0.0 "${PLUGIN_DIR}/ep_layout_trip_wire"
+          sudo ln -sfn ../plugin_packages/ep_layout_trip_wire \
+            /opt/etherpad/src/node_modules/ep_layout_trip_wire
+          sudo chown -R etherpad:etherpad "${PLUGIN_DIR}/.versions/ep_layout_trip_wire@1.0.0" \
+            "${PLUGIN_DIR}/ep_layout_trip_wire" \
+            /opt/etherpad/src/node_modules/ep_layout_trip_wire
+          echo '{"plugins":[{"name":"ep_etherpad-lite","version":"0.0.0"},{"name":"ep_layout_trip_wire","version":"1.0.0"}]}' \
+            | sudo tee /var/lib/etherpad/var/installed_plugins.json >/dev/null
+          sudo chown etherpad:etherpad /var/lib/etherpad/var/installed_plugins.json
+          sudo systemctl start etherpad
+          ok=
+          for i in $(seq 1 30); do
+            if curl -fsS http://127.0.0.1:9001/health; then ok=1; break; fi
+            sleep 2
+          done
+          if [ -z "${ok}" ]; then
+            sudo journalctl -u etherpad --no-pager -n 300 || true
+            exit 1
+          fi
+          # Marker proves the require('ep_etherpad-lite/...') calls in
+          # the fixture's index.js all resolved.
+          sudo journalctl -u etherpad --no-pager -n 500 \
+            | grep -F 'ep_layout_trip_wire: plugin_packages layout OK'
+          # And no MODULE_NOT_FOUND involving ep_etherpad-lite, anywhere.
+          if sudo journalctl -u etherpad --no-pager -n 500 \
+              | grep -E "Cannot find module '?ep_etherpad-lite"; then
+            echo "::error::ep_etherpad-lite require failed inside an installed plugin"
+            exit 1
+          fi
+          sudo systemctl stop etherpad
+
           sudo dpkg --purge etherpad
           ! id etherpad 2>/dev/null
+          # Purge must clean up runtime-created plugin artifacts that
+          # dpkg didn't ship (ether/ep_comments_page#416, Qodo #3).
+          sudo test ! -e /opt/etherpad/src/plugin_packages
+          sudo test ! -e /var/lib/etherpad
 
       - name: Upload artifact
         uses: actions/upload-artifact@v7

.github/workflows/dependency-review.yml

@@ -17,4 +17,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@v6
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5

.github/workflows/docker.yml

@@ -59,7 +59,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
           cache-dependency-path: etherpad/pnpm-lock.yaml
       -
@@ -79,7 +79,88 @@ jobs:
             esac
           done
           (cd src && pnpm run test-container)
+          docker rm -f test
           git clean -dxf .
+      -
+        # Regression test for #7718. Reproduces the production
+        # docker-compose layout reported in that issue: a named volume
+        # mounted on src/plugin_packages with no TTY allocated. Under
+        # the previous `CMD ["pnpm", "run", "prod"]`, pnpm 11's
+        # runDepsStatusCheck spuriously decided node_modules was out of
+        # sync at boot and tried to wipe + reinstall, aborting with
+        # ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY before the HTTP
+        # server ever came up. If the CMD is ever reverted to go
+        # through `pnpm run`, this step will time out waiting for the
+        # health endpoint and fail.
+        name: Regression — boot with named volume on plugin_packages (#7718)
+        working-directory: etherpad
+        run: |
+          docker volume create ep7718-plugins
+          docker run --rm -d -p 9001:9001 \
+            -v ep7718-plugins:/opt/etherpad-lite/src/plugin_packages \
+            --name test-7718 ${{ env.TEST_TAG }}
+          docker logs -f test-7718 &
+          ok=0
+          for i in $(seq 1 60); do
+            status=$(docker container inspect -f '{{.State.Health.Status}}' test-7718 2>/dev/null) || {
+              echo "container exited prematurely — likely #7718 regression"
+              docker logs test-7718 || true
+              break
+            }
+            case ${status} in
+              healthy) ok=1; echo "container healthy after $((i*2))s"; break;;
+              starting) sleep 2;;
+              *) echo "unexpected status: ${status}"; docker logs test-7718; break;;
+            esac
+          done
+          docker rm -f test-7718 >/dev/null 2>&1 || true
+          docker volume rm ep7718-plugins >/dev/null 2>&1 || true
+          [ "$ok" = "1" ] || exit 1
+
+  build-test-local-plugin:
+    # Regression coverage for #7687: the Docker image's
+    # `bin/installLocalPlugins.sh` step runs as the `etherpad` user and
+    # invokes pnpm via the corepack shim. A previous corepack/cache bug
+    # made that path fail when ETHERPAD_LOCAL_PLUGINS was set. This job
+    # builds the development target with a stub local plugin so the
+    # regression cannot silently come back.
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Check out
+        uses: actions/checkout@v6
+        with:
+          path: etherpad
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+      -
+        name: Stub a local plugin
+        run: |
+          mkdir -p etherpad/local_plugins/ep_test_corepack
+          cat > etherpad/local_plugins/ep_test_corepack/package.json <<'EOF'
+          {
+            "name": "ep_test_corepack",
+            "version": "0.0.1",
+            "description": "regression-test stub for ether/etherpad#7687",
+            "main": "index.js"
+          }
+          EOF
+          cat > etherpad/local_plugins/ep_test_corepack/index.js <<'EOF'
+          exports.placeholder = true;
+          EOF
+      -
+        name: Build with ETHERPAD_LOCAL_PLUGINS (must succeed)
+        uses: docker/build-push-action@v7
+        with:
+          context: ./etherpad
+          target: development
+          load: false
+          build-args: |
+            ETHERPAD_LOCAL_PLUGINS=ep_test_corepack
+          cache-from: type=gha
 
   build-test-db-drivers:
     # Spinning up MySQL + Postgres + cross-driver smoke is expensive; only
@@ -284,13 +365,13 @@ jobs:
         if: success() && github.ref == 'refs/heads/develop'
         working-directory: ether-charts
         run: |
-          sed -i 's/tag: ".*"/tag: "${{ steps.build-docker.outputs.digest }}"/' values-dev.yaml
+          sed -i 's/tag: ".*"/tag: "${{ steps.build-docker.outputs.digest }}"/' charts/etherpad/values-dev.yaml
       - name: Commit and push changes
         working-directory: ether-charts
         if: success() && github.ref == 'refs/heads/develop'
         run: |
           git config --global user.name 'github-actions[bot]'
           git config --global user.email 'github-actions[bot]@users.noreply.github.com'
-          git add values-dev.yaml
+          git add charts/etherpad/values-dev.yaml
           git commit -m 'Update develop image tag'
           git push

.github/workflows/frontend-admin-tests.yml

@@ -21,8 +21,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # PRs: single Node version. Push: full matrix.
-        node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[22, 24, 25]') }}
+        # Etherpad requires Node >= 24 (see package.json engines.node).
+        node: ${{ fromJSON('[24]') }}
 
     steps:
       -