Skip to content

APS-22954: pin dev/CI Node to 24.22.1 (CVE-2026-111497) - #51

Draft
karanshah-browserstack wants to merge 1 commit into
mainfrom
APS-22954-node-cve
Draft

karanshah-browserstack wants to merge 1 commit into
mainfrom
APS-22954-node-cve

Conversation

@karanshah-browserstack

Copy link
Copy Markdown
Collaborator

Description

Pins .nvmrc and the CI setup-node version to 24.22.1 (was 14.17.5). Two lines, no code or dependency changes.

Motivation and Context

APS-22954 row 16 (EOL / unpatched Node, CVE-2026-111497 Brotli decoder OOB write; fixed in 24.22.1).

Where ws-reconnect-proxy actually runs:

  • It is installed on hub nodes by the infra-config ws_proxy role (hub_nodes.yml, puppeteer_hub.yml playbooks) and its daemontools run script launches it with /usr/bin/node.
  • /usr/bin/node on hub nodes is owned by the hub_code role (hub_node_version, 24.20.0 today). The production runtime bump to 24.22.1 is in infra-config#54287 (APS-22920). That PR also restarts the ws-reconnect-proxy master during the runtime switch.
  • The ticket cites provision/roles/ws_proxy/tasks/node_install.yml (16.20.2). That file isn't included by ws_proxy/tasks/main.yml or anywhere else in infra-config, so it is dead code and doesn't set the production runtime.

This PR closes the remaining gap: dev and CI were still on Node 14 (EOL), so tests were not run on the runtime that ships.

How Has This Been Tested?

Local, macOS arm64, clean npm ci each time:

Baseline Node 14.21.3* Node 24.22.1
npm ci ok ok (no native modules)
npm run eslint pass pass
npm run eslint:test pass pass
npm test (mocha + nyc) 158 passing 158 passing

*14.17.5 has no darwin-arm64 binary, so 14.21.3 was used as the nearest baseline.

node -p "'BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH' in require('zlib').constants" on 24.22.1 prints true.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • My code follows the code style of this project.
  • I have added tests to cover my changes. (n/a, version pin only)
  • All new and existing tests passed.

🤖 Generated with Claude Code

.nvmrc and CI were on 14.17.5 (EOL) while production runs on the hub
fleet's /usr/bin/node (24.20.0 today, 24.22.1 via infra-config#54287).
Align dev and CI with the patched production runtime.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Nov 2, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Central YAML (base), Organization UI (inherited), Workspace UI (inherited); Enforced overrides: Organization
  • Review profile: ASSERTIVE
  • Plan: Enterprise
  • Run ID: cc8bd773-fb42-4f20-94ce-7ab9820569f6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants