icu.js: link ICU dynamically on Alpine too (musl static is non-PIC)

Alpine's icu-static (libicuuc.a) is NOT built with -fPIC, so it can't link
into the .node shared object — the alpine prebuild failed with the same
"recompile with -fPIC" error as glibc. Correcting my earlier assumption that
musl static archives are PIC.

Static ICU is therefore only viable on macOS (Homebrew). Link ICU dynamically
on ALL Linux (glibc + Alpine); the runtime image must provide ICU
(`apk add icu-libs` in the zero-cache Alpine image).

- icu.js: useStatic = isMac only; drop the Alpine static branch.
- build.yml: drop `icu-static` from the alpine prebuild apk installs (icu-dev
  provides the headers and the .so we now link against).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: arv

.github/workflows/build.yml

@@ -14,11 +14,11 @@ on:
 
 env:
   # See https://github.com/nodejs/release#release-schedule
-  # Node.js v20 EOL = 2026-04-30. v22 EOL = 2027-04-30. v23 EOL = 2025-06-01. v24 EOL = 2028-04-30. v25 EOL = 2026-06-01.
-  # Node.js 20-24 can build with GCC 10 (bullseye)
-  NODE_BUILD_CMD_LEGACY: npx --no-install prebuild -r node -t 20.0.0 -t 22.0.0 -t 23.0.0 -t 24.0.0 --include-regex '_sqlite3'
+  # Node.js v22 EOL = 2027-04-30. v23 EOL = 2025-06-01. v24 EOL = 2028-04-30. v25 EOL = 2026-06-01. v26 EOL = 2029-04-30.
+  # Node.js 22-24 can build with GCC 10 (bullseye)
+  NODE_BUILD_CMD_LEGACY: npx --no-install prebuild -r node -t 22.0.0 -t 23.0.0 -t 24.0.0 --include-regex '_sqlite3'
   # Node.js 25+ requires GCC 11+ for <source_location> header (bookworm)
-  NODE_BUILD_CMD_MODERN: npx --no-install prebuild -r node -t 25.0.0 --include-regex '_sqlite3'
+  NODE_BUILD_CMD_MODERN: npx --no-install prebuild -r node -t 25.0.0 -t 26.0.0 --include-regex '_sqlite3'
 
 jobs:
   test:
@@ -31,11 +31,10 @@ jobs:
           - macos-15-intel
           - windows-2022
         node:
-          - 20
           - 22
-          - 23
           - 24
           - 25
+          - 26
     name: Testing Node ${{ matrix.node }} on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     steps:
@@ -137,7 +136,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: 20
+          node-version: 22
           registry-url: https://registry.npmjs.org
       - name: Upgrade npm for OIDC support
         run: npm install -g npm@latest
@@ -161,7 +160,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: 20
+          node-version: 22
       - if: ${{ startsWith(matrix.os, 'windows') }}
         run: pip.exe install setuptools
       - if: ${{ startsWith(matrix.os, 'macos') }}
@@ -182,7 +181,7 @@ jobs:
       contents: write # prebuild -u uploads the .node assets to the GitHub release
     name: Prebuild on Linux x64
     runs-on: ubuntu-latest
-    container: node:20-bullseye
+    container: node:22-bullseye
     needs: test
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -196,7 +195,7 @@ jobs:
       contents: write # prebuild -u uploads the .node assets to the GitHub release
     name: Prebuild on Linux x64 (Node 25+)
     runs-on: ubuntu-latest
-    container: node:20-bookworm
+    container: node:22-bookworm
     needs: test
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -210,11 +209,11 @@ jobs:
       contents: write # prebuild -u uploads the .node assets to the GitHub release
     name: Prebuild on alpine
     runs-on: ubuntu-latest
-    container: node:20-alpine
+    container: node:22-alpine
     needs: test
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - run: apk add build-base git python3 py3-setuptools libstdc++ readline-dev ncurses-dev icu-dev icu-static --update-cache
+      - run: apk add build-base git python3 py3-setuptools libstdc++ readline-dev ncurses-dev icu-dev --update-cache
       - run: npm install --ignore-scripts
       - run: ${{ env.NODE_BUILD_CMD_LEGACY }} -u ${{ secrets.GITHUB_TOKEN }}
       - run: ${{ env.NODE_BUILD_CMD_MODERN }} -u ${{ secrets.GITHUB_TOKEN }}
@@ -236,8 +235,8 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
       - run: |
-          docker run --rm -v $(pwd):/tmp/project --entrypoint /bin/sh --platform linux/${{ matrix.arch }} node:20-alpine -c "\
-          apk add build-base git python3 py3-setuptools libstdc++ readline-dev ncurses-dev icu-dev icu-static --update-cache && \
+          docker run --rm -v $(pwd):/tmp/project --entrypoint /bin/sh --platform linux/${{ matrix.arch }} node:22-alpine -c "\
+          apk add build-base git python3 py3-setuptools libstdc++ readline-dev ncurses-dev icu-dev --update-cache && \
           cd /tmp/project && \
           npm install --ignore-scripts && \
           ${{ env.NODE_BUILD_CMD_LEGACY }} -u ${{ secrets.GITHUB_TOKEN }} && \
@@ -260,7 +259,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
       - run: |
-          docker run --rm -v $(pwd):/tmp/project --entrypoint /bin/sh --platform linux/${{ matrix.arch }} node:20-bullseye -c "\
+          docker run --rm -v $(pwd):/tmp/project --entrypoint /bin/sh --platform linux/${{ matrix.arch }} node:22-bullseye -c "\
           apt-get update && apt-get install -y libicu-dev && \
           cd /tmp/project && \
           npm install --ignore-scripts && \
@@ -283,7 +282,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
       - run: |
-          docker run --rm -v $(pwd):/tmp/project --entrypoint /bin/sh --platform linux/${{ matrix.arch }} node:20-bookworm -c "\
+          docker run --rm -v $(pwd):/tmp/project --entrypoint /bin/sh --platform linux/${{ matrix.arch }} node:22-bookworm -c "\
           apt-get update && apt-get install -y libicu-dev && \
           cd /tmp/project && \
           npm install --ignore-scripts && \

