build(deps): bump @kujolang/kujo-runtime from 1.2.3 to 1.3.1 - #16

Sourced from @​kujolang/kujo-runtime's releases.

Kujo v1.3.1 fixes transient Linux Text file busy failures during native runtime upgrades.

The staged executable version check now retries Linux ETXTBSY within its existing deadline. Checksum verification, version matching, installation ownership checks, and recovery backups remain enforced. Regression tests retain and identify an inherited writable staging descriptor, exercise the failure against the previous implementation, and verify bounded recovery under parallel execution.

Install the matching archive below or use npm install -g @kujolang/kujo-runtime@1.3.1. Standalone Kujo v1.3.0 and later installations can run kujo upgrade 1.3.1; older versions must first use the installer or their existing package manager. Native upgrades update the runtime only.

This patch is based on v1.3.0. The existing v1.3.0 signed tag and GitHub assets are unchanged. Each archive has a SHA-256 file, also collected in checksums.txt.

Kujo v1.3.0

Kujo 1.3.0 adds runtime maintenance, streaming I/O, database, and text-decoding capabilities, with fixes for VM closures, async calls, and PostgreSQL execution.

Runtime maintenance

• kujo upgrade [VERSION] updates a supported standalone runtime from official release binaries. It supports read-only --check, structured --json, exact stable versions, explicit downgrade permission, checksum verification, and retained recovery backups.
• npm, Cargo, and other recognized managed installations keep using their original package manager. Native upgrades do not update ecosystem sources, profiles, package pins, or project dependencies.

Streaming and network I/O

• Incremental HTTP response streaming, routed uploads with authorization preflight, and bounded file-range streaming over TCP and TLS.
• Strict per-request destination policies, DNS pinning, redirect controls, and bounded timeouts for HTTP file uploads and downloads.
• Transformed file-range streaming into private spools and atomic no-overwrite file publication with explicit verification and durability receipts.
• Expanded IP-literal facts for network-policy consumers.

Databases and text

• PostgreSQL TLS connections with mandatory peer/hostname verification and an explicit CA bundle; synchronous PostgreSQL calls work safely in async workers and preserve parameter types.
• Read-only immutable SQLite inspection and tracked immediate transactions.
• Strict bounded charset decoding and streaming file-range charset conversion, with independent decoded and UTF-8 hashes.
• Doctor composition preserves profile arguments and bounded readiness reports.

Correctness

• VM closures capture the nearest same-named local binding.
• Imported async functions preserve arity, captured environments, and promise behavior across VM call paths.
• TLS APIs accept VM dictionary option literals with the same validation as the interpreter.
• Async scheduling is bounded independently of host CPU count, and interpreter execution avoids nested CLI-runtime failures.

Installation and compatibility

Download the archive and matching SHA-256 file for Linux x64/arm64, macOS x64/arm64, or Windows x64. GitHub binary publication does not imply that another package registry has published the same version.

Upgrading from v1.2.3 or earlier: those binaries do not contain kujo upgrade. First install v1.3.0 through the existing installer, a verified standalone archive, or your original package manager once its matching package is available. Thereafter, supported standalone installations can use kujo upgrade.

Checksums provide integrity through the official release channel, not independent artifact signing. Successful native upgrades retain a backup; a crash between Windows replacement renames can require manual recovery. See runtime upgrade documentation for ownership and recovery boundaries.

This is an additive minor release under the compatibility policy. Existing capability requirements and resource limits remain part of each API contract.

Full changelog · Changes since v1.2.3

Sourced from @​kujolang/kujo-runtime's changelog.

[1.3.1] - 2026-09-06

Fixed

• Prevent transient Linux Text file busy errors from aborting verified native runtime upgrades. Staged version checks retry only this condition, sharing one deadline across retries and process execution. Other execution errors, checksum verification, version matching and destination checks remain intact.

Changed

• Exercise inherited writable executable descriptors and repeated parallel native upgrades in Linux CI. Verify clean, lifecycle-script-disabled npm installations on every supported native target.

[1.3.0] - 2026-09-05

Added

• Add native runtime-only kujo upgrade [VERSION], exact stable release selection, read-only --check, documented --json, explicit downgrade opt-in, official SHA-256 verification, managed-install guidance, and retained recovery binaries. Upgrade archive support remains available without default language features.

• Add database-capability-gated db_connect_postgres_tls for PostgreSQL over mandatory TLS 1.2+ with peer and hostname verification, an explicit bounded public CA bundle, TCP-host enforcement, and secret-free deterministic connection failures.

• Add capability-free decode_charset(bytes, charset, max_output_bytes) with strict no-replacement decoding, explicit 64 MiB resource ceilings, exact MIME ISO-8859-1 semantics, registered legacy charset support, and VM/interpreter parity.

• Add filesystem-read-gated decode_text_file_range_info to compose strict identity/Base64/quoted-printable streaming with strict registered-charset conversion, independent decoded/UTF-8 hashes, fixed memory, explicit output and prefix ceilings, and VM/interpreter parity.

• Add db_connect_readonly("sqlite", path) for capability-gated, fail-closed immutable inspection of existing checkpointed SQLite databases without create, write, WAL or shared-memory side effects.

• Preserve doctor-profile arguments, bounded structured reports up to 1 MiB, and optional readiness/profile data through generic Doctor composition.

• Add routed, authorization-preflighted HTTP uploads with fixed-memory body streaming into auto-cleaned private files, caller-lowerable 64 MiB ceilings, SHA-256 receipts, read deadlines, and interpreter/VM parity. Upload routes require explicit network-server, filesystem-write, and filesystem-delete

... (truncated)

• af210d4 release: prepare Kujo v1.3.1 patch metadata
• a729428 release: prepare Kujo v1.3.0
• See full diff in compare view

This version was pushed to npm by GitHub Actions, a new releaser for @​kujolang/kujo-runtime since your current version.

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)