Run on Node 22 (Node.js Oct 2026 security release) #224

Merged

backmeupplz merged 3 commits from node-22-security into main

2026-10-22 03:24:17 +00:00

backmeupplz commented

2026-10-21 15:25:58 +00:00

(Migrated from github.com)

Why

Node.js shipped a security release on 2026-10-21. Node 16/18/20 are EOL and get no fix; Voicy runs Node 18.20.5. Fixed lines are 22.23.4 / 24.22.1.

What

.nvmrc: v17.0.1 -> v22 (Nixpacks resolves this to nodejs_22; confirmed with nixpacks plan .. There is no engines field to override it.)
nixpacks.toml: pin [phases.setup] nixpkgsArchive to nixos-26.05 rev cd4ea8d5…, which has nodejs 22.23.3. It will be swapped for a rev with 22.23.4 once that reaches the channel, before merging.
No dependency or code changes. The bot server doesn't shell out to any binary. The only spawn is in the Windows/macOS worker client, which doesn't run on Easypanel.

Verification (local `nixpacks build`, Node v22.23.3, OpenSSL 3.6.5)

yarn install --frozen-lockfile + yarn build-ts build cleanly in Nixpacks.
Start (yarn distribute) with fake credentials against a mongo:7 container:
```
Starting app...
Mongo started
GrammyError: Call to 'getMe' failed! (401: Unauthorized)
Node.js v22.23.3
```
The modules load, Mongo connects, and the Telegram API call over TLS goes through. It stops only because the fake bot token is rejected.
yarn lint (prettier + eslint): passes.
All 34 test:* proof scripts run inside the Node 22 image (with Mongo): 30 pass. The 4 that fail are worker-local-stt (macOS say), whisper-transcriber (no node on /usr/bin/env PATH for the whisper stub), telegram-runtime (needs a real bot token) and local-runtime-health (launchctl). They fail in the same way on a Node 18.20.5 build of main, so they are environment-only, not regressions.

Not deployed, not merged.

🤖 Generated with Claude Code

## Why Node.js shipped a security release on 2026-10-21. Node 16/18/20 are EOL and get no fix; Voicy runs Node 18.20.5. Fixed lines are 22.23.4 / 24.22.1. ## What - `.nvmrc`: `v17.0.1` -> `v22` (Nixpacks resolves this to `nodejs_22`; confirmed with `nixpacks plan .`. There is no `engines` field to override it.) - `nixpacks.toml`: pin `[phases.setup] nixpkgsArchive` to nixos-26.05 rev `cd4ea8d5…`, which has nodejs 22.23.3. It will be swapped for a rev with 22.23.4 once that reaches the channel, before merging. - No dependency or code changes. The bot server doesn't shell out to any binary. The only `spawn` is in the Windows/macOS worker client, which doesn't run on Easypanel. ## Verification (local `nixpacks build`, Node v22.23.3, OpenSSL 3.6.5) - `yarn install --frozen-lockfile` + `yarn build-ts` build cleanly in Nixpacks. - Start (`yarn distribute`) with fake credentials against a `mongo:7` container: ``` Starting app... Mongo started GrammyError: Call to 'getMe' failed! (401: Unauthorized) Node.js v22.23.3 ``` The modules load, Mongo connects, and the Telegram API call over TLS goes through. It stops only because the fake bot token is rejected. - `yarn lint` (prettier + eslint): passes. - All 34 `test:*` proof scripts run inside the Node 22 image (with Mongo): **30 pass**. The 4 that fail are `worker-local-stt` (macOS `say`), `whisper-transcriber` (no `node` on `/usr/bin/env` PATH for the whisper stub), `telegram-runtime` (needs a real bot token) and `local-runtime-health` (`launchctl`). They fail in the same way on a Node 18.20.5 build of `main`, so they are environment-only, not regressions. Not deployed, not merged. 🤖 Generated with [Claude Code](https://claude.com/claude-code)