Run on Node 22 (Node.js Oct 2026 security release) #69

Merged

backmeupplz merged 3 commits from node-22-security into master

2026-10-22 03:26:38 +00:00

backmeupplz commented

2026-10-21 15:00:42 +00:00

(Migrated from github.com)

Moves borodutch-stats from Node 20 (EOL) to Node 22 for the Node.js October 2026 security release (fixed lines are 22.23.4 / 24.22.1).

Changes

.nvmrc: v20 → v22
nixpacks.toml: pin [phases.setup] nixpkgsArchive to a nixos-26.05 rev with nodejs_22. This rev ships 22.23.3. It will be bumped to a rev with 22.23.4 before merge.

No dependency or code changes. package.json has no engines field.

Smoke test

nixpacks build . gives nodejs_22. The image reports node -v = v22.23.3 (OpenSSL 3.6.5). Every entrypoint was run against throwaway mongo:7 + postgres:16 with fake tokens:

node dist/app.js (nixpacks start): Koa application is up and running on port 1339. Stats update ran. GET /stats, /summary, /count, /reachability returned 200. /arr returned 500 (Stripe 401 on the fake key).
yarn collect-stats: Mongo queries ran, pg authenticated (SCRAM) and then failed on relation ... does not exist (empty DB).
yarn collect-stats-shadow: Shadow collection failed: relation "known_chats" does not exist (empty DB).

yarn test (tsc + jest) on Node 22.23.3: 14 suites / 93 tests passed.

Both Easypanel services (borodutch-stats, borodutch-stats-counter-shadow) build from this repo. Whichever start command each one uses, all of the entrypoints above load on Node 22.

🤖 Generated with Claude Code

Moves borodutch-stats from Node 20 (EOL) to Node 22 for the Node.js October 2026 security release (fixed lines are 22.23.4 / 24.22.1). ## Changes - `.nvmrc`: `v20` → `v22` - `nixpacks.toml`: pin `[phases.setup] nixpkgsArchive` to a nixos-26.05 rev with `nodejs_22`. This rev ships 22.23.3. It will be bumped to a rev with 22.23.4 before merge. No dependency or code changes. `package.json` has no `engines` field. ## Smoke test `nixpacks build .` gives `nodejs_22`. The image reports `node -v` = `v22.23.3` (OpenSSL 3.6.5). Every entrypoint was run against throwaway `mongo:7` + `postgres:16` with fake tokens: - `node dist/app.js` (nixpacks start): `Koa application is up and running on port 1339`. Stats update ran. `GET /stats`, `/summary`, `/count`, `/reachability` returned 200. `/arr` returned 500 (Stripe 401 on the fake key). - `yarn collect-stats`: Mongo queries ran, pg authenticated (SCRAM) and then failed on `relation ... does not exist` (empty DB). - `yarn collect-stats-shadow`: `Shadow collection failed: relation "known_chats" does not exist` (empty DB). `yarn test` (tsc + jest) on Node 22.23.3: **14 suites / 93 tests passed**. Both Easypanel services (`borodutch-stats`, `borodutch-stats-counter-shadow`) build from this repo. Whichever start command each one uses, all of the entrypoints above load on Node 22. 🤖 Generated with [Claude Code](https://claude.com/claude-code)