Skip to content

chore: pin node - #363

Merged
paolodamico merged 2 commits into
mainfrom
pdc/patch-node-security
Oct 23, 2026
Merged

paolodamico merged 2 commits into
mainfrom
pdc/patch-node-security

Conversation

@paolodamico

@paolodamico paolodamico commented Oct 22, 2026 •

Copy link
Copy Markdown
Collaborator

Note

Low Risk
Workflow-only Node version pins; initiate-release upgrades from Node 18 to 22.23.4, which could surface script compatibility issues but does not change application runtime code.

Overview
Pins exact Node.js patch versions across GitHub Actions so CI, conformance, release initiation, and npm publish jobs no longer float on major-only labels like "22" or "24".

Build and test workflows (ci.yml, js-conformance.yml conformance/hermes/packages build steps) now use 22.23.4. The package consumption matrix tests Node 18 (unchanged), 22.23.4, and 24.22.1 instead of "22" / "24", and Playwright/portable runtime steps key off matrix.node == '22.23.4'.

Release initiation (initiate-release.yml) moves from Node 18 to 22.23.4 for version-bump scripts. Publish workflows (publish-js.yml, publish-react.yml, publish-server.yml) pin the publish runner to 24.22.1.

Reviewed by Cursor Bugbot for commit f234ac4. Bugbot is set up for automated code reviews on this repo. Configure here.

@vercel

vercel Bot commented Oct 22, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
idkit-js-example Ready Ready Preview Oct 22, 2026 7:47pm UTC

Request Review

@paolodamico paolodamico changed the title fix: patch Node.js security vulnerabilities chore: pin node Oct 22, 2026
@paolodamico
paolodamico marked this pull request as ready for review October 22, 2026 19:39
@cursor

cursor Bot commented Oct 22, 2026

Copy link
Copy Markdown

Current version of PR was reviewed by /review-bugbot on Oct 22, 18:55 UTC. It flagged 0 findings.

Bugbot on commit 5747a2c is skipped.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 22, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-22T19:41:51.948865Z 5747a2c Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5747a2c1b7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread js/examples/nextjs/package.json Outdated
"type": "module",
"engines": {
"node": "24.x"
"node": "24.22.1"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep the Vercel runtime on a major-version range

When Vercel automatically rolls Node 24 to its next patch, this exact engine stops matching the runtime used by the deployed Next.js example, and the corepack pnpm install command in vercel.json will fail with an unsupported-engine error before the build. Vercel only makes major versions selectable and explicitly warns for major.minor.patch engine values, so retain 24.x here and pin local/CI tooling separately. See Vercel's runtime documentation and the corresponding Vercel version-selection code.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in f234ac4. Restored 24.x for the Vercel example; CI and release workflows retain exact security-patch pins. Verified the range accepts Node 24 patch/minor updates and rejects other majors, and the example's frozen-lockfile install passes on Node 24.22.1.

@paolodamico
paolodamico merged commit 4d7c2db into main Oct 23, 2026
24 checks passed

This branch was successfully deployed

1 active deployment
Preview — f234ac46 Deployed Oct 22, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants