From d0e7990f5040f891799d01f0df7a95d56aee1ca4 Mon Sep 17 00:00:00 2001 From: Ryan Bahan Date: Wed, 21 Oct 2026 20:50:13 -0600 Subject: [PATCH] Bump pinned Node versions to the Oct 21 security releases The Oct 21 Node.js security releases (22.23.4, 24.22.1, 26.12.1) fix high-severity issues in TLS hostname checks for non-canonical IPs, dns.resolve with NUL bytes, and an out-of-bounds write in Brotli. Every Node version pinned in this repo was on an affected release. None of these pins ship to users; they only control what developers run locally (.nvmrc, dev.yml) and what CI runs (workflow pins and the test matrix). Move all of them to the patched release in their line: 22.12.0 -> 22.23.4 24.1.0 -> 24.22.1 24.12.0 -> 24.22.1 26.1.0 -> 26.12.1 Deliberately unchanged: - engines.node (>=22.12.0) in package.json files: this is the user-facing minimum supported version, a product decision rather than a CVE fix. - pages.yml node-version "22": major-only pin, already resolves to the latest (patched) 22.x. - @types/node and test fixtures: not runtime versions. --- .github/workflows/gardener-backlog-prs.yml | 2 +- .github/workflows/maintenance-prs.yml | 2 +- .github/workflows/release.yml | 6 +++--- .github/workflows/tests-main.yml | 12 +++++------ .github/workflows/tests-manual.yml | 10 ++++----- .github/workflows/tests-pr.yml | 24 +++++++++++----------- .github/workflows/update-graphql-deps.yml | 2 +- .nvmrc | 2 +- dev.yml | 2 +- 9 files changed, 31 insertions(+), 31 deletions(-) diff --git a/.github/workflows/gardener-backlog-prs.yml b/.github/workflows/gardener-backlog-prs.yml index d59486f7ed4..bff4d27fb23 100644 --- a/.github/workflows/gardener-backlog-prs.yml +++ b/.github/workflows/gardener-backlog-prs.yml @@ -35,7 +35,7 @@ jobs: - name: Setup deps uses: ./.github/actions/setup-cli-deps with: - node-version: '26.1.0' + node-version: '26.12.1' - name: Create issue branch run: | diff --git a/.github/workflows/maintenance-prs.yml b/.github/workflows/maintenance-prs.yml index cb88aa5b1f0..f8851c26b55 100644 --- a/.github/workflows/maintenance-prs.yml +++ b/.github/workflows/maintenance-prs.yml @@ -56,7 +56,7 @@ jobs: if: steps.schedule.outputs.run == 'true' uses: ./.github/actions/setup-cli-deps with: - node-version: '26.1.0' + node-version: '26.12.1' - name: Create maintenance branch if: steps.schedule.outputs.run == 'true' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d13e87c2fff..3b3cbadba35 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -181,7 +181,7 @@ jobs: - name: Setup deps uses: ./.github/actions/setup-cli-deps with: - node-version: 24.12.0 + node-version: 24.22.1 - name: Publish snapshot id: publish run: | @@ -259,7 +259,7 @@ jobs: - name: Setup deps uses: ./.github/actions/setup-cli-deps with: - node-version: 24.12.0 + node-version: 24.22.1 - name: Create Release Pull Request id: changesets uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1 @@ -363,7 +363,7 @@ jobs: - name: Setup deps uses: ./.github/actions/setup-cli-deps with: - node-version: 24.12.0 + node-version: 24.22.1 - name: Release run: pnpm release ${{ github.event.inputs.tag || 'nightly' }} env: diff --git a/.github/workflows/tests-main.yml b/.github/workflows/tests-main.yml index d2b7bdb5fc4..cd49b380189 100644 --- a/.github/workflows/tests-main.yml +++ b/.github/workflows/tests-main.yml @@ -22,7 +22,7 @@ env: BUNDLE_WITHOUT: 'test:development' GH_TOKEN: ${{ secrets.SHOPIFY_GH_READ_CONTENT_TOKEN }} GH_TOKEN_SHOP: ${{ secrets.SHOP_GH_READ_CONTENT_TOKEN }} - DEFAULT_NODE_VERSION: '26.1.0' + DEFAULT_NODE_VERSION: '26.12.1' jobs: main: @@ -32,7 +32,7 @@ jobs: strategy: matrix: os: [ 'ubuntu-latest', 'windows-latest', 'macos-latest' ] - node: [ '22.12.0', '24.1.0', '26.1.0' ] + node: [ '22.23.4', '24.22.1', '26.12.1' ] steps: - uses: actions/checkout@v6 name: Checkout [${{ github.ref_name }}] @@ -44,16 +44,16 @@ jobs: node-version: ${{ matrix.node }} - name: Build run: pnpm nx run-many --all --target=build --output-style=stream - if: ${{ matrix.os == 'ubuntu-latest' && matrix.node == '26.1.0' }} + if: ${{ matrix.os == 'ubuntu-latest' && matrix.node == '26.12.1' }} - name: Lint run: pnpm nx run-many --all --target=lint --output-style=stream - if: ${{ matrix.os == 'ubuntu-latest' && matrix.node == '26.1.0' }} + if: ${{ matrix.os == 'ubuntu-latest' && matrix.node == '26.12.1' }} - name: Type-check run: pnpm nx run-many --all --target=type-check --output-style=stream - if: ${{ matrix.os == 'ubuntu-latest' && matrix.node == '26.1.0' }} + if: ${{ matrix.os == 'ubuntu-latest' && matrix.node == '26.12.1' }} - name: Bundle run: pnpm nx run-many --all --target=bundle --output-style=stream - if: ${{ matrix.os == 'ubuntu-latest' && matrix.node == '26.1.0' }} + if: ${{ matrix.os == 'ubuntu-latest' && matrix.node == '26.12.1' }} - name: Unit tests run: pnpm vitest run ${{ env.POOL_OPTIONS }} env: diff --git a/.github/workflows/tests-manual.yml b/.github/workflows/tests-manual.yml index db7b539e808..3c0fcf9a94d 100644 --- a/.github/workflows/tests-manual.yml +++ b/.github/workflows/tests-manual.yml @@ -11,12 +11,12 @@ on: node-version: description: 'Node version' required: true - default: '26.1.0' + default: '26.12.1' type: choice options: - - 22.12.0 - - 24.1.0 - - 26.1.0 + - 22.23.4 + - 24.22.1 + - 26.12.1 os: description: 'Operating system' required: true @@ -41,7 +41,7 @@ env: SHOPIFY_FLAG_CLIENT_ID: ${{ secrets.SHOPIFY_FLAG_CLIENT_ID }} GH_TOKEN: ${{ secrets.SHOPIFY_GH_READ_CONTENT_TOKEN }} GH_TOKEN_SHOP: ${{ secrets.SHOP_GH_READ_CONTENT_TOKEN }} - DEFAULT_NODE_VERSION: '26.1.0' + DEFAULT_NODE_VERSION: '26.12.1' DEFAULT_OS: 'ubuntu-latest' jobs: diff --git a/.github/workflows/tests-pr.yml b/.github/workflows/tests-pr.yml index ff77d5e97a3..d585924e8ae 100644 --- a/.github/workflows/tests-pr.yml +++ b/.github/workflows/tests-pr.yml @@ -16,8 +16,8 @@ env: BUNDLE_WITHOUT: 'test:development' GH_TOKEN: ${{ secrets.SHOPIFY_GH_READ_CONTENT_TOKEN }} GH_TOKEN_SHOP: ${{ secrets.SHOP_GH_READ_CONTENT_TOKEN }} - DEFAULT_NODE_VERSION: '26.1.0' - PLAYWRIGHT_NODE_VERSION: '24.1.0' + DEFAULT_NODE_VERSION: '26.12.1' + PLAYWRIGHT_NODE_VERSION: '24.22.1' jobs: type-check: @@ -159,38 +159,38 @@ jobs: strategy: matrix: os: [ 'ubuntu-latest', 'windows-latest', 'macos-latest' ] - node: [ '22.12.0', '24.1.0', '26.1.0' ] + node: [ '22.23.4', '24.22.1', '26.12.1' ] shard: [ '' ] include: # Add sharding for Windows jobs to reduce wall-clock time - os: windows-latest - node: '22.12.0' + node: '22.23.4' shard: '1/2' - os: windows-latest - node: '22.12.0' + node: '22.23.4' shard: '2/2' - os: windows-latest - node: '24.1.0' + node: '24.22.1' shard: '1/2' - os: windows-latest - node: '24.1.0' + node: '24.22.1' shard: '2/2' - os: windows-latest - node: '26.1.0' + node: '26.12.1' shard: '1/2' - os: windows-latest - node: '26.1.0' + node: '26.12.1' shard: '2/2' exclude: # Exclude the non-sharded Windows entries (replaced by sharded ones above) - os: windows-latest - node: '22.12.0' + node: '22.23.4' shard: '' - os: windows-latest - node: '24.1.0' + node: '24.22.1' shard: '' - os: windows-latest - node: '26.1.0' + node: '26.12.1' shard: '' steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/update-graphql-deps.yml b/.github/workflows/update-graphql-deps.yml index f6da583047d..b2951313bf9 100644 --- a/.github/workflows/update-graphql-deps.yml +++ b/.github/workflows/update-graphql-deps.yml @@ -28,7 +28,7 @@ jobs: - name: Setup deps uses: ./.github/actions/setup-cli-deps with: - node-version: '26.1.0' + node-version: '26.12.1' - name: Get schemas for codegen env: GH_TOKEN: ${{ secrets.SHOPIFY_GH_READ_CONTENT_TOKEN }} diff --git a/.nvmrc b/.nvmrc index b807a943cb3..7dfae3df1d0 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -v26.1.0 +v26.12.1 diff --git a/dev.yml b/dev.yml index 6c6bffb6bfc..596aa68a4d6 100644 --- a/dev.yml +++ b/dev.yml @@ -2,7 +2,7 @@ name: cli up: - node: - version: 26.1.0 + version: 26.12.1 package_manager: pnpm@10.11.1 - packages: - jq