Repository navigation
Conversation
sybohy
marked this pull request as ready for review
October 24, 2026 04:53
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Move local and shared component tooling from EOL Node 20 to 22.23.4, replace EOL 18/20 CI test/install/lint/typecheck runners with patched 22.23.4 / 24.22.1, and pin release tooling to 24.22.1 for CVE-2026-111497. Consumer
engines.node >=18.12.0and dependencies are unchanged; browser-library support is a separate declaration from the build machine's Node binary.The devcontainer uses Microsoft’s maintained Bookworm image and copies Node 22.23.4 from a digest-pinned official image into the system path and every inherited nvm binary. This replaces vulnerable inherited binaries as well as the default shell runtime.
Validation:
npm cicompleted on the SHA256-verified Node 22.23.4 binary without changing the lockfile. Production bundles and typecheck passed. The bounded local full suite passed 64/65 tests; its duplicate-DOM DeviceDetails assertion passed when isolated. CI tests, lint, typecheck, package builds, docs and package-install smoke passed on both patched majors; the Vercel preview also passed. The corrected complete devcontainer built and reports v22.23.4 from login-shell PATH, direct/usr/local/bin/node, and nvm after sourcing its initialization script. CI is rerunning for that inherited-binary correction. The package will not be published by this task.Rollout handoff: rebuild developer containers and use
.nvmrclocally; new CI/release jobs use the pinned binaries. Separately verify the Node runtime of hosted docs/examples and servers consuming this library. Updating browser bundles does not replace those servers' Node binary; this CVE alone does not require an npm/CDN release. Any Vercel project still selecting Node 20 needs an operator-selected supported major and fresh deployment, with effective patch verification. No provider setting, release, CDN publish, merge or production deploy was performed.Required-check policy blocker (verified read-only): main still requires four legacy Node 18 contexts. This PR emits honest stable major labels while selecting exact patched binaries through
matrix.node_version. A repository owner must separately map these required contexts before merge; this task did not modify protection or add misleading Node 18 jobs.Install (Node.js v18 on Linux)Install (Node.js v22 on Linux)Test (Node.js v18 on Linux)Test (Node.js v22 on Linux)Lint (Node.js v18)Lint (Node.js v22)Typecheck (Node.js v18)Typecheck (Node.js v22)The stable-label workflow revision is rerunning CI on the same patched binaries. This PR is ready for review but remains blocked from merge until legitimate policy reconciliation.