From d646fdbe60c40e7194a387067ed494100efb5e97 Mon Sep 17 00:00:00 2001 From: Sameh Khamis Date: Mon, 2 Nov 2026 07:39:02 -0800 Subject: [PATCH] Pin Node 24.22.2, the current 24 LTS patch, keeping 24.22.1 as the security floor --- .github/ISSUE_TEMPLATE/bug_report.yml | 2 +- .github/workflows/ci.yml | 8 ++++---- CONTRIBUTING.md | 4 ++-- Dockerfile | 2 +- changelog.d/1458-node-24-22-1-security-release.md | 7 ++++--- docs/CURRENT-STATE.md | 7 ++++--- 6 files changed, 16 insertions(+), 14 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 9069c648d..b753f8fef 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -40,7 +40,7 @@ body: attributes: label: OS, Node version, browser description: Include the versions you can find. Write "unknown" for anything unavailable. - placeholder: "Windows 11, Node 24.22.1, Chrome 151" + placeholder: "Windows 11, Node 24.22.2, Chrome 151" validations: required: true - type: input diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 766f0cc51..63d1eb29b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,10 +20,10 @@ jobs: strategy: fail-fast: false matrix: - node: [24.22.1, 26.x] + node: [24.22.2, 26.x] env: PUPPETEER_SKIP_DOWNLOAD: '1' - GEV_REQUIRE_ALLOCATION_GATE: ${{ matrix.node == '24.22.1' && '1' || '0' }} + GEV_REQUIRE_ALLOCATION_GATE: ${{ matrix.node == '24.22.2' && '1' || '0' }} steps: - name: Check out source uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 @@ -76,7 +76,7 @@ jobs: - name: Use Node.js uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 24.22.1 + node-version: 24.22.2 cache: npm - name: Install locked dependencies and headless Chrome @@ -131,7 +131,7 @@ jobs: - name: Use Node.js uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 24.22.1 + node-version: 24.22.2 cache: npm - name: Run the Pinokio install path diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 5850fe650..9361e1f3c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -11,8 +11,8 @@ fixes, including CVE-2026-111497 (a Brotli decoder flaw). ```bash git clone https://github.com/bilawalsidhu/gods-eye-view.git cd gods-eye-view -nvm install 24.22.1 -nvm use 24.22.1 +nvm install 24.22.2 +nvm use 24.22.2 npm install npm run doctor ./scripts/dev-fresh.sh # or: npm run dev (keys are optional) diff --git a/Dockerfile b/Dockerfile index e711ec1d9..a9b8aebd9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ # proxies (ADS-B, AIS, Overpass, OpenAI Realtime, ...) as middleware, so there # is nothing else to containerise. See compose.yaml for the usual entry point. # Same Node as CI (package.json engines, .github/workflows), pinned by digest. -FROM node:24.22.1-slim@sha256:be8204d4bd327363357f532187b752ff62759c31bedf98e9e18fc08c9cbd605c +FROM node:24.22.2-slim@sha256:c86ecead9e55a5210ac1727de38a4ca840bf03dcaf34dc9749addbf383b1920c # Puppeteer is only used by the QA scripts; skip its ~150MB Chromium download. ENV PUPPETEER_SKIP_DOWNLOAD=1 diff --git a/changelog.d/1458-node-24-22-1-security-release.md b/changelog.d/1458-node-24-22-1-security-release.md index 8c8cdd318..d379a26f1 100644 --- a/changelog.d/1458-node-24-22-1-security-release.md +++ b/changelog.d/1458-node-24-22-1-security-release.md @@ -1,3 +1,4 @@ -- The Docker image and CI now pin Node 24.22.1, the first 24.x release with - the October 21, 2026 security fixes, including CVE-2026-111497 in the Brotli - decoder (Luis Ortiz, @anobjectn, #1458). +- The Docker image and CI now pin Node 24.22.2, the current 24 LTS patch. It + carries the October 21, 2026 security fixes first released in 24.22.1, + including CVE-2026-111497 in the Brotli decoder (Luis Ortiz, @anobjectn, + #1458). diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 11df591b0..1792c73de 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -3436,7 +3436,7 @@ down | auth-failed` (plus the unchanged `missing-key`/`unsupported`) with > operator-side; the final accounting records only comparable population > reductions and deterministic Node allocation/solve measurements. Those > allocation gates were calibrated on Node.js 24.14.x and run in CI on the -> pinned Node.js 24.22.1 with the same ceilings; `package.json` permits +> pinned Node.js 24.22.2 with the same ceilings; `package.json` permits > supported product runtimes on Node 24 or 26, while the allocation runner > separately enforces Node 24 for these two calibrated probes. Each probe > compiles synchronously and discards explicit-GC @@ -6183,8 +6183,9 @@ The lockfile uses DOMPurify 3.4.17, protobufjs 8.8.0, PostCSS 8.5.28, source-map-js 1.2.2 and nanoid 3.3.19. Cesium remains on 1.138.0. Browser QA uses Puppeteer 25.10.0; image-processing tools use Sharp 0.35.5. QA scripts await Puppeteer's asynchronous executable-path lookup before testing or passing the path to Chrome. Supported Node versions remain -Node 24 (24.14.0 or later) and 26.x; the Docker image and CI pin 24.22.1, the first 24.x release with -the October 21, 2026 Node.js security fixes (including CVE-2026-111497). Use +Node 24 (24.14.0 or later) and 26.x; the Docker image and CI pin 24.22.2, +the current 24 LTS patch, which carries the October 21, 2026 Node.js security +fixes first released in 24.22.1 (including CVE-2026-111497). Use `npm ci` to reproduce the checked-in dependency tree. ### Traffic city navigation