.github/workflows/bump-version.yml

@@ -28,7 +28,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: 20
+          node-version: 22
       - name: Configure user
         run: |
           git config --local user.name "${{ github.actor }}"

.github/workflows/update-sqlite.yml

@@ -24,7 +24,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: 20
+          node-version: 22
       - name: Create new update branch
         run: git checkout -b sqlite-update-${{ env.ENV_VERSION }}
       - name: Update download script

README.md

@@ -4,6 +4,6 @@ So far the changes are:
 
 * Build the [bedrock](https://sqlite.org/src/timeline?r=bedrock) branch of SQLite to enable [`begin concurrent`](https://www.sqlite.org/src/doc/begin-concurrent/doc/begin_concurrent.md).
 * Create a shell too, so we can debug db files created
-* Supports both Node.js (20.x, 22.x, 23.x, 24.x) and Bun (>=1.1.0) runtimes
+* Supports both Node.js (22.x, 23.x, 24.x, 25.x, 26.x) and Bun (>=1.1.0) runtimes
 
 Other changes will be likely be made over time.

deps/icu.js

@@ -8,24 +8,23 @@
 // auto-registers Unicode-aware LIKE/upper()/lower()/REGEXP on every
 // connection. That code calls into ICU.
 //
-// We prefer STATIC linking so the prebuilt .node binaries stay self-contained:
-// zero-cache ships them via prebuild-install onto runtime images (e.g. Alpine)
-// that do not have ICU installed, and a dynamic NEEDED libicu*.so.<ver> would
-// fail to load there. Static linking is only possible where the ICU archives
-// are -fPIC, which holds on macOS (Homebrew) and Alpine (musl). Debian/Ubuntu
-// (glibc) ship non-PIC static archives, so there we link ICU dynamically
-// against the system .so (the consumer must have ICU installed at runtime).
-// See `useStatic` below.
+// We STATIC-link ICU where we can, so the prebuilt .node stays self-contained.
+// That is only possible where the ICU static archives are position-independent
+// (-fPIC) and can be linked into a shared object (the .node) — which in practice
+// is ONLY macOS (Homebrew). Both Linux flavors ship NON-PIC static archives:
+// Debian/Ubuntu (glibc) AND Alpine (musl) both fail with "recompile with -fPIC".
+// So on every Linux we link ICU dynamically against the system .so, and the
+// consumer must have ICU installed at runtime (e.g. `apk add icu-libs` in the
+// zero-cache Alpine image). See `useStatic` below.
 //
 // Usage:
 //   node icu.js include   -> the ICU include directory (for #include <unicode/...>)
 //   node icu.js libs       -> newline-separated linker inputs (static archive
 //                             paths or -L/-l flags), then the C++ runtime /
 //                             system libraries ICU depends on.
 //
-// Discovery order: pkg-config (Linux/Alpine) -> Homebrew icu4c (macOS) ->
-// common system locations. Set ICU_ROOT to override (expects ICU_ROOT/lib and
-// ICU_ROOT/include).
+// Discovery order: pkg-config (Linux) -> Homebrew icu4c (macOS) -> common system
+// locations. Set ICU_ROOT to override (expects ICU_ROOT/lib and ICU_ROOT/include).
 //
 // ICU is not enabled on Windows (see deps/sqlite3.gyp), so this script only
 // ever runs on macOS and Linux.
@@ -36,20 +35,15 @@ const fs = require('fs');
 const path = require('path');
 
