Skip to content

fix!: require patched Node 22 and 24 security baselines - #184

Merged
abruption merged 1 commit into
mainfrom
fix/node-security-baseline-183
Oct 28, 2026
Merged

abruption merged 1 commit into
mainfrom
fix/node-security-baseline-183

Conversation

@abruption

Copy link
Copy Markdown
Owner

Summary

Closes #183.

  • Require Node ^22.23.4 || ^24.22.1, with matching root lock metadata, installation docs and translated READMEs. This intentionally drops older patches; Node 26 remains unsupported.
  • Test both exact patched minimums and latest 22/24 across Linux/macOS x64/arm64. Align release and supporting workflows with patched baselines without changing permissions or publishing anything.
  • Add a baseline consistency regression test. Reserve argv space in the synthetic terminal-width fixture so a short checkout path cannot truncate its process title; no assertions weakened.
  • Native dependency pins (including already-fixed brace-expansion), runtime source, ownership checks and recovery policy are unchanged. Advisory applicability remains conditional; metadata does not upgrade installed runtimes or demonstrate exploitability.

Validation

Dots cloud Linux x64, Node 24.22.1:

  • Clean npm ci, typecheck, lint and build: passed.
  • Full suite: 291 tests, 290 passed, 1 filesystem-case-sensitivity skip, 0 failures.
  • Packed artifact smoke: passed (isolated temporary HOME/cache; offline CLI/JSON/type boundaries).
  • Platform smoke: native addon loaded; real synthetic lock held and owner/process/file identity verified.
  • Full and runtime-only npm audits: 0 vulnerabilities.
  • git diff --check and independent read-only diff review: passed.

Other platform/architecture and Node 22 minimum evidence awaits PR CI. No live user Codex process, auth/state, release or repository setting changed.

BREAKING CHANGE: Node 22 below 22.23.4 and Node 24 below 24.22.1 are no longer supported.

Align runtime metadata, minimum-version CI, release tooling, and installation docs with the October 2026 security releases. Keep native dependencies and recovery policy unchanged.

BREAKING CHANGE: Node 22 versions below 22.23.4 and Node 24 versions below 24.22.1 are no longer supported.
@abruption
abruption marked this pull request as ready for review October 28, 2026 01:44
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review 🔄 Running since 2026-10-28T01:44:29.850412Z 5fa086f Draft marked ready
🔒 Security Review ✅ Completed 2026-10-28T01:46:36.845418Z 5fa086f Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@abruption
abruption merged commit 0c9ecfc into main Oct 28, 2026
57 checks passed
@abruption
abruption deleted the fix/node-security-baseline-183 branch October 28, 2026 03:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

security: refresh Node minimum versions after October 2026 patches

1 participant