[plum117]

What & why

Fixes #450

Require the Node.js releases with the updated CA store for the eMudhra intermediate CA compromise ("ca-cert (eMudhra Intermediate CA Compromise) on 26.x, 24.x, 22.x" in the October 2026 security releases). Same range as webdriverio/webdriverio#16211:

"engines": { "node": ">=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1" }

Place	Change
engines.node in backend, service, selenium-devtools, nightwatch-devtools	>=22.19.0 → the range above; minor changeset
selenium-devtools-py require_node()	One floor per line (NODE_LINE_FLOORS) instead of one minimum: refuses a release below its line's floor and the odd lines 23 and 25, accepts a line newer than 26. minor fragment in changes/
ci.yml (3 jobs), release.yml	check-latest: true on the .nvmrc setup: a bare 24 took the runner cache (24.21.0) in webdriverio/webdriverio#16211
README, selenium-devtools-py README, CONTRIBUTING (said ≥ 20)	New floors

require_node() before and after (probe with a mocked node --version):

Node	20.20.2	22.22.3	22.23.4	23.99.0	24.20.0	24.22.1	25.9.0	26.11.1	26.12.1	27.0.0
Before	refused	accepted	accepted	accepted	accepted	accepted	accepted	accepted	accepted	accepted
After	refused	refused	accepted	refused	refused	accepted	refused	refused	accepted	accepted

How I tested

Command	Node 22.23.4	Node 24.22.1
pnpm install --frozen-lockfile (pnpm 10.26.1)	ok, no engine warning	ok, no engine warning
pnpm build	ok	ok
pnpm test	2819 passed, 3 skipped	2819 passed, 3 skipped
pnpm lint	ok	ok

Python 3.14 (CI uses 3.10 and 3.13): PYTHONPATH=src python -m unittest discover -s tests → 765 tests; test_node_runtime 16 passed. One failure, test_screencast … test_finalize_encodes_and_delivers_frame, fails the same way with the main source on this Mac, so it is not from this change. scripts/changes.py check --base origin/main → "src/ changed and a change fragment is present". pnpm changeset status → minor for the 4 packages.

Type of change

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Polish (an improvement to an existing feature)
• Breaking change (existing behavior changes for users)
• Documentation
• Internal (build, CI, dependencies, tooling)

Packages touched

• shared (types and contracts)
• core (framework-agnostic capture/reporting)
• elements (published element/snapshot API — @wdio/elements)
• service (WebdriverIO adapter)
• nightwatch-devtools (Nightwatch adapter)
• selenium-devtools (Selenium adapter)
• selenium-devtools-py (Selenium Python adapter)
• backend (server)
• app (UI)
• script (page-injected runtime)
• trace (Trace mode)

Notes for reviewers

• Why not in core: only package.json metadata changes in the adapters; the one runtime check is the Python adapter's, because a Python user has no engines to read.
• The Python check is now stricter than the pinned backend (BACKEND_NPM_VERSION = "2.0.0", engines >=22.19.0) until the next backend release and its pin bump.
• @wdio/devtools-app, @wdio/elements and @wdio/devtools-script have no engines; adding one is a new constraint, so it is not part of this PR.
• engines only warns, except with Yarn 1 or npm --engine-strict. WebdriverIO shipped the same range as a minor version.

Screenshots / recordings

Not a UI change.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with the previous release-note issue fixed.

Summary

Raises the supported Node.js versions across four npm packages and the Python adapter.

• The JavaScript packages require Node releases with the updated certificate store.
• The Python adapter checks Node's release line before starting a local backend.
• CI and release jobs select the latest Node version listed in .nvmrc.

_{Reviews (4) · Last reviewed commit: "docs(selenium-devtools-py): install-back..." · Reviewed by Greptile}

[plum117]

@vishnuv688, any concerns about merging this PR? Thanks!

[vishnuv688]

@vishnuv688, any concerns about merging this PR? Thanks!

Thanks @plum117, looks good.

One thing: Python users on a Node release below the new floors (e.g. 22.22) will now hit a RuntimeError at enable() instead of a warning. Could the changes/ fragment say that plainly? Right now only the odd-line refusal is spelled out.

Also, does the Node requirement on the webdriverio docs site need updating too?

Happy to approve after that.

[plum117]

Thanks @vishnuv688, both done:

1. changes/ fragment: it now says plainly what changes for a Node release below the floor of its line (for example 22.22 or 24.21), which worked before: enable() logs a warning naming the found and the needed versions, returns None, and the run continues without capture; selenium-devtools install-backend prints the error and exits 1 when it installs (no backend on disk, or --force; e905622). (Correction, f3c9000: enable() catches the RuntimeError of the Node check, so it does not raise, as Greptile noted; my first wording in ffcee7f said it raised.) DEVTOOLS_PORT still needs no local Node. python3 scripts/changes.py check --base origin/main passes.
2. webdriverio docs: yes, 4 places in devtools/GettingStarted.md and devtools/Selenium.md still say 22.19. Draft fix(@wdio/vitest-framework, @wdio/lighthouse-service): require Node.js 22.23.4, 24.22.1 or 26.12.1 in engines and docs webdriverio#16257 updates them, to merge once the selenium-devtools release with this PR is out.

[vishnuv688]

LGTM