Update dependency node-gyp to v12.4.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
node-gyp	12.3.0 → 12.4.0

---

Release Notes

nodejs/node-gyp (node-gyp)

v12.4.0

Compare Source

Features

• update gyp-next to v0.22.2 (#​3316) (8ea71e5)

Bug Fixes

• retry downloads on retryable errors (#​3308) (0793489)
• stop testing end-of-life Node.js v20 (#​3315) (5c0ec47)
• test on Node.js v26 (#​3314) (0e65639)

Miscellaneous

• add workflow_dispatch trigger to tests workflow (#​3299) (b2fcdcd)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fossabot]

[fossabot]

Needs Review

I recommend reviewing this upgrade before merging because the new node-gyp release has dropped testing support for Node.js v20 (treating it as end-of-life), yet the project explicitly targets "node": ">=20" in package.json and the runtime context confirms the project runs on Node 20. CI environments or developer machines running Node 20.0–20.16 may encounter build failures when compiling the native addon required by @​abandonware/bluetooth-hci-socket. Additionally, two active supply-chain threats targeting the node-gyp ecosystem were identified this week — a self-propagating npm worm ('Miasma/Phantom Gyp') exploiting binding.gyp expansion at install time, and a typosquatting package (node-gyp-runtime) masquerading as this tool — warranting heightened vigilance. Teams should verify their Node.js runtime version meets the new minimum before merging, audit transitive binding.gyp files in the dependency tree, and confirm node-gyp-runtime is not present in any lockfile. On the positive side, the upgrade ships download retry logic, an updated build system backend, and refreshed Python tooling, none of which introduce breaking API changes.

Tip: Comment @​fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 3 fixable issues in this upgrade.

• Verify that CI and developer environments run Node.js >=20.17 or Node.js >=22. The node-gyp 12.4.0 release dropped CI testing for Node.js v20 (treating it as EOL), but the project's package.json declares '"node": ">=20"'. If CI uses Node 20.0–20.16, native addon compilation (for @​abandonware/bluetooth-hci-socket) may fail. Either (a) update the engines field in package.json to '"node": ">=20.17"' to match the new effective minimum, or (b) ensure all CI matrix entries and developer toolchains use Node >=20.17.
  Files: package.json
• Audit the lockfile for the malicious typosquatting package 'node-gyp-runtime'. Run: grep -r 'node-gyp-runtime' package-lock.json yarn.lock npm-shrinkwrap.json 2>/dev/null || echo 'Not found'. If any match is found, immediately remove it and investigate how it entered the dependency tree. Manually: open the lockfile(s) and search for the string 'node-gyp-runtime'.
  Run: grep -r 'node-gyp-runtime' package-lock.json yarn.lock npm-shrinkwrap.json 2>/dev/null || echo 'Not found - safe'
  Files: package-lock.json
• Audit transitive dependencies for suspicious binding.gyp files related to the Miasma/Phantom Gyp supply-chain campaign. Run: find node_modules -name 'binding.gyp' -exec grep -l 'exec|spawn|child_process|curl|wget|http' {} ; to identify any binding.gyp files with suspicious command expansion. Manually: list all binding.gyp files in node_modules and inspect them for outbound network calls or command execution beyond normal compilation.
  Run: find node_modules -name 'binding.gyp' -exec grep -l 'exec\|spawn\|child_process\|curl\|wget\|http' {} \;
  Files: package.json

AI Assistant Prompt

Copy prompt for AI assistant

# Fix dependency upgrade issues: node-gyp 12.4.0 in minidrone-js (PR #173)

## Context
`node-gyp` was updated to 12.4.0. This is a build-time dependency used to compile native C/C++ addons for `@​abandonware/bluetooth-hci-socket` (Bluetooth HCI communication for drone control). The upgrade adds download retry logic and Node.js 26 support via an updated `gyp-next` backend. No breaking API changes, but there are compatibility and supply-chain concerns.

## Issue 1: Node.js version compatibility (manual decision needed)

`node-gyp` 12.4.0 dropped CI testing for Node.js v20 (treating it as EOL). This project's `package.json` declares `"node": ">=20"`, but the effective minimum is now `>=20.17` for reliable native addon compilation.

