Thanks for reporting. Will be fixed in a few minutes.

Completed working base repository with developer workflows for watching files and rebuilding/retesting:
https://github.com/anthumchris/node-addon

You mean ask ldv to renew it? Sure, can do, but we often want to check sigs that were valid at the time but are now expired (sometimes upstreams are not reachable anymore).

• --experimental-addon-modules stability for javascript ESM import syntax

Fixed in 2.5.16

What about prolonging the expired key?

Also fixed in the other active branches.

man gpg has a WARNING section right below the RETURN Value section. The 3rd paragraph gives hints on how to use gpg with scripts etc:

The int-truncation change breaks other things. I noticed this by chance in the interactive mode due to warning noticed. Before we ever do such things again we need to have regression tests for setting preferences. Or manually check everything. Need to do a 2.5.16 tomorrow :-(

https://www.gnupg.org/gph/en/manual/x135.html could benefit from the same treatment under "Clearsigned documents".

Note using the output of --decrypt directly on the tty is a Bad Idea(tm). You won't cat arbitrary files to your tty for the same reason.

https://gnupg.org/blog/20251226-cleartext-signatures.html explains why we have cleartext signatures and how you properly use them. The suggestion of the reporters to remove them entirely is a no-go because there are too many systems (open source or in-house) which rely on that format. If properly used (i.e. using --output to get the signed text) there is no problem. Anyway the suggestion has always been to use detached signatures using two files or PGP/MIME).