Run on Node 22 (Node.js Oct 2026 security release) #24

Merged

backmeupplz merged 3 commits from node-22-security into master

2026-10-22 02:47:50 +00:00

backmeupplz commented

2026-10-21 14:57:20 +00:00

(Migrated from github.com)

Why

Node 16 is EOL and does not get the Node.js Oct 21 2026 security release. This moves the bot to Node 22 (fixed line 22.23.4).

Change

.nvmrc: v16.17.0 -> v22 (Nixpacks picks nodejs_22)
nixpacks.toml: pin [phases.setup] nixpkgsArchive to nixos-26.05 rev cd4ea8d57de16f4810bc5f14207bac45fbf19f67 (nodejs_22 22.23.3). It will be swapped for a rev carrying 22.23.4 once that reaches the channel, before merge/deploy.
Builder stays Nixpacks; no dependency changes.

Smoke test

nixpacks build . locally, then ran the start command (node dist/app.js) in the image for 20 s with a fake bot token and a local mongo:7:

v22.23.3
Bot is up and running
(node:11) Warning: Accessing non-existent property 'remove' of module exports inside circular dependency
Failed to process updates. TelegramError: 401: Unauthorized
  on: { method: 'getUpdates?offset=0&limit=100&timeout=30', payload: {} }

Loads all modules and reaches Telegram polling; fails only on the fake token. The circular-dependency warnings come from mongoose 5 and are harmless (same on Node 16).

🤖 Generated with Claude Code

## Why Node 16 is EOL and does not get the Node.js Oct 21 2026 security release. This moves the bot to Node 22 (fixed line 22.23.4). ## Change - `.nvmrc`: `v16.17.0` -> `v22` (Nixpacks picks `nodejs_22`) - `nixpacks.toml`: pin `[phases.setup] nixpkgsArchive` to nixos-26.05 rev `cd4ea8d57de16f4810bc5f14207bac45fbf19f67` (nodejs_22 22.23.3). It will be swapped for a rev carrying 22.23.4 once that reaches the channel, before merge/deploy. - Builder stays Nixpacks; no dependency changes. ## Smoke test `nixpacks build .` locally, then ran the start command (`node dist/app.js`) in the image for 20 s with a fake bot token and a local `mongo:7`: ``` v22.23.3 Bot is up and running (node:11) Warning: Accessing non-existent property 'remove' of module exports inside circular dependency Failed to process updates. TelegramError: 401: Unauthorized on: { method: 'getUpdates?offset=0&limit=100&timeout=30', payload: {} } ``` Loads all modules and reaches Telegram polling; fails only on the fake token. The circular-dependency warnings come from mongoose 5 and are harmless (same on Node 16). 🤖 Generated with [Claude Code](https://claude.com/claude-code)