Run on Node 22 (Node.js Oct 2026 security release) #2

Merged

backmeupplz merged 3 commits from node-22-security into main

2026-10-22 03:48:08 +00:00

backmeupplz commented

2026-10-21 15:00:38 +00:00

(Migrated from github.com)

Moves the book backend from Node 16 (EOL) to Node 22 for the Node.js October 2026 security release (fixed lines are 22.23.4 / 24.22.1).

Changes

.nvmrc: v16.17.0 → v22
nixpacks.toml: pin [phases.setup] nixpkgsArchive to a nixos-26.05 rev with nodejs_22. This rev ships 22.23.3. It will be bumped to a rev with 22.23.4 before merge.

No dependency or code changes. package.json has no engines field.

Smoke test

nixpacks build . gives nodejs_22. The image reports node -v = v22.23.3 (OpenSSL 3.6.5). The book HTML is gitignored, so a minimal fake book/wdlaty-{ru,en}.html was mounted, and the env vars were fake:

v22.23.3
Preparing book editions
HTTP is listening on 1337
GET /book/toc 200
ethers Wallet.signMessage + utils.verifyMessage round-trip: ok

Without env vars it exits on envalid's "Missing environment variables" check, as expected. yarn lint (prettier + eslint --max-warnings 0) passes on Node 22.

Note: the Borodutch/build-and-lint-code@v1.0.3 CI action hardcodes Node 16, so PR CI still runs on 16.

🤖 Generated with Claude Code

Moves the book backend from Node 16 (EOL) to Node 22 for the Node.js October 2026 security release (fixed lines are 22.23.4 / 24.22.1). ## Changes - `.nvmrc`: `v16.17.0` → `v22` - `nixpacks.toml`: pin `[phases.setup] nixpkgsArchive` to a nixos-26.05 rev with `nodejs_22`. This rev ships 22.23.3. It will be bumped to a rev with 22.23.4 before merge. No dependency or code changes. `package.json` has no `engines` field. ## Smoke test `nixpacks build .` gives `nodejs_22`. The image reports `node -v` = `v22.23.3` (OpenSSL 3.6.5). The book HTML is gitignored, so a minimal fake `book/wdlaty-{ru,en}.html` was mounted, and the env vars were fake: ``` v22.23.3 Preparing book editions HTTP is listening on 1337 GET /book/toc 200 ethers Wallet.signMessage + utils.verifyMessage round-trip: ok ``` Without env vars it exits on envalid's "Missing environment variables" check, as expected. `yarn lint` (prettier + eslint `--max-warnings 0`) passes on Node 22. Note: the `Borodutch/build-and-lint-code@v1.0.3` CI action hardcodes Node 16, so PR CI still runs on 16. 🤖 Generated with [Claude Code](https://claude.com/claude-code)