From 16756bb790adb557208e55c2506994e3993cccf8 Mon Sep 17 00:00:00 2001 From: Sameh Khamis Date: Mon, 2 Nov 2026 07:03:49 -0800 Subject: [PATCH] Align the doctor, state doc and bug template with the 24.22.1 pin, and credit the author --- .github/ISSUE_TEMPLATE/bug_report.yml | 2 +- CONTRIBUTING.md | 6 +++--- changelog.d/1458-node-24-22-1-security-release.md | 4 ++-- docs/CURRENT-STATE.md | 5 +++-- scripts/setup-doctor.mjs | 2 +- 5 files changed, 10 insertions(+), 9 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 016576bf8..9069c648d 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -40,7 +40,7 @@ body: attributes: label: OS, Node version, browser description: Include the versions you can find. Write "unknown" for anything unavailable. - placeholder: "Windows 11, Node 24.14.0, Chrome 151" + placeholder: "Windows 11, Node 24.22.1, Chrome 151" validations: required: true - type: input diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 341252ba4..5850fe650 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -4,9 +4,9 @@ Thanks for being here. God's Eye View is an open foundation for live spatial int ## Getting set up -Use Node.js 24.14.x or 26.x (also enforced by `package.json`). Prefer 24.22.1 or -later: earlier releases lack the October 21, 2026 security fixes, including -CVE-2026-111497 (a Brotli decoder flaw that can lead to remote code execution). +Use Node.js 24 (24.14.0 or later) or 26.x (also enforced by `package.json`). +Prefer 24.22.1 or later: earlier releases lack the October 21, 2026 security +fixes, including CVE-2026-111497 (a Brotli decoder flaw). ```bash git clone https://github.com/bilawalsidhu/gods-eye-view.git diff --git a/changelog.d/1458-node-24-22-1-security-release.md b/changelog.d/1458-node-24-22-1-security-release.md index a440892a8..8c8cdd318 100644 --- a/changelog.d/1458-node-24-22-1-security-release.md +++ b/changelog.d/1458-node-24-22-1-security-release.md @@ -1,3 +1,3 @@ - The Docker image and CI now pin Node 24.22.1, the first 24.x release with - the October 21, 2026 security fixes, including CVE-2026-111497 (a Brotli - decoder flaw that can lead to remote code execution) (anobjectn, #1458). + the October 21, 2026 security fixes, including CVE-2026-111497 in the Brotli + decoder (Luis Ortiz, @anobjectn, #1458). diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index c872b609c..bf5d99fc7 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -3433,7 +3433,8 @@ down | auth-failed` (plus the unchanged `missing-key`/`unsupported`) with > style-switch persistence state. Browser/GPU performance comparison remains > operator-side; the final accounting records only comparable population > reductions and deterministic Node allocation/solve measurements. Those -> allocation gates are calibrated on Node.js 24.14.x; `package.json` permits +> allocation gates were calibrated on Node.js 24.14.x and run in CI on the +> pinned Node.js 24.22.1 with the same ceilings; `package.json` permits > supported product runtimes on Node 24 or 26, while the allocation runner > separately enforces Node 24 for these two calibrated probes. Each probe > compiles synchronously and discards explicit-GC @@ -6180,7 +6181,7 @@ The lockfile uses DOMPurify 3.4.17, protobufjs 8.8.0, PostCSS 8.5.28, source-map-js 1.2.2 and nanoid 3.3.19. Cesium remains on 1.138.0. Browser QA uses Puppeteer 25.10.0; image-processing tools use Sharp 0.35.5. QA scripts await Puppeteer's asynchronous executable-path lookup before testing or passing the path to Chrome. Supported Node versions remain -24.14.x and 26.x; the Docker image and CI pin 24.22.1, the first 24.x release with +Node 24 (24.14.0 or later) and 26.x; the Docker image and CI pin 24.22.1, the first 24.x release with the October 21, 2026 Node.js security fixes (including CVE-2026-111497). Use `npm ci` to reproduce the checked-in dependency tree. diff --git a/scripts/setup-doctor.mjs b/scripts/setup-doctor.mjs index 7075be2c1..600e96b09 100644 --- a/scripts/setup-doctor.mjs +++ b/scripts/setup-doctor.mjs @@ -57,7 +57,7 @@ export function classifyNodeVersion(version = process.versions.node) { // NEWER than this release has verified is a warning, never a refusal: a // future Node must not brick a no-terminal install with advice its user // cannot follow. Too-old stays an error above — old runtimes genuinely fail. - return { level: 'warn', summary: 'newer than this release has verified; Node 24.14.x or 26.x is the tested path' }; + return { level: 'warn', summary: 'newer than this release has verified; Node 24.22.x or 26.x is the tested path' }; } /** Verify that every direct package declared by this checkout is present. */