Run on Node 22 (Node.js Oct 2026 security release) #5

Merged

backmeupplz merged 4 commits from node-22-security into main

2026-10-22 02:52:18 +00:00

backmeupplz commented

2026-10-21 14:57:22 +00:00

(Migrated from github.com)

Why

Node 16 is EOL and does not get the Node.js Oct 21 2026 security release. This moves the bot to Node 22 (fixed line 22.23.4).

Change

.nvmrc: v16.17.0 -> v22 (Nixpacks picks nodejs_22)
nixpacks.toml: pin [phases.setup] nixpkgsArchive to nixos-26.05 rev cd4ea8d57de16f4810bc5f14207bac45fbf19f67 (nodejs_22 22.23.3). It will be swapped for a rev carrying 22.23.4 once that reaches the channel, before merge/deploy.
Builder stays Nixpacks; no dependency changes.

Smoke test

nixpacks build . locally, then ran the start command (node dist/app.js) in the image for 20 s with a fake bot token and a local mongo:7 (image built with --platform linux/amd64, matching the server):

v22.23.3
Starting app...
Mongo connected
[INFO] - [Connection to 149.154.167.91:80/TCPFull complete!]
[INFO] - [Using LAYER 198 for initial connect]
? Phone ?

Connects to Mongo and Telegram MTProto (gramJS crypto works); stops at the interactive login prompt because no SESSION is set.

Note: an arm64 build fails because bufferutil@4.0.5 ships no linux-arm64 prebuild and Nixpacks has no node-gyp. The linux-x64 N-API prebuild works on Node 22, so the amd64 build is fine. CI steps on Node 22: yarn --frozen-lockfile and tsc pass; yarn lint fails on an existing unused-import warning (SHA1 in src/controllers/audience.ts), which is not Node-related and was left alone.

🤖 Generated with Claude Code

## Why Node 16 is EOL and does not get the Node.js Oct 21 2026 security release. This moves the bot to Node 22 (fixed line 22.23.4). ## Change - `.nvmrc`: `v16.17.0` -> `v22` (Nixpacks picks `nodejs_22`) - `nixpacks.toml`: pin `[phases.setup] nixpkgsArchive` to nixos-26.05 rev `cd4ea8d57de16f4810bc5f14207bac45fbf19f67` (nodejs_22 22.23.3). It will be swapped for a rev carrying 22.23.4 once that reaches the channel, before merge/deploy. - Builder stays Nixpacks; no dependency changes. ## Smoke test `nixpacks build .` locally, then ran the start command (`node dist/app.js`) in the image for 20 s with a fake bot token and a local `mongo:7` (image built with `--platform linux/amd64`, matching the server): ``` v22.23.3 Starting app... Mongo connected [INFO] - [Connection to 149.154.167.91:80/TCPFull complete!] [INFO] - [Using LAYER 198 for initial connect] ? Phone ? ``` Connects to Mongo and Telegram MTProto (gramJS crypto works); stops at the interactive login prompt because no `SESSION` is set. Note: an arm64 build fails because `bufferutil@4.0.5` ships no linux-arm64 prebuild and Nixpacks has no node-gyp. The linux-x64 N-API prebuild works on Node 22, so the amd64 build is fine. CI steps on Node 22: `yarn --frozen-lockfile` and `tsc` pass; `yarn lint` fails on an existing unused-import warning (`SHA1` in `src/controllers/audience.ts`), which is not Node-related and was left alone. 🤖 Generated with [Claude Code](https://claude.com/claude-code)