**Action:** Update the `engines` field in `package.json` to reflect the new effective minimum:

```json
"engines": {
  "node": ">=20.17"
}
```

Alternatively, if you want to jump to the next LTS line:
```json
"engines": {
  "node": ">=22"
}
```

Also update any CI matrix configurations to ensure no jobs run on Node 20.0–20.16.

**File:** `package.json`

---

## Issue 2: Audit lockfile for malicious typosquatting package

An active typosquatting campaign uses a package called `node-gyp-runtime` that masquerades as `node-gyp`. Verify it is NOT present in the dependency tree.

**Action:** Run these commands and report the results:

```bash
grep -r 'node-gyp-runtime' package-lock.json yarn.lock npm-shrinkwrap.json 2>/dev/null || echo 'Not found - safe'
```

If any match is found, immediately remove it, regenerate the lockfile, and investigate how it entered the tree.

**File:** `package-lock.json`

---

## Issue 3: Audit binding.gyp files for supply-chain threats

The "Miasma/Phantom Gyp" campaign (June 2026) exploits `binding.gyp` command expansion during `npm install`. Since this project uses `@​abandonware/bluetooth-hci-socket` (which has native bindings), audit for suspicious files.

**Action:** Run this command and review the output:

```bash
find node_modules -name 'binding.gyp' -exec grep -l 'exec\|spawn\|child_process\|curl\|wget\|http' {} \;
```

Expected: Only legitimate compilation commands from `@​abandonware/bluetooth-hci-socket` and its known sub-dependencies should appear. Flag anything with outbound network calls, shell command execution, or references to unknown URLs.

---

## Summary of changes needed

| Priority | File | Change |
|----------|------|--------|
| High | `package.json` | Update `engines.node` from `>=20` to `>=20.17` (or `>=22`) |
| High | `package-lock.json` | Confirm `node-gyp-runtime` is absent |
| Medium | `node_modules/**/binding.gyp` | Audit for suspicious command expansion |

Please make the `package.json` engines change and run both audit commands, reporting back what you find.

What we checked

• node-gyp is declared as a devDependency at "^12.0.0" — the new version's CI workflow dropped Node.js v20 support (treating it as EOL), creating a potential mismatch with the project's declared "node": ">=20" engine requirement on line 11. ^[1]
• Project engine constraint is "node": ">=20", but the runtime context flags that new dependencies require Node 20.17 or Node 22. Developers or CI agents on Node 20.0–20.16 may fail to compile native addons. ^[2]
• @​abandonware/noble (and transitively @​abandonware/bluetooth-hci-socket) is the runtime driver behind node-gyp usage in this project — it compiles native Bluetooth HCI socket bindings. The Miasma/Phantom Gyp campaign (June 3–4, 2026) specifically targets packages with binding.gyp files; this transitive dependency should be audited for unexpected outbound network activity at install time. ^[3]
• Active supply chain campaign ('Miasma / Phantom Gyp') exploits binding.gyp command expansion to run malicious payloads during npm install when node-gyp rebuild is invoked. 57 packages with hundreds of compromised versions were identified June 3–4, 2026. Projects with native addon dependencies (like this one) should audit their binding.gyp files and monitor for unexpected network calls at install time. ^[4]
• Malicious package node-gyp-runtime is a typosquatting impersonator of node-gyp deploying a persistent Windows agent with credential harvesting. This project correctly depends on the canonical node-gyp package, but developers should verify node-gyp-runtime does not appear in any lockfile or transitive dependency tree. ^[5]

Dependency Usage

node-gyp is declared as a direct dependency in package.json and is transitively pulled in by @​abandonware/bluetooth-hci-socket, a native Bluetooth communication module — indicating this project interfaces with hardware (likely drones) over Bluetooth at a low level. The dependency serves as a build-time tool for compiling native C/C++ Node.js addons required for Bluetooth HCI socket access, and is not imported directly in application code. Its presence is entirely infrastructure-driven, enabling the native hardware communication layer that underlies the project's core drone control functionality.

