fix(ci): pin Node to 24.18.0 so better-sqlite3 stops aborting test workers

.github/workflows/ci.yml

@@ -24,6 +24,19 @@ on:
       - '.gitignore'
       - 'CHANGELOG.md'
 
+# Node 24.19.0 shipped nodejs/node#63642 ("src: add cleanup hooks to
+# node::ObjectWrap"), which makes NAN-style ObjectWrap addons abort during
+# environment teardown: better-sqlite3's Statement destructor calls
+# RemoveEnvironmentCleanupHook after the Environment is gone, tripping
+# `Assertion failed: (env) != nullptr` and killing the process with SIGABRT.
+# In CI that surfaced as vitest workers dying mid-run, taking whole test files
+# with them and dropping coverage below the gate — with no code change to
+# explain it, because a floating `'24'` pin picks up each new patch release.
+# Pinned until better-sqlite3 adapts to the new hook contract; verified locally
+# under both versions (24.19.0: 4-6 workers killed per run; 24.18.0: none).
+env:
+  NODE_VERSION: '24.18.0'
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
@@ -46,7 +59,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-node@v4
         with:
-          node-version: '24'
+          node-version: ${{ env.NODE_VERSION }}
       - name: Lint commit messages (release notes are generated from them)
         run: node scripts/commit-lint.mjs "origin/${{ github.base_ref }}" HEAD
 
@@ -105,7 +118,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '24'
+          node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
 
       - name: Install dependencies
@@ -302,7 +315,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '24'
+          node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
 
       - name: Install dependencies

.github/workflows/deploy-site.yml

@@ -24,6 +24,20 @@ on:
   workflow_dispatch:
 
 # Allow the GITHUB_TOKEN to deploy to Pages via OIDC.
+
+# Node 24.19.0 shipped nodejs/node#63642 ("src: add cleanup hooks to
+# node::ObjectWrap"), which makes NAN-style ObjectWrap addons abort during
+# environment teardown: better-sqlite3's Statement destructor calls
+# RemoveEnvironmentCleanupHook after the Environment is gone, tripping
+# `Assertion failed: (env) != nullptr` and killing the process with SIGABRT.
+# In CI that surfaced as vitest workers dying mid-run, taking whole test files
+# with them and dropping coverage below the gate — with no code change to
+# explain it, because a floating `'24'` pin picks up each new patch release.
+# Pinned until better-sqlite3 adapts to the new hook contract; verified locally
+# under both versions (24.19.0: 4-6 workers killed per run; 24.18.0: none).
+env:
+  NODE_VERSION: '24.18.0'
+
 permissions:
   contents: read
   pages: write
@@ -50,7 +64,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '24'
+          node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
 
       - name: Install dependencies

.github/workflows/notarize-finalize.yml

@@ -36,6 +36,19 @@ on:
         default: stable
         type: string
 
+# Node 24.19.0 shipped nodejs/node#63642 ("src: add cleanup hooks to
+# node::ObjectWrap"), which makes NAN-style ObjectWrap addons abort during
+# environment teardown: better-sqlite3's Statement destructor calls
+# RemoveEnvironmentCleanupHook after the Environment is gone, tripping
+# `Assertion failed: (env) != nullptr` and killing the process with SIGABRT.
+# In CI that surfaced as vitest workers dying mid-run, taking whole test files
+# with them and dropping coverage below the gate — with no code change to
+# explain it, because a floating `'24'` pin picks up each new patch release.
+# Pinned until better-sqlite3 adapts to the new hook contract; verified locally
+# under both versions (24.19.0: 4-6 workers killed per run; 24.18.0: none).
+env:
+  NODE_VERSION: '24.18.0'
+
 permissions:
   contents: write
 
@@ -57,7 +70,7 @@ jobs:
           version: 10
       - uses: actions/setup-node@v4
         with:
-          node-version: '24'
+          node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.github/workflows/notarize-poll.yml

