Repository navigation
Upgrade from EOL Node 20 to Node 24 for CVE-2026-111497 - #44
Merged
Merged
Conversation
Node 20 is end-of-life and receives no fix for the Brotli decoder out-of-bounds write (CVE-2026-111497). Move local, CI, deploy and the App Engine runtime to Node 24, whose 24.22.1 release carries the fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KW4XMLaQFJA9YEDWY1ZJwL
GitHub now hard-fails jobs using actions/cache@v2, so bump cache, checkout and setup-node to v4, and bump the cache key so node_modules built under Node 20 aren't restored under Node 24. Newer Node detects ESM syntax in .js files, so mocha's import() of the client tests loaded them as ES modules and bypassed @babel/register, failing on JSX. Disable module syntax detection for the client tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KW4XMLaQFJA9YEDWY1ZJwL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This app runs on Node 20 everywhere:
.nvmrc, CI, the deploy workflow and the App Engineruntime: nodejs20. Node 20 is end-of-life and gets no fix for CVE-2026-111497. That CVE is a high-severity out-of-bounds write in the Brotli decoder bundled with Node, reachable throughnode:zlib. Patched releases are 22.23.4, 24.22.1 and 26.12.1.This PR moves the app to Node 24, the active LTS line:
.nvmrc:v20→v24package.jsonengines:>=20.0.0→>=24.0.0app-template.yaml:runtime: nodejs20→nodejs24. App Engine applies Node patch updates for the runtime.lint-and-test.ymlanddeploy.yml:node-version: 20→24CI fixes
CI was broken before this change, so this PR also fixes it:
actions/cache@v2.lint-and-test.ymlnow uses v4 ofactions/cache,actions/checkoutandactions/setup-node. The cache key prefix moves fromv1-tov2-, so anode_modulesbuilt under Node 20 isn't restored under Node 24.yarn test:clientfailed withSyntaxError: Unexpected token '<'on Node 20.20+, 22 and 24. Mocha 10 loads test files withimport(), and newer Node treats a.jsfile containingimportstatements as an ES module. That skips@babel/register, so the JSX in the tests is never transpiled.test:clientnow passes--node-option no-experimental-detect-moduleto mocha, which affects the client tests only."type": "commonjs"makes the tests pass, but webpack then rejects the ESM insrc/client, so the build fails.Testing on Node 24.22.1
yarn lint,yarn test:serverandyarn test:clientpass locally and in CI.yarn buildcompiles./with a 200.Known follow-up
The tests don't run on Node 26 yet. The old
yargsthat mocha depends on crashes on startup withrequire is not defined in ES module scope. Nothing here targets 26, so I left it for a dependency upgrade when the app moves to 26.🤖 Generated with Claude Code
https://claude.ai/code/session_01KW4XMLaQFJA9YEDWY1ZJwL