pinokiod 8.2.19 → 8.2.20

package/kernel/bin/conda-pins.js

@@ -3,7 +3,7 @@ const path = require('path')
 const { resolveAsarPath } = require('../util')
 const PIP_WHEEL = require('../../system/pip_seed.json')
 
-const CONDA_PIN_VERSION = "26.5.3"
+const CONDA_PIN_VERSION = "26.7.0"
 // Conda 26.9.4 has no Python 3.10 builds. Apply its CA-bundle requirements
 // explicitly while retaining the managed Python version required by apps.
 const TLS_PACKAGE_MINIMUMS = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.19",
+  "version": "8.2.20",
   "description": "",
   "main": "index.js",
   "scripts": {

package/test/conda-bin.test.js

@@ -211,11 +211,12 @@ test('Conda uses Miniforge assets and writes conda-forge-only config', async ()
 })
 
 test('Conda pins the managed Conda and Python versions consistently', async () => {
-  assert.equal(CONDA_PIN_VERSION, '26.5.3')
+  assert.equal(CONDA_PIN_VERSION, '26.7.0')
   assert.equal(PYTHON_INSTALL_SPEC, 'python=3.10.20')
   assert.equal(WINDOWS_PYTHON_SSL_FIX_SPEC, 'python=3.10.20=*_1_cpython')
 
-  assert.equal(isExpectedCondaPinned('26.5.3'), true)
+  assert.equal(isExpectedCondaPinned('26.7.0'), true)
+  assert.equal(isExpectedCondaPinned('26.5.3'), false)
   assert.equal(isExpectedCondaPinned('26.3.2'), false)
 
   assert.equal(isExpectedPythonPinned('darwin', '3.10.20', 'cpython'), true)
@@ -235,7 +236,7 @@ test('Conda init writes the current Conda pin into an existing runtime', async (
 
   assert.equal(
     await fs.readFile(path.join(root, 'bin', 'miniforge', 'conda-meta', 'pinned'), 'utf8'),
-    ['conda ==26.5.3', ...TLS_PACKAGE_SPECS].join('\n')
+    ['conda ==26.7.0', ...TLS_PACKAGE_SPECS].join('\n')
   )
 })
 
@@ -290,11 +291,11 @@ test('Conda install requests the Python 3.10.20 pin on macOS/Linux', async () =>
   assert.deepEqual(condaInstall.message[2], { _: ['python', '-I', '-m', 'pip', '--isolated', 'install', '--no-index', PIP_WHEEL.filename] })
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
+    'conda install -y --override-channels -c conda-forge "conda=26.7.0" "python=3.10.20" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
   )
   assert.equal(
     await fs.readFile(path.join(root, 'bin', 'miniforge', 'conda-meta', 'pinned'), 'utf8'),
-    ['conda ==26.5.3', ...TLS_PACKAGE_SPECS].join('\n')
+    ['conda ==26.7.0', ...TLS_PACKAGE_SPECS].join('\n')
   )
 })
 
@@ -322,7 +323,7 @@ test('Conda install keeps the Windows Python 3.10.20 SSL-fixed build pin', async
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
+    'conda install -y --override-channels -c conda-forge "conda=26.7.0" "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
   )
 })
 
@@ -354,10 +355,73 @@ test('Conda install replaces the stale runtime and rebuilds declared Conda modul
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19" uv=0.11.23 nodejs=22.21.1 pnpm'
+    'conda install -y --override-channels -c conda-forge "conda=26.7.0" "python=3.10.20" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19" uv=0.11.23 nodejs=22.21.1 pnpm'
   )
 })
 
+test('Conda 26.5.3 triggers replacement even when certificates and pip are current', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-version-update-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  for (const platform of ['darwin', 'linux', 'win32']) {
+    for (const securityReady of [false, true]) {
+      const dir = path.join(root, platform, String(securityReady))
+      await writeHealthyCondaMeta(dir, platform, '26.5.3')
+      await writeFakeManagedConda(dir, platform)
+      if (!securityReady) {
+        for (const name of ['ca-certificates', 'certifi']) {
+          await fs.rm(path.join(dir, 'bin/miniforge/conda-meta', `${name}-2026.10.19.json`))
+          await writeCondaMeta(dir, name, '2026.7.22')
+        }
+        await fs.writeFile(path.join(dir, 'bin/miniforge/test-pip-version'), '26.2.1')
+        await fs.rm(path.join(dir, 'bin/miniforge/test-pip-seed'))
+      }
+      const trash = path.join(dir, 'bin/miniforge/Library/bin/libcrypto-3-x64.dll.c~.conda_trash')
+      await fs.mkdir(path.dirname(trash), { recursive: true })
+      await fs.writeFile(trash, 'stale trash')
+      const appFile = path.join(dir, 'api/demo/env/keep.txt')
+      await fs.mkdir(path.dirname(appFile), { recursive: true })
+      await fs.writeFile(appFile, 'existing app venv')
+      const bin = createBin(dir, platform)
+      await bin.tryList()
+      assert.equal(bin.correct_conda, false)
+
+      const kernel = createKernel(dir, platform)
+      kernel.bin.mods = []
+      let downloads = 0
+      kernel.bin.download = async () => { downloads++ }
+      kernel.bin.rm = async () => {}
+      const calls = []
+      kernel.bin.exec = async payload => {
+        calls.push(payload)
+        if (payload.conda?.skip) {
+          assert.equal(await pathExists(trash), false, 'replacement removes old runtime and trash')
+          assert.equal(await pathExists(path.join(dir, 'bin/miniforge/conda-meta')), false)
+          await fs.mkdir(path.join(dir, 'bin/miniforge/conda-meta'), { recursive: true })
+          await writeFakeManagedConda(dir, platform)
+          if (platform === 'win32') await fs.writeFile(path.join(dir, 'bin/miniforge/python.exe'), 'fake python\n')
+        } else {
+          assert.match(payload.message[1], /"conda=26\.7\.0"/)
+          assert.deepEqual(payload.message[2], { _: ['python', '-I', '-m', 'pip', '--isolated', 'install', '--no-index', PIP_WHEEL.filename] })
+          await writeHealthyCondaMeta(dir, platform)
+        }
+        return {}
+      }
+      const conda = createConda(kernel)
+      await conda.install({ dependencies: [] }, () => {})
+      assert.equal(await conda.check(), true)
+      await bin.tryList()
+      assert.equal(bin.correct_conda, true)
+      assert.equal(await fs.readFile(appFile, 'utf8'), 'existing app venv')
+      assert.equal(await pathExists(trash), false)
+      assert.equal(downloads, 1)
+      assert.equal(calls.length, 2, 'installer and bootstrap run once')
+      await conda.install({ dependencies: [] }, () => {})
+      assert.equal(downloads, 1, 'the updated runtime is not reinstalled on a retry')
+      assert.equal(calls.length, 2)
+    }
+  }
+})
+
 test('Conda replacement stops a running managed Caddy without restoring it', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-caddy-lifecycle-'))
   await createMiniforge(root)