Repository navigation
ci: upgrade Node to 24 LTS and add .nvmrc - #1708
Merged
Merged
Conversation
Node 22.22.3 (pinned in deploy jobs) lacks the October 21, 2026 security fixes, including a Brotli out-of-bounds write (CVE-2026-111497) and several TLS hostname-verification bypasses. Move all workflows to the Node 24 LTS line (EOL 2028-04-30) and add .nvmrc so local setups match. This also removes the 22.22.3 pin added in 80c774d for the gaxios STS "Premature close" regression. Deploy jobs run via pull_request_target, so this PR cannot exercise them; watch the first deploy-live run after merge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Size Change: 0 B Total Size: 2.45 MB ℹ️ View Unchanged
|
|
Visit the preview URL for this PR (updated for commit d28d7e6): https://docusaurus-openapi-36b86--pr1708-y76ef4kt.web.app (expires Wed, 11 Nov 2026 20:41:58 GMT) 🔥 via Firebase Hosting GitHub Action 🌎 Sign: bf293780ee827f578864d92193b8c2866acd459f |
📸 Visual Diff ReportSnapshot comparison against https://docusaurus-openapi.tryingpan.dev/
✅ No visual regressions detected. Updated at 2026-11-04T20:47:37.231Z · run 41908493439 |
sserrata
added a commit
to PaloAltoNetworks/pan.dev
that referenced
this pull request
Nov 4, 2026
Node 22 is in Maintenance LTS (EOL 2027-04-30). Move the deploy workflows to the Node 24 LTS line (EOL 2028-04-30) and add .nvmrc so local setups match CI. Same change as PaloAltoNetworks/docusaurus-openapi-docs#1708, whose Deploy Live run succeeded on Node 24.22.2. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
22.22.3pin in thedeploy-liveanddeploy-previewdeploy jobs..nvmrc(24) so local setups match CI.Why
The pinned
22.22.3does not include the October 21, 2026 security release fixes (4 high, for example the Brotli decoder out-of-bounds write CVE-2026-111497 and TLS hostname-verification bypasses). Node 22 is in Maintenance LTS and reaches EOL on 2027-04-30. Another security release with HIGH-severity fixes for 22.x/24.x/26.x is scheduled for November 11, 2026. The floating"24"will pick it up automatically.Risk
The
22.22.3pin was added in 80c774d to avoid a gaxios/STS "Premature close" error whenfirebase-toolsexchanged WIF credentials on Node 22.23.0. The deploy action installs the latestfirebase-tools, so the upstream fix should be in now, but I could not confirm it.Deploy Preview runs on
pull_request_target, so this PR cannot exercise the deploy jobs on Node 24. Validate (build, lint, and tests) runs on Node 24 here.After merge, watch the first
Deploy Liverun. If it fails with "Premature close", pin the deploy step to a specific Node 24 patch version or revert that step to Node 22.Not in scope
The
enginesfields (>=14/>=18) are unchanged. Raising them affects consumers and belongs in a major release.🤖 Generated with Claude Code