 const isMac = process.platform === 'darwin';
-const isLinux = process.platform === 'linux';
-const isAlpine = isLinux && fs.existsSync('/etc/alpine-release');
-
-// We static-link ICU only where the static archives are position-independent
-// (-fPIC) and can therefore be linked into a shared object (the .node):
-//   * macOS  — Homebrew's icu4c archives are PIC.
-//   * Alpine — musl builds everything PIC, so icu-static is PIC.
-// Debian/Ubuntu (glibc) ship NON-PIC static archives (libicu*.a), which fail to
-// link into a shared object ("recompile with -fPIC"), so on glibc Linux we link
-// ICU dynamically against the distro .so instead — those consumers must have
-// ICU installed at runtime. ICU_ALLOW_DYNAMIC=1 forces dynamic everywhere as a
-// local-dev escape hatch.
-const useStatic =
-  (isMac || isAlpine) && process.env.ICU_ALLOW_DYNAMIC !== '1';
+
+// Static-link ICU only on macOS, the one platform whose static archives are
+// -fPIC and so can be linked into the .node shared object. Both Debian/Ubuntu
+// (glibc) and Alpine (musl) ship NON-PIC static archives (libicu*.a) that fail
+// with "relocation ... can not be used when making a shared object; recompile
+// with -fPIC", so on all Linux we link ICU dynamically against the system .so
+// and the consumer must have ICU at runtime. ICU_ALLOW_DYNAMIC=1 forces dynamic
+// even on macOS, as a local-dev escape hatch.
+const useStatic = isMac && process.env.ICU_ALLOW_DYNAMIC !== '1';
 
 function run(cmd) {
   try {
@@ -125,15 +119,14 @@ function staticLibInputs(loc) {
     if (full && fs.existsSync(full)) {
       return full;
     }
-    // On the static platforms (macOS, Alpine) a missing archive is fatal: we
-    // must not silently produce a dynamically-linked binary, since zero-cache
-    // ships these prebuilds onto images (e.g. Alpine) that have no ICU.
+    // macOS is the only static platform; a missing archive is fatal here (we
+    // must not silently fall back to a dynamic build that would change the
+    // shipped binary's behavior).
     fail(
       `static ICU archive ${name}.a not found in ${loc.libDir || '(unknown library dir)'}.\n` +
-        `  This platform links ICU statically to stay self-contained, so the build is aborting\n` +
-        `  rather than linking ICU dynamically. Install the static ICU libraries (icu-dev +\n` +
-        `  icu-static on Alpine, icu4c via Homebrew on macOS), or set ICU_ALLOW_DYNAMIC=1 to\n` +
-        `  allow a dynamic fallback for local development.`,
+        `  macOS links ICU statically to stay self-contained, so the build is aborting rather\n` +
+        `  than linking ICU dynamically. Install icu4c via Homebrew (brew install icu4c), or\n` +
+        `  set ICU_ALLOW_DYNAMIC=1 to allow a dynamic fallback for local development.`,
     );
     return null; // unreachable; fail() exits
   });

package.json

@@ -20,7 +20,7 @@
     "shell.js"
   ],
   "engines": {
-    "node": "20.x || 22.x || 23.x || 24.x || 25.x",
+    "node": "22.x || 23.x || 24.x || 25.x || 26.x",
     "bun": ">=1.1.0"
   },
   "types": "lib/index.d.ts",