Backend: Node 22.23.4 (security release, Node 16 EOL) #19

Merged

backmeupplz merged 1 commit from node22-security into main

2026-10-21 14:58:29 +00:00

backmeupplz commented

2026-10-21 14:54:23 +00:00

(Migrated from github.com)

Node.js shipped a security release on Oct 21 2026 and Node 16, 18 and 20 no longer get fixes. The backend was still on Node 16 (node:16.20.2-bullseye-slim).

Changes

backend/Dockerfile: both stages now use node:22.23.4-bookworm-slim (published on Docker Hub today for amd64 and arm64; this also moves from Debian bullseye to bookworm)
backend/.nvmrc: 22, which CI reads
backend/README.md: "You need Node 22"

No dependency changes were needed. The backend has no native modules (no bcrypt, sharp or node-gyp builds), and passwords use the built-in crypto.scrypt, which works the same on OpenSSL 3.

Verified locally on node:22.23.4-bookworm-slim

yarn install --frozen-lockfile, prettier, eslint, tsc --noEmit and tsc all pass with no errors
jest, CI set (v2.ts, appleAuthKey.ts): 21/21 pass
jest, full suite: 78/80 pass. The 2 failures (verifyTelegramPayload, docs) fail the same way on Node 16 and are not part of CI
docker build backend/ works; the image reports Node v22.23.4, OpenSSL 3.5.9, Debian 12.15
The image booted against mongo:4.4 with dummy secrets and logged HTTP is listening on 1337, Sockets are listening on 3000, Mongo connected, Indexes ready. Requests:
- GET /docs/ → 200
- GET /login/generate_uuid → 200 {"uuid":"…"}
- POST /login/anonymous → 200, user with a JWT
- GET /todo/current?date=2026-10-21 with that token → 200 {"todosCount":0,…}; with a bad token → 403
- socket.io polling on :3000 → 200

web/Dockerfile uses node:22-slim only to build the static files, and web.yml uses Node 22, so a rebuild picks up 22.23.4 and nothing there needs to change.

Deploy: after this is merged, backend.yml runs its checks on main and moves deploy/backend to the merge commit, and Easypanel then rebuilds backend.todorant.com.

🤖 Generated with Claude Code

Node.js shipped a security release on Oct 21 2026 and Node 16, 18 and 20 no longer get fixes. The backend was still on Node 16 (`node:16.20.2-bullseye-slim`). ## Changes - `backend/Dockerfile`: both stages now use `node:22.23.4-bookworm-slim` (published on Docker Hub today for amd64 and arm64; this also moves from Debian bullseye to bookworm) - `backend/.nvmrc`: `22`, which CI reads - `backend/README.md`: "You need Node 22" No dependency changes were needed. The backend has no native modules (no bcrypt, sharp or node-gyp builds), and passwords use the built-in `crypto.scrypt`, which works the same on OpenSSL 3. ## Verified locally on node:22.23.4-bookworm-slim - `yarn install --frozen-lockfile`, prettier, eslint, `tsc --noEmit` and `tsc` all pass with no errors - jest, CI set (`v2.ts`, `appleAuthKey.ts`): 21/21 pass - jest, full suite: 78/80 pass. The 2 failures (`verifyTelegramPayload`, `docs`) fail the same way on Node 16 and are not part of CI - `docker build backend/` works; the image reports Node v22.23.4, OpenSSL 3.5.9, Debian 12.15 - The image booted against `mongo:4.4` with dummy secrets and logged `HTTP is listening on 1337`, `Sockets are listening on 3000`, `Mongo connected`, `Indexes ready`. Requests: - `GET /docs/` → 200 - `GET /login/generate_uuid` → 200 `{"uuid":"…"}` - `POST /login/anonymous` → 200, user with a JWT - `GET /todo/current?date=2026-10-21` with that token → 200 `{"todosCount":0,…}`; with a bad token → 403 - socket.io polling on :3000 → 200 `web/Dockerfile` uses `node:22-slim` only to build the static files, and `web.yml` uses Node 22, so a rebuild picks up 22.23.4 and nothing there needs to change. Deploy: after this is merged, `backend.yml` runs its checks on `main` and moves `deploy/backend` to the merge commit, and Easypanel then rebuilds backend.todorant.com. 🤖 Generated with [Claude Code](https://claude.com/claude-code)