From b1422b3b4f3b6187ce5f2064ad31984bcdb3722b Mon Sep 17 00:00:00 2001 From: Pete Bacon Darwin Date: Thu, 2 Jul 2026 11:36:13 +0100 Subject: [PATCH] [ci] Pin CI Node.js to node-fetch@2-safe versions (22.23.1 / 24.18.0) Node 22.23.0 and 24.17.0 shipped a security backport that regressed node-fetch@2 keep-alive responses, throwing spurious ERR_STREAM_PREMATURE_CLOSE errors (nodejs/node#63989, fixed in 22.23.1 / 24.18.0). This was already causing flakes in the Handle Changesets job. Roll the pin out across the repo: - install-dependencies action default: 22 -> 22.23.1 (covers all default consumers) - changesets.yml: Node 24 -> 24.18.0 and the non-npm-deploy switch 22 -> 22.23.1 - test-and-check-other-node.yml: matrix Node 24 -> 24.18.0 (25 left as-is) - e2e-wrangler.yml: drop the now-redundant explicit pin (inherits the default) --- .github/actions/install-dependencies/action.yml | 6 +++++- .github/workflows/changesets.yml | 10 ++++++++-- .github/workflows/e2e-wrangler.yml | 3 --- .github/workflows/test-and-check-other-node.yml | 11 ++++++++++- 4 files changed, 23 insertions(+), 7 deletions(-) diff --git a/.github/actions/install-dependencies/action.yml b/.github/actions/install-dependencies/action.yml index 76db84826c..59ca8a9300 100644 --- a/.github/actions/install-dependencies/action.yml +++ b/.github/actions/install-dependencies/action.yml @@ -2,9 +2,13 @@ name: "Install Dependencies" description: "Install dependencies, fetching from cache when possible" inputs: # We run all jobs on Node.js 22 by default, as this is the most stable and supported version right now. + # + # Pinned to 22.23.1 (rather than floating `22`) until it's safe to float back: + # Node 22.23.0 regressed node-fetch@2 keep-alive responses with + # ERR_STREAM_PREMATURE_CLOSE (nodejs/node#63989, fixed in 22.23.1). node-version: description: the version of Node.js to install - default: 22 + default: 22.23.1 turbo-api: description: the api URL for connecting to the turbo remote cache turbo-team: diff --git a/.github/workflows/changesets.yml b/.github/workflows/changesets.yml index 91dcb4afa9..92b4ddeca8 100644 --- a/.github/workflows/changesets.yml +++ b/.github/workflows/changesets.yml @@ -37,7 +37,10 @@ jobs: # rather than restoring from a (potentially poisoned) cache. uses: ./.github/actions/install-dependencies with: - node-version: 24 + # Pinned to 24.18.0 (rather than floating `24`) until it's safe to + # float back: Node 24.17.0 regressed node-fetch@2 keep-alive responses + # with ERR_STREAM_PREMATURE_CLOSE (nodejs/node#63989, fixed in 24.18.0). + node-version: 24.18.0 disable-cache: "true" - name: Check npm version @@ -74,7 +77,10 @@ jobs: - name: Switch to Node 22 for non-npm package deployments uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: - node-version: 22 + # Pinned to 22.23.1 (rather than floating `22`) until it's safe to + # float back: Node 22.23.0 regressed node-fetch@2 keep-alive responses + # with ERR_STREAM_PREMATURE_CLOSE (nodejs/node#63989, fixed in 22.23.1). + node-version: 22.23.1 - name: Deploy non-NPM Packages id: deploy diff --git a/.github/workflows/e2e-wrangler.yml b/.github/workflows/e2e-wrangler.yml index a2b47a0176..8a1a88a288 100644 --- a/.github/workflows/e2e-wrangler.yml +++ b/.github/workflows/e2e-wrangler.yml @@ -51,9 +51,6 @@ jobs: if: steps.changes.outputs.everything_but_markdown == 'true' uses: ./.github/actions/install-dependencies with: - # Pin until `node-version: 22` resolves to 22.23.1 or later. Node 22.23.0 - # regressed node-fetch@2 chunked/gzip responses with ERR_STREAM_PREMATURE_CLOSE. - node-version: 22.23.1 turbo-api: ${{ secrets.TURBO_API }} turbo-team: ${{ secrets.TURBO_TEAM }} turbo-token: ${{ secrets.TURBO_TOKEN }} diff --git a/.github/workflows/test-and-check-other-node.yml b/.github/workflows/test-and-check-other-node.yml index 86bf08fe06..61b0793eba 100644 --- a/.github/workflows/test-and-check-other-node.yml +++ b/.github/workflows/test-and-check-other-node.yml @@ -23,8 +23,17 @@ jobs: # expected_to_fail: if true, tests may fail on this Node version. # These versions are skipped on normal PRs but run on Version Packages PRs # (changeset-release/main) or when the 'ci:test-all-node-versions' label is added. + # + # Node 24 is pinned to 24.18.0 (rather than floating `24`): Node 24.17.0 + # regressed node-fetch@2 keep-alive responses with ERR_STREAM_PREMATURE_CLOSE + # (nodejs/node#63989, fixed in 24.18.0). `description` stays "Node 24" to + # keep the job/check name stable. include: - - { node_version: 24, description: "Node 24", expected_to_fail: true } + - { + node_version: 24.18.0, + description: "Node 24", + expected_to_fail: true, + } - { node_version: 25, description: "Node 25", expected_to_fail: true } steps: