Merge release/17.9 into dev

.buildpacks

@@ -1,2 +1,2 @@
-https://github.com/heroku/heroku-buildpack-nodejs.git#v356
+https://github.com/heroku/heroku-buildpack-nodejs.git#v375
 https://github.com/pkgr/heroku-buildpack-ruby.git#v356-1

.github/workflows/eslint-core.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '24.18.0'
+          node-version: '24.22.1'
           package-manager-cache: false
           cache: npm
           cache-dependency-path: |

.github/workflows/hocuspocus-test.yml

@@ -26,7 +26,7 @@ jobs:
 
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '24.18.0'
+          node-version: '24.22.1'
           package-manager-cache: false
           cache: npm
           cache-dependency-path: extensions/op-blocknote-hocuspocus/package-lock.json

.github/workflows/npm-audit.yml

@@ -37,7 +37,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '24.18.0'
+          node-version: '24.22.1'
           package-manager-cache: false
 
       - name: Required git config

.github/workflows/op-blocknote-extensions-publish.yml

@@ -31,7 +31,7 @@ jobs:
 
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '24.18.0'
+          node-version: '24.22.1'
           registry-url: 'https://registry.npmjs.org'
           package-manager-cache: false
 

.github/workflows/op-blocknote-extensions-test.yml

@@ -26,7 +26,7 @@ jobs:
 
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '24.18.0'
+          node-version: '24.22.1'
           package-manager-cache: false
           cache: npm
           cache-dependency-path: extensions/blocknote-extensions/package-lock.json
@@ -51,7 +51,7 @@ jobs:
 
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '24.18.0'
+          node-version: '24.22.1'
           package-manager-cache: false
           cache: npm
           cache-dependency-path: extensions/blocknote-extensions/package-lock.json

.github/workflows/openapi.yaml

@@ -29,6 +29,6 @@ jobs:
           bundler-cache: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "24.18.0"
+          node-version: "24.22.1"
           package-manager-cache: false
       - run: ./script/api/validate_spec

.github/workflows/test-frontend-unit.yml

@@ -62,7 +62,7 @@ jobs:
 
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '24.18.0'
+          node-version: '24.22.1'
           package-manager-cache: false
 
       - name: Install Dependencies
@@ -100,7 +100,7 @@ jobs:
 
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '24.18.0'
+          node-version: '24.22.1'
           package-manager-cache: false
 
       - name: Install Dependencies

AGENTS.md

@@ -8,7 +8,7 @@
 
 - **Size**: Large monorepo (~840MB, ~1M+ lines of code)
 - **Backend**: Ruby 4.0.7, Rails ~8.1.3
-- **Frontend**: Node.js 24.x (>= 24.15.0), npm 11.x, TypeScript
+- **Frontend**: Node.js 24.x (>= 24.22.1), npm 11.x, TypeScript
 - **Database**: PostgreSQL (required)
 - **Architecture**: Server-rendered HTML with Hotwire (Turbo + Stimulus). Legacy Angular components exist and are being migrated to custom elements. Uses GitHub's Primer Design System via ViewComponent.
 - **Editions**: Community, Enterprise (SSO, LDAP, SCIM), and BIM (construction industry, code in `modules/bim/`)
@@ -17,7 +17,7 @@
 
 **ALWAYS verify versions before building:**
 - Ruby: `4.0.7` (see `.ruby-version`)
-- Node: `^24.15.0` (see `package.json` engines)
+- Node: `^24.22.1` (see `package.json` engines)
 - Bundler: `4.0.21` (see `BUNDLED WITH` in `Gemfile.lock`)
 
 ### Local Development Setup

docker/ci/Dockerfile

@@ -2,7 +2,7 @@
 ARG RUBY_VERSION
 FROM ruby:${RUBY_VERSION}-trixie
 
-ENV NODE_VERSION="24.18.0"
+ENV NODE_VERSION="24.22.1"
 ENV DEBIAN_FRONTEND=noninteractive
 ENV BUNDLE_WITHOUT="development:production:docker"
 

docker/dev/frontend/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.18.0
+FROM node:24.22.1
 LABEL org.opencontainers.image.authors="operations@openproject.com"
 
