chore(deps): update dependency @node-datachannel/linux-arm64-gnu to v0.33.4

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@node-datachannel/linux-arm64-gnu	0.33.2 → 0.33.4

---

Release Notes

murat-dogan/node-datachannel (@​node-datachannel/linux-arm64-gnu)

v0.33.4

Compare Source

What's Changed

• Add npm-artifacts folder to npmignore by @​longnguyen2004 in #​438
• build: bump libdatachannel to v0.24.5 (fixes intermittent DTLS handshake failures) by @​johnhenry in #​444

New Contributors

• @​johnhenry made their first contribution in #​444

Full Changelog: murat-dogan/node-datachannel@v0.33.1...v0.33.4

v0.33.3

Compare Source

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Only on Monday (* * * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	7242731
Status:	✅  Deploy successful!
Preview URL:	https://610860af.mouseterm.pages.dev
Branch Preview URL:	https://renovate-node-datachannel-li.mouseterm.pages.dev

View logs

[dormouse-bot]

Feedback on work in progress — this is a draft, so no merge verdict here.

Splitting this platform package out of its family breaks an invariant the repo states normatively, and Build & Test is already red on it.

The disclosure gate fails on every machine that isn't linux-arm64-gnu. optionalSiblingsAtSameVersion in website/scripts/generate-deps.js describes an uninstallable optional dependency from a sibling declared in the same optionalDependencies block at the identical version string — with @node-datachannel/linux-arm64-gnu alone at 0.33.4 and the other five still at 0.33.2, no sibling matches and the generator throws "…is not installed and neither is any sibling declared beside it at the same version, so it cannot be described". That's the Build & Test failure at the Dependency disclosure is current step. docs/specs/security-supply-chain.md → "Disclosure" carries the rule: "described from a sibling in the same optionalDependencies block at the same exact version string — published in lockstep, so the disclosure is identical on every machine."

The bump also doesn't change which binary loads. node-datachannel@0.33.2 declares its own optional '@node-datachannel/linux-arm64-gnu': 0.33.2 (see its snapshot in pnpm-lock.yaml), and per the comment in standalone/scripts/build-sidecar-proxy.mjs the addon "resolves its platform package and detect-libc relative to its own __dirname" — so on Linux arm64 the loader still picks up the 0.33.2 build nested under the wrapper, and the sidecar-root 0.33.4 copy rides along unused. The libdatachannel v0.24.5 DTLS-handshake fix these release notes advertise won't reach the running sidecar until node-datachannel itself moves.

Both point at the same resolution: the wrapper and all six platform pins have to move together, in one PR.

The durable fix is a Renovate group. renovate.json has no rule for this family, so one upstream release fans out into a PR per platform that each break the invariant independently — #637 and #639 fail Build & Test at 24s with the same step. The config already carries five lockstep groups (react, react-router, tailwindcss, storybook, vite, xterm) written for exactly this reason, and the lockstep property here is already stated in the supply-chain spec rather than being an inference. A sixth in the same shape would make Renovate open one PR that bumps node-datachannel and all six platform pins together:

{
  "description": "node-datachannel publishes the wrapper and one prebuilt package per platform from one repo at one version, and website/scripts/generate-deps.js describes an uninstallable platform package from a sibling declared at the SAME exact version string — so a split bump makes the disclosure generator throw on every machine that cannot install the bumped platform. The wrapper also resolves its platform package relative to its own __dirname, so bumping a platform pin without the wrapper ships a binary nothing loads. Keep them in one PR",
  "matchManagers": ["npm"],
  "matchPackageNames": ["node-datachannel", "@node-datachannel/**"],
  "groupName": "node-datachannel",
  "groupSlug": "node-datachannel",
  "separateMajorMinor": false
}

I can open that against main as its own PR if you want it — say the word and I'll push it. Renovate would then regenerate #637/#639/#640 as a single grouped PR on the next Monday window.