Changes

node-gyp was updated with two notable improvements: download retries are now automatically attempted (up to 3 times) via a RetryAgent wrapper in download.js, and Node.js 26 is now officially supported with an updated gyp-next build system dependency.

• add workflow_dispatch trigger to tests workflow (#3299) (b2fcdcd) (v12.3.0-12.4.0, changelog)
• update gyp-next to v0.22.2 (#3316) (8ea71e5) (v12.3.0-12.4.0, changelog)
• retry downloads on retryable errors (#3308) (0793489) (v12.3.0-12.4.0, changelog)

View 15 more changes

• stop testing end-of-life Node.js v20 (#3315) (5c0ec47) (v12.3.0-12.4.0, changelog)
• test on Node.js v26 (#3314) (0e65639) (v12.3.0-12.4.0, changelog)
• add workflow_dispatch trigger to tests workflow (#3299) (b2fcdcd) (v12.4.0, changelog)
• Add workflow_dispatch trigger to tests workflow (v12.3.0-12.4.0, commit)
• Add support for Node.js 26 (v12.3.0-12.4.0, commit)
• Update gyp-next to v0.22.2 (v12.3.0-12.4.0, commit)
• Stop testing end-of-life Node.js v20 (v12.3.0-12.4.0, commit)
• Retry downloads on retryable errors (v12.3.0-12.4.0, commit)
• Retry downloads on retryable errors - Added RetryAgent wrapper with maxRetries: 3 to automatically retry failed downloads in download.js (v12.4.0, package source)
• Updated gyp-next to v0.22.2 for improved build system support (v12.4.0, package source)
• Updated setuptools dependency in gyp/pyproject.toml from >=69.5.1 to >=77.0.3 (v12.4.0, package source)
• Updated license metadata format in gyp/pyproject.toml from file-based to inline BSD-3-Clause declaration (v12.4.0, package source)
• Removed deprecated 'License :: OSI Approved :: BSD License' classifier from gyp/pyproject.toml (v12.4.0, package source)
• Updated test workflow to support Node.js v26 and stopped testing end-of-life Node.js v20 (v12.4.0, package source)
• Added workflow_dispatch trigger to tests workflow for manual test runs (v12.4.0, package source)

References (5)

[1]: node-gyp is declared as a devDependency at "^12.0.0" — the new version's CI workflow dropped Node.js v20 support (treating it as EOL), creating a potential mismatch with the project's declared "node": ">=20" engine requirement on line 11.

minidrone-js/package.json

Line 36 in aba06f0

"node-gyp": "^12.0.0",

[2]: Project engine constraint is "node": ">=20", but the runtime context flags that new dependencies require Node 20.17 or Node 22. Developers or CI agents on Node 20.0–20.16 may fail to compile native addons.

minidrone-js/package.json

Line 11 in aba06f0

"node": ">=20"

[3]: @​abandonware/noble (and transitively @​abandonware/bluetooth-hci-socket) is the runtime driver behind node-gyp usage in this project — it compiles native Bluetooth HCI socket bindings. The Miasma/Phantom Gyp campaign (June 3–4, 2026) specifically targets packages with binding.gyp files; this transitive dependency should be audited for unexpected outbound network activity at install time.

minidrone-js/package.json

Line 21 in aba06f0

"@abandonware/noble": "^1.9.2-23",

[4]: Active supply chain campaign ('Miasma / Phantom Gyp') exploits binding.gyp command expansion to run malicious payloads during npm install when node-gyp rebuild is invoked. 57 packages with hundreds of compromised versions were identified June 3–4, 2026. Projects with native addon dependencies (like this one) should audit their binding.gyp files and monitor for unexpected network calls at install time. (source link)

[5]: Malicious package node-gyp-runtime is a typosquatting impersonator of node-gyp deploying a persistent Windows agent with credential harvesting. This project correctly depends on the canonical node-gyp package, but developers should verify node-gyp-runtime does not appear in any lockfile or transitive dependency tree. (source link)

---

fossabot analyzed this PR using dependency research. View this analysis on the web