bump Node.js to 24.22.1 by jramosg · Pull Request #12278 · TanStack/query

jramosg · 2026-10-22T07:30:54Z

24.21.0 is affected by high-severity TLS hostname-verification bypasses and a Brotli decoder out-of-bounds write that permits remote code execution (CVE-2026-111497): https://nodejs.org/es/blog/vulnerability/october-2026-security-releases

🎯 Changes

✅ Checklist

I have followed the steps in the Contributing guide.
I have tested code changes locally with pnpm run test:pr, or these tests do not apply to this pull request.
I have followed the AI contribution policy and fully understand the code in this pull request, including any code generated with AI assistance.

🚀 Release Impact

This change affects published code, and I have generated a changeset.
This change is docs/CI/dev-only (no release).

Summary by CodeRabbit

Chores
- Updated the project’s specified Node.js version. This is a tooling change; no user-facing feature or behavior changes are included in this update.

…release 24.21.0 is affected by high-severity TLS hostname-verification bypasses and a Brotli decoder out-of-bounds write that permits remote code execution (CVE-2026-111497). https://nodejs.org/es/blog/vulnerability/october-2026-security-releases

changeset-bot · 2026-10-22T07:30:58Z

⚠️ No Changeset found

Latest commit: 60f7773

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-10-22T07:31:11Z

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

Source mode: Auto
Repository: TanStack/query
Branch: main
File: .coderabbit.yaml
Commit: 84332de
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 8ac4ba6b-2988-4925-9c4d-ef1371d97ea5

📥 Commits

Reviewing files that changed from the base of the PR and between 6da9859 and 60f7773.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Source mode: Auto
Repository: TanStack/query
Branch: main
File: .coderabbit.yaml
Commit: b2246c2
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: b05376dd-df51-4ec7-b2ec-35ee13666fe5

📥 Commits

Reviewing files that changed from the base of the PR and between b2246c2 and 6da9859.

📒 Files selected for processing: 1

.nvmrc

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

The Node.js version specified in .nvmrc changes from 24.21.0 to 24.22.1.

Changes: Node.js version update

Layer / File(s)	Summary
Update Node.js version pin `.nvmrc`	The specified Node.js version changes from `24.21.0` to `24.22.1`.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: sukvvon

Merge Risk: ⚪ Minimal · up to 6da98

No merge-blocking issue is identified in this version-only update.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: updating Node.js to version 24.22.1.
Description check		The description explains the security motivation and includes all required template sections. The Changes section is not filled in, and the dev-only release-impact option is not selected, but the desc…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the security motivation and includes all required template sections. The Changes section is not filled in, and the dev-only release-impact option is not selected, but the description remains mostly complete.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

nx-cloud · 2026-10-22T10:44:26Z

View your CI Pipeline Execution ↗ for commit 60f7773

Command	Status	Duration	Result
`nx affected --targets=test:sherif,test:knip,tes...`	✅ Succeeded	7m 1s	View ↗
`nx run-many --target=build --exclude=examples/*...`	✅ Succeeded	28s	View ↗

☁️ Nx Cloud last updated this comment at 2026-10-22 11:16:32 UTC

pkg-pr-new · 2026-10-22T10:54:36Z

More templates

@tanstack/angular-query-experimental

npm i https://pkg.pr.new/@tanstack/angular-query-experimental@12278

@tanstack/eslint-plugin-query

npm i https://pkg.pr.new/@tanstack/eslint-plugin-query@12278

@tanstack/lit-query

npm i https://pkg.pr.new/@tanstack/lit-query@12278

@tanstack/preact-query

npm i https://pkg.pr.new/@tanstack/preact-query@12278

@tanstack/preact-query-devtools

npm i https://pkg.pr.new/@tanstack/preact-query-devtools@12278

@tanstack/preact-query-persist-client

npm i https://pkg.pr.new/@tanstack/preact-query-persist-client@12278

@tanstack/query-async-storage-persister

npm i https://pkg.pr.new/@tanstack/query-async-storage-persister@12278

@tanstack/query-broadcast-client-experimental

npm i https://pkg.pr.new/@tanstack/query-broadcast-client-experimental@12278

@tanstack/query-core

npm i https://pkg.pr.new/@tanstack/query-core@12278

@tanstack/query-devtools

npm i https://pkg.pr.new/@tanstack/query-devtools@12278

@tanstack/query-persist-client-core

npm i https://pkg.pr.new/@tanstack/query-persist-client-core@12278

@tanstack/query-sync-storage-persister

npm i https://pkg.pr.new/@tanstack/query-sync-storage-persister@12278

@tanstack/react-query

npm i https://pkg.pr.new/@tanstack/react-query@12278

@tanstack/react-query-devtools

npm i https://pkg.pr.new/@tanstack/react-query-devtools@12278

@tanstack/react-query-next-experimental

npm i https://pkg.pr.new/@tanstack/react-query-next-experimental@12278

@tanstack/react-query-persist-client

npm i https://pkg.pr.new/@tanstack/react-query-persist-client@12278

@tanstack/solid-query

npm i https://pkg.pr.new/@tanstack/solid-query@12278

@tanstack/solid-query-devtools

npm i https://pkg.pr.new/@tanstack/solid-query-devtools@12278

@tanstack/solid-query-persist-client

npm i https://pkg.pr.new/@tanstack/solid-query-persist-client@12278

@tanstack/svelte-query

npm i https://pkg.pr.new/@tanstack/svelte-query@12278

@tanstack/svelte-query-devtools

npm i https://pkg.pr.new/@tanstack/svelte-query-devtools@12278

@tanstack/svelte-query-persist-client

npm i https://pkg.pr.new/@tanstack/svelte-query-persist-client@12278

@tanstack/vue-query

npm i https://pkg.pr.new/@tanstack/vue-query@12278

@tanstack/vue-query-devtools

npm i https://pkg.pr.new/@tanstack/vue-query-devtools@12278

commit: 60f7773

Merge branch 'main' into chore/node-24.22.1-security

60f7773

DogPawHat merged commit f450917 into TanStack:main Oct 22, 2026
9 checks passed

jramosg deleted the chore/node-24.22.1-security branch October 22, 2026 11:22

Navigation Menu

Repository navigation

bump Node.js to 24.22.1 - #12278

bump Node.js to 24.22.1#12278
DogPawHat merged 2 commits into
TanStack:mainfrom
jramosg:chore/node-24.22.1-security

jramosg commented Oct 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

changeset-bot Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 22, 2026 •

edited

Loading

Review skipped

Uh oh!

nx-cloud Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jramosg commented Oct 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎯 Changes

✅ Checklist

🚀 Release Impact

Summary by CodeRabbit

Uh oh!

changeset-bot Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

nx-cloud Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jramosg commented Oct 22, 2026 •

edited by coderabbitai Bot

Loading

changeset-bot Bot commented Oct 22, 2026 •

edited

Loading

coderabbitai Bot commented Oct 22, 2026 •

edited

Loading

nx-cloud Bot commented Oct 22, 2026 •

edited

Loading

pkg-pr-new Bot commented Oct 22, 2026 •

edited

Loading