This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+4 more
Affected surfaces
ReleasePort's take
Light signalThe release pins all ContextLattice‑owned runtimes to Node 24.18.0 and npm 11.16.0, enforcing strict version contracts across tooling, containers, dashboards, CI pipelines, and dependency scripts.
Why it matters: Enforces consistent runtime versions (Node 24.18.0, npm 11.16.0) across local tooling, container images, GitHub Actions, CI gates, and audit scripts; drift is now rejected by the new node24_runtime_audit.py check.
Summary
AI summaryPinned all ContextLattice‑owned runtimes to Node 24.18.0 and npm 11.16.0, enforcing strict version contracts.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Added strict `engines` and `packageManager` requirements plus Node 24 type definitions to dashboard package.json. Added strict `engines` and `packageManager` requirements plus Node 24 type definitions to dashboard package.json. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Dependency | High |
Pinned local Node runtime to version 24.18.0 and npm to 11.16.0. Pinned local Node runtime to version 24.18.0 and npm to 11.16.0. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Dependency | High |
Moved dashboard, MemoryMCP, and custom MCP gateway builds to Node 24.18.0 images. Moved dashboard, MemoryMCP, and custom MCP gateway builds to Node 24.18.0 images. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Dependency | High |
Rebuilt MCP gateway Dockerfile to remove Alpine package manager assumption. Rebuilt MCP gateway Dockerfile to remove Alpine package manager assumption. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Dependency | High |
Upgraded all JavaScript GitHub Actions to verified Node 24 major version. Upgraded all JavaScript GitHub Actions to verified Node 24 major version. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Dependency | High |
Added dedicated Node 24 CI gate that installs dashboard, runs full test suite, and produces production build. Added dedicated Node 24 CI gate that installs dashboard, runs full test suite, and produces production build. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Dependency | High |
Added `scripts/node24_runtime_audit.py` to reject version drift in package, Docker, and workflow surfaces. Added `scripts/node24_runtime_audit.py` to reject version drift in package, Docker, and workflow surfaces. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Dependency | High |
Reviewed and version‑pinned every dependency install script surfaced by npm 11; unreviewed or stale approvals now fail closed. Reviewed and version‑pinned every dependency install script surfaced by npm 11; unreviewed or stale approvals now fail closed. Source: llm_adapter@2026-07-13 Confidence: high |
— |
Full changelog
ContextLattice v3.15.1 - One Runtime. Zero Drift.
The application, local tooling, containers, and release machinery should not
quietly inhabit different JavaScript eras. v3.15.1 converges every
ContextLattice-owned Node surface on the current Node 24 LTS line and turns
that choice into an executable contract.
What changed
- Pinned local version-manager contracts to Node
24.18.0and npm11.16.0. - Added strict dashboard
enginesandpackageManagerrequirements plus Node
24 type definitions. - Moved the dashboard, MemoryMCP, and custom MCP gateway build paths to Node
24.18.0images. - Rebuilt the stale MCP gateway Dockerfile around the current proxy binary;
it no longer assumes an Alpine package manager that the upstream image does
not contain. - Upgraded every JavaScript GitHub Action to a verified Node 24 major,
including checkout, setup, artifacts, labeling, attestation, and release
publication. - Added a dedicated Node 24 CI gate that performs a clean dashboard install,
runs the full test suite, and produces a production build. - Added
scripts/node24_runtime_audit.pyto reject version drift in package,
Docker, and workflow surfaces. - Reviewed and version-pinned every dependency install script surfaced by npm
11. Future unreviewed or stale approvals now fail closed.
The boundary
- This is a runtime-convergence release, not an application architecture
rewrite. - ContextLattice still uses the CLI as its primary agent interface.
- No MCP tool, gateway route, retrieval behavior, entitlement, or memory
contract was added. - Third-party services retain their vendor-owned runtimes; the audit covers
ContextLattice-owned build and execution surfaces.
Verify it
node --version
npm --version
python3 scripts/node24_runtime_audit.py --check-local --pretty
Expected runtime line:
Node v24.18.0
npm 11.16.0
The reproducible baseline and verification ledger are in
docs/evals/v3.15.1-node24-runtime.json.
Breaking Changes
- Enforced Node 24.18.0 as the minimum required runtime for all local tooling, dashboard, MCP gateway, and GitHub Actions; previous version flexibility removed.
- Required npm 11.16.0 via `engines` and `packageManager` fields in package.json; older npm versions will fail to install.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About sheawinkler/ContextLattice
Private-by-default memory and context layer for agents with Go/Rust runtime, staged retrieval across fused data backends, and long-horizon context continuity.
Related context
Related tools
Beta — feedback welcome: [email protected]