Repository navigation
Require patched Node runtimes - #8143
Merged
Merged
Conversation
Pin CI and the billing build image to Node 22.23.4 and exclude vulnerable Node releases from supported workspace engines.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| "packageManager": "pnpm@11.1.1", | ||
| "engines": { | ||
| "node": ">=22" | ||
| "node": "^22.23.4 || ^24.22.1 || >=26.12.1" |
Contributor
There was a problem hiding this comment.
🔍 Linux setup can retain unsupported Node
With Node 22.0 installed, setup_toolchains leaves it unchanged despite the new engine floor. The setup guidance also still permits any Node 22 release.
Was this helpful? React with 👍 or 👎 to provide feedback.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Intent: Prevent CI and billing image builds from selecting Node versions affected by the October security advisory. Pin Node 22.23.4 and restrict supported workspace engines to patched release ranges.
Tracks ANLG-525. Production Vercel patch verification and coordinated Stripe key rotation remain separate follow-up work; this PR does not establish production remediation.
Demo
N/A — runtime and build configuration only; no user-facing UI changes.
Verification
docker build --target billing-runtime -f apps/api/Dockerfile .passed.Summary by cubic
Pins CI workflows and the billing Docker image to Node 22.23.4 and restricts workspace engines to patched releases so builds avoid Node versions affected by the October security advisory.
node-versionpin in all five CI setup steps and the billing Docker base image.enginesrange>=22with^22.23.4 || ^24.22.1 || >=26.12.1.Tracks ANLG-525. Production Vercel and Stripe key rotation remain separate follow-ups.
Written for commit e12f37d. Summary will update on new commits.