Repository navigation
fix: pin patched Node for development and CI - #23
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
sybohy
marked this pull request as ready for review
October 24, 2026 04:52
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pin shared CI/package-build tooling to 24.22.1, the existing 22/24 CI matrix to 22.23.4 / 24.22.1, and add
.nvmrcfor the patched default. Raise only the developer runtime range to the patched minima for CVE-2026-111497; consumerengines.node >=22.12.0is unchanged.The devcontainer uses Microsoft’s maintained Bookworm image and copies Node 24.22.1 from a digest-pinned official image into the system path and every inherited nvm binary. This replaces vulnerable inherited binaries as well as the default shell runtime.
Validation:
npm cipassed on SHA256-verified Node 24.22.1 without lockfile changes. Build, typecheck and the test passed locally. CI and the Vercel preview passed on the final commit, including install/test/lint/typecheck matrices on both patched majors. The corrected complete devcontainer built and reports v24.22.1 from login-shell PATH, direct/usr/local/bin/node, and nvm after sourcing its initialization script. All CI checks passed again on the final inherited-binary correction. No package publishing is performed by this task.Rollout handoff: rebuild development containers, use the new local selector, and let subsequent CI jobs install the patched binary. Verify hosted examples/docs and downstream Node servers separately. A tooling update does not patch consuming servers or require a browser bundle/CDN release. Vercel manages patches for supported majors; verify the effective runtime/provider rollout. No merge, release, provider setting change or production deployment was performed.
Required checks use stable major labels (
v22/v24). The matrix keeps those labels and separately selects exact patchedmatrix.node_versionbinaries, so future patch updates do not rename protected checks. The prior patch-number labels passed CI but could not satisfy the existing protection; this workflow-only correction passed all CI checks and the Vercel preview. No branch protection/settings were changed.