Run on Node 22 (Node.js Oct 2026 security release) #66

Merged

backmeupplz merged 3 commits from node-22-security into master

2026-10-22 03:03:35 +00:00

backmeupplz commented

2026-10-21 15:00:36 +00:00

(Migrated from github.com)

Moves banofbot to Node 22 for the Node.js October 2026 security release (Node 16/18/20 are EOL; fixed lines are 22.23.4 / 24.22.1).

Changes

.nvmrc: v16.17.0 → v22
package.json engines.node: >=6.4 → 22.x. Nixpacks reads engines.node before .nvmrc, and the open-ended >=6.4 made it pick nodejs_24, so the .nvmrc change alone did nothing. Pinning it is what selects nodejs_22.
nixpacks.toml: pin [phases.setup] nixpkgsArchive to a nixos-26.05 rev so the Node patch version is reproducible. This rev ships 22.23.3. It will be bumped to a rev with 22.23.4 before merge.

No dependency changes.

Smoke test

nixpacks build . gives nodejs_22, yarn-1_x. The image reports node -v = v22.23.3 (OpenSSL 3.6.5). Ran yarn start with a throwaway mongo:7 and a fake Telegram token:

v22.23.3
$ node app.js
Telegram is using polling
Bot is up and running
(node:34) Warning: Accessing non-existent property 'count' of module exports inside circular dependency   <- existing mongoose 5 warning
Polling error   (x33, expected: fake token gets 401)

Modules load, Mongo connects, and the bot only fails on the fake credentials. Both banofbot and banofbot-silent use this build.

🤖 Generated with Claude Code

Moves banofbot to Node 22 for the Node.js October 2026 security release (Node 16/18/20 are EOL; fixed lines are 22.23.4 / 24.22.1). ## Changes - `.nvmrc`: `v16.17.0` → `v22` - `package.json` `engines.node`: `>=6.4` → `22.x`. Nixpacks reads `engines.node` **before** `.nvmrc`, and the open-ended `>=6.4` made it pick `nodejs_24`, so the `.nvmrc` change alone did nothing. Pinning it is what selects `nodejs_22`. - `nixpacks.toml`: pin `[phases.setup] nixpkgsArchive` to a nixos-26.05 rev so the Node patch version is reproducible. This rev ships 22.23.3. It will be bumped to a rev with 22.23.4 before merge. No dependency changes. ## Smoke test `nixpacks build .` gives `nodejs_22, yarn-1_x`. The image reports `node -v` = `v22.23.3` (OpenSSL 3.6.5). Ran `yarn start` with a throwaway `mongo:7` and a fake Telegram token: ``` v22.23.3 $ node app.js Telegram is using polling Bot is up and running (node:34) Warning: Accessing non-existent property 'count' of module exports inside circular dependency <- existing mongoose 5 warning Polling error (x33, expected: fake token gets 401) ``` Modules load, Mongo connects, and the bot only fails on the fake credentials. Both `banofbot` and `banofbot-silent` use this build. 🤖 Generated with [Claude Code](https://claude.com/claude-code)