 ARG DEV_UID=1000

docker/prod/Dockerfile

@@ -6,7 +6,7 @@ ARG BUILDKIT_SBOM_SCAN_STAGE=true
 FROM ruby:${RUBY_VERSION}-slim-trixie AS runtime-base
 LABEL maintainer="operations@openproject.com"
 
-ARG NODE_VERSION="24.19.0"
+ARG NODE_VERSION="24.22.1"
 # npm bundled with node lags behind on patches for its vendored deps (e.g. tar)
 ARG NPM_VERSION="11.19.0"
 ARG BIM_SUPPORT=true
@@ -63,7 +63,7 @@ COPY ./docker/prod/setup/preinstall-common.sh ./docker/prod/setup/preinstall-com
 RUN ./docker/prod/setup/preinstall-common.sh
 
 FROM runtime-base AS build-base
-ARG NODE_VERSION="24.19.0"
+ARG NODE_VERSION="24.22.1"
 ARG NPM_VERSION="11.19.0"
 
 # build-only dependencies

docs/development/development-environment/linux/README.md

@@ -161,11 +161,11 @@ git clone https://github.com/nodenv/node-build.git $(nodenv root)/plugins/node-b
 
 You can find the latest LTS version here: [nodejs.org/en/download/](https://nodejs.org/en/download/)
 
-At the time of writing this is v24.18.0 Install and activate it with:
+At the time of writing this is v24.22.1 Install and activate it with:
 
 ```shell
-nodenv install 24.18.0
-nodenv global 24.18.0
+nodenv install 24.22.1
+nodenv global 24.22.1
 nodenv rehash
 ```
 
@@ -187,7 +187,7 @@ bundler --version
 4.0.21
 
 node --version
-v24.18.0
+v24.22.1
 
 npm --version
 11.16.0

docs/development/development-environment/macos/README.md

@@ -115,11 +115,11 @@ nodenv init
 
 You can find the latest LTS version here: [nodejs.org/en/download](https://nodejs.org/en/download/)
 
-At the time of writing this is v24.18.0. Install and activate it with:
+At the time of writing this is v24.22.1. Install and activate it with:
 
 ```shell
-nodenv install 24.18.0
-nodenv global 24.18.0
+nodenv install 24.22.1
+nodenv global 24.22.1
 ```
 
 #### Update NPM to the latest version
@@ -140,7 +140,7 @@ $ bundler --version
 4.0.21
 
 node --version
-v24.18.0
+v24.22.1
 
 npm --version
 11.16.0

docs/installation-and-operations/installation/manual/README.md

@@ -137,15 +137,15 @@ time to finish.
 [openproject@host] source ~/.profile
 [openproject@host] git clone https://github.com/OiNutter/node-build.git ~/.nodenv/plugins/node-build
 
-[openproject@host] nodenv install 24.18.0
+[openproject@host] nodenv install 24.22.1
 [openproject@host] nodenv rehash
-[openproject@host] nodenv global 24.18.0
+[openproject@host] nodenv global 24.22.1
 ```
 
 To check our Node installation we run `node --version`. It should output something very similar to:
 
 ```text
-v24.18.0
+v24.22.1
 ```
 
 ## Installation of OpenProject

extensions/op-blocknote-hocuspocus/package.json

@@ -20,7 +20,7 @@
   },
   "homepage": "https://github.com/opf/openproject/tree/dev/extensions/op-blocknote-hocuspocus#readme",
   "engines": {
-    "node": "^24.15.0"
+    "node": "^24.22.1"
   },
   "dependencies": {
     "@blocknote/server-util": "^0.55.0",

frontend/AGENTS.md

@@ -11,7 +11,7 @@ Where a given module belongs is explained in [doc/README.md](./doc/README.md#dir
 
 ## Version Requirements
 
-- Node: `^24.15.0` (see `engines` in the repository root `../package.json`)
+- Node: `^24.22.1` (see `engines` in the repository root `../package.json`)
 
 ## Commands
 

package.json

@@ -10,7 +10,7 @@
   },
   "private": true,
   "engines": {
-    "node": "^24.15.0",
+    "node": "^24.22.1",
     "npm": "^11.12.0"
   },
   "devDependencies": {