packaging/linux/fetch-node.sh and packaging/windows/fetch-node.sh download a pinned Node.js build and bundle it into every packaged artifact except the npm package (standalone tarballs, Windows zip, deb/rpm, snap, AppImage, desktop). That runtime is usually the largest single binary in those artifacts, and because a shell script fetches it rather than bun.lock resolving it, the CycloneDX SBOM never mentions it. SECURITY.md already scopes the SBOM to "the dependency closure of" those artifacts; this issue is the gap behind that wording.
Fix. Read the pinned Node.js version out of the two scripts and add a hand-maintained component entry to SECURITY.md (or a sibling doc) naming the version and its upstream provenance (the nodejs.org release it is fetched from). No script changes.
Done when a reader of the security documentation can learn which Node.js build ships inside the packaged artifacts and where it comes from. Docs only.
Context: docs/BACKLOG.md, entry C7.
Curated for Hacktoberfest 2026. Comment to claim it before you start so two people do not work on the same issue. A PR must reference this issue and land with its tests in the same change; see CONTRIBUTING.md. Repo rules that apply: write the failing test first, run bun run test (never bare bun test), and the 100% line-coverage gate must stay green.
packaging/linux/fetch-node.shandpackaging/windows/fetch-node.shdownload a pinned Node.js build and bundle it into every packaged artifact except the npm package (standalone tarballs, Windows zip, deb/rpm, snap, AppImage, desktop). That runtime is usually the largest single binary in those artifacts, and because a shell script fetches it rather thanbun.lockresolving it, the CycloneDX SBOM never mentions it.SECURITY.mdalready scopes the SBOM to "the dependency closure of" those artifacts; this issue is the gap behind that wording.Fix. Read the pinned Node.js version out of the two scripts and add a hand-maintained component entry to
SECURITY.md(or a sibling doc) naming the version and its upstream provenance (the nodejs.org release it is fetched from). No script changes.Done when a reader of the security documentation can learn which Node.js build ships inside the packaged artifacts and where it comes from. Docs only.
Context:
docs/BACKLOG.md, entry C7.Curated for Hacktoberfest 2026. Comment to claim it before you start so two people do not work on the same issue. A PR must reference this issue and land with its tests in the same change; see CONTRIBUTING.md. Repo rules that apply: write the failing test first, run
bun run test(never barebun test), and the 100% line-coverage gate must stay green.