Skip to content

fix: require patched Node.js 22.23.4 for October security fixes - #1388

Open
JordyDutch wants to merge 1 commit into
mainfrom
fix/node-october-2026-security
Open

JordyDutch wants to merge 1 commit into
mainfrom
fix/node-october-2026-security

Conversation

@JordyDutch

@JordyDutch JordyDutch commented Oct 22, 2026 •

Copy link
Copy Markdown
Collaborator

The documentation site now uses patched Node.js 22.23.4 for local tooling and all active workflows that directly invoke Yarn or npm, replacing the previous Node 18 minimum and Node 20 selectors.

Add .nvmrc, update asdf, constrain package engines to >=22.23.4 <23, and document the requirement in the README. Pin both main CI jobs and add explicit Node setup before the spellcheck workflow installs dependencies and the tools-sync workflow invokes npm. The temporarily disabled contracts-sync workflow remains disabled.

This follows the official October 2026 Node.js security bulletin. Package-manager versions, dependencies and the Yarn lockfile are preserved.

Validation under Node 22.23.4:

  • Immutable Yarn installation passed with dependency lifecycle scripts disabled.
  • The repository Prettier check passed.
  • Production Docusaurus build passed.
  • Workflow YAML parsing, engine boundaries, dependency preservation and git diff --check passed.

Remote codespell failed on the pre-existing typo in docs/learn/universal-profile/universal-receiver/accept-reject-assets.md:56 (puprose -> purpose); the entire file is identical to the base commit. Documentation-sync and deployment commands were not run locally. Existing build warnings do not prevent successful production compilation. This change establishes repository-controlled runtime selection; hosted platform runtime patch levels still require separate verification.

Draft pending the mandatory independent provider review. No deployment or live runtime upgrade has been verified.

@JordyDutch
JordyDutch marked this pull request as ready for review October 22, 2026 09:43
@github-actions

Copy link
Copy Markdown
Contributor

Deployed with Cloudflare Pages ☁️ 🚀 🆗

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant