Run on Node 22 (Node.js Oct 2026 security release) #11

Merged

backmeupplz merged 3 commits from node-22-security into master

2026-10-22 03:09:30 +00:00

backmeupplz commented

2026-10-21 15:14:11 +00:00

(Migrated from github.com)

Why

Node.js shipped a security release on 2026-10-21. Node 16/18/20 are EOL and get no fix; this service runs Node 18.20.5. Fixed lines are 22.23.4 / 24.22.1.

What

.nvmrc: v17.0.1 -> v22 (Nixpacks resolves this to nodejs_22; confirmed with nixpacks plan .)
nixpacks.toml: pin [phases.setup] nixpkgsArchive to nixos-26.05 rev cd4ea8d5…, which has nodejs 22.23.3. It will be swapped for a rev with 22.23.4 once that reaches the channel, before merging.
No dependency changes. No engines field.

Smoke test (local `nixpacks build`, Node v22.23.3, OpenSSL 3.6.5)

node ./bin/www with fake credentials against a mongo:4.4 container: Server is up and running!, Listening on port 3001, New stats were generated!
GET /statsfornikita -> 200, GET /statsforashmanov -> 200
Outbound TLS: Stripe with a fake key -> StripeAuthenticationError; Telegram getMe with a fake token -> 401. So TLS and the HTTP clients work, and only the credentials are rejected.
Only new output is a Node deprecation warning (DEP0044 util.isArray, from old deps). It still works on 22, but these APIs are removed in Node 23+.

Note: mongoose 4 / mongodb-core 2 cannot talk to MongoDB >= 5.1 (OP_QUERY removed). This is unrelated to Node and the same as before; production Mongo must already be older.

Not deployed, not merged.

🤖 Generated with Claude Code

## Why Node.js shipped a security release on 2026-10-21. Node 16/18/20 are EOL and get no fix; this service runs Node 18.20.5. Fixed lines are 22.23.4 / 24.22.1. ## What - `.nvmrc`: `v17.0.1` -> `v22` (Nixpacks resolves this to `nodejs_22`; confirmed with `nixpacks plan .`) - `nixpacks.toml`: pin `[phases.setup] nixpkgsArchive` to nixos-26.05 rev `cd4ea8d5…`, which has nodejs 22.23.3. It will be swapped for a rev with 22.23.4 once that reaches the channel, before merging. - No dependency changes. No `engines` field. ## Smoke test (local `nixpacks build`, Node v22.23.3, OpenSSL 3.6.5) - `node ./bin/www` with fake credentials against a `mongo:4.4` container: `Server is up and running!`, `Listening on port 3001`, `New stats were generated!` - `GET /statsfornikita` -> 200, `GET /statsforashmanov` -> 200 - Outbound TLS: Stripe with a fake key -> `StripeAuthenticationError`; Telegram `getMe` with a fake token -> 401. So TLS and the HTTP clients work, and only the credentials are rejected. - Only new output is a Node deprecation warning (`DEP0044 util.isArray`, from old deps). It still works on 22, but these APIs are removed in Node 23+. Note: mongoose 4 / mongodb-core 2 cannot talk to MongoDB >= 5.1 (`OP_QUERY` removed). This is unrelated to Node and the same as before; production Mongo must already be older. Not deployed, not merged. 🤖 Generated with [Claude Code](https://claude.com/claude-code)