Run on Node 22 (Node.js Oct 2026 security release) #1

Merged

backmeupplz merged 3 commits from node-22-security into main

2026-10-22 02:23:32 +00:00

backmeupplz commented

2026-10-21 14:57:18 +00:00

(Migrated from github.com)

Why

Node 16 is EOL and does not get the Node.js Oct 21 2026 security release. This moves the bot to Node 22 (fixed line 22.23.4).

Change

.nvmrc: v16.17.0 -> v22 (Nixpacks picks nodejs_22)
nixpacks.toml: pin [phases.setup] nixpkgsArchive to nixos-26.05 rev cd4ea8d57de16f4810bc5f14207bac45fbf19f67 (nodejs_22 22.23.3). It will be swapped for a rev carrying 22.23.4 once that reaches the channel, before merge/deploy.
Builder stays Nixpacks; no dependency changes.

Smoke test

nixpacks build . locally, then ran the start command (node dist/app.js) in the image for 20 s with a fake bot token:

v22.23.3
Launch failed
Error: 401: Unauthorized
    at /app/node_modules/telegraf/core/network/client.js:281:17
Bot is up and running

Gets as far as calling Telegram and fails only on the fake token.

🤖 Generated with Claude Code

## Why Node 16 is EOL and does not get the Node.js Oct 21 2026 security release. This moves the bot to Node 22 (fixed line 22.23.4). ## Change - `.nvmrc`: `v16.17.0` -> `v22` (Nixpacks picks `nodejs_22`) - `nixpacks.toml`: pin `[phases.setup] nixpkgsArchive` to nixos-26.05 rev `cd4ea8d57de16f4810bc5f14207bac45fbf19f67` (nodejs_22 22.23.3). It will be swapped for a rev carrying 22.23.4 once that reaches the channel, before merge/deploy. - Builder stays Nixpacks; no dependency changes. ## Smoke test `nixpacks build .` locally, then ran the start command (`node dist/app.js`) in the image for 20 s with a fake bot token: ``` v22.23.3 Launch failed Error: 401: Unauthorized at /app/node_modules/telegraf/core/network/client.js:281:17 Bot is up and running ``` Gets as far as calling Telegram and fails only on the fake token. 🤖 Generated with [Claude Code](https://claude.com/claude-code)