@@ -13,6 +13,19 @@ on:
     - cron: '13,43 * * * *'
   workflow_dispatch: {}
 
+# Node 24.19.0 shipped nodejs/node#63642 ("src: add cleanup hooks to
+# node::ObjectWrap"), which makes NAN-style ObjectWrap addons abort during
+# environment teardown: better-sqlite3's Statement destructor calls
+# RemoveEnvironmentCleanupHook after the Environment is gone, tripping
+# `Assertion failed: (env) != nullptr` and killing the process with SIGABRT.
+# In CI that surfaced as vitest workers dying mid-run, taking whole test files
+# with them and dropping coverage below the gate — with no code change to
+# explain it, because a floating `'24'` pin picks up each new patch release.
+# Pinned until better-sqlite3 adapts to the new hook contract; verified locally
+# under both versions (24.19.0: 4-6 workers killed per run; 24.18.0: none).
+env:
+  NODE_VERSION: '24.18.0'
+
 permissions:
   contents: write
 
@@ -33,7 +46,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '24'
+          node-version: ${{ env.NODE_VERSION }}
       - name: Scan for a pending release and poll it once
         id: scan
         run: |

.github/workflows/release.yml

@@ -26,6 +26,20 @@ on:
 # A re-push of the same tag is rare but happens (e.g., draft release re-cut).
 # Deduplicate retries on the same tag, but never cancel a mid-flight macOS
 # notarize — that wastes 10x ubuntu-equivalent minutes.
+
+# Node 24.19.0 shipped nodejs/node#63642 ("src: add cleanup hooks to
+# node::ObjectWrap"), which makes NAN-style ObjectWrap addons abort during
+# environment teardown: better-sqlite3's Statement destructor calls
+# RemoveEnvironmentCleanupHook after the Environment is gone, tripping
+# `Assertion failed: (env) != nullptr` and killing the process with SIGABRT.
+# In CI that surfaced as vitest workers dying mid-run, taking whole test files
+# with them and dropping coverage below the gate — with no code change to
+# explain it, because a floating `'24'` pin picks up each new patch release.
+# Pinned until better-sqlite3 adapts to the new hook contract; verified locally
+# under both versions (24.19.0: 4-6 workers killed per run; 24.18.0: none).
+env:
+  NODE_VERSION: '24.18.0'
+
 concurrency:
   group: release-${{ inputs.version || github.ref_name }}
   cancel-in-progress: false
@@ -53,7 +67,7 @@ jobs:
           fetch-tags: true
       - uses: actions/setup-node@v4
         with:
-          node-version: '24'
+          node-version: ${{ env.NODE_VERSION }}
       - name: Build notes from conventional commits
         id: notes
         env:
@@ -181,7 +195,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '24'
+          node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
 
       - name: Install Rust
@@ -513,7 +527,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '24'
+          node-version: ${{ env.NODE_VERSION }}
       - name: Download notary submission ids from the draft release
         run: |
           set -euo pipefail

.github/workflows/test-build.yml

@@ -34,6 +34,19 @@ on:
           - linux
           - all
 
+# Node 24.19.0 shipped nodejs/node#63642 ("src: add cleanup hooks to
+# node::ObjectWrap"), which makes NAN-style ObjectWrap addons abort during
+# environment teardown: better-sqlite3's Statement destructor calls
+# RemoveEnvironmentCleanupHook after the Environment is gone, tripping
+# `Assertion failed: (env) != nullptr` and killing the process with SIGABRT.
+# In CI that surfaced as vitest workers dying mid-run, taking whole test files
+# with them and dropping coverage below the gate — with no code change to
+# explain it, because a floating `'24'` pin picks up each new patch release.
+# Pinned until better-sqlite3 adapts to the new hook contract; verified locally
+# under both versions (24.19.0: 4-6 workers killed per run; 24.18.0: none).
+env:
+  NODE_VERSION: '24.18.0'
+
 permissions:
   contents: write
 
@@ -87,7 +100,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '24'
+          node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
 
       - name: Install Rust