build(node): bump Node.js 26.11.1 to 26.12.1 security release
PR
- Have you followed the contributing guidelines?
- Have you explained what your changes do, and why they add value?
Please note: we will close your PR without comment if you do not check the boxes above and provide ALL requested information.
Security patch: bump every exact Node.js 26 pin from 26.11.1 to 26.12.1, the latest Node 26 release (2026-10-21, security: true in https://nodejs.org/dist/index.json). Same major, no runtime migration.
| Where | Old | New |
|---|---|---|
.nvmrc | 26.11.1 | 26.12.1 |
FROM node:…-alpine3.24, every stage of .deploy/{api,worker,webapp,mcp,mcp-auth}/Dockerfile (17 lines) | 26.11.1 | 26.12.1 |
actions/setup-node node-version in the agent, desktop, desktop-timer, server, server-api, server-mcp demo/stage/prod workflows (66 lines, 18 files) | 26.11.1 | 26.12.1 |
.codacy/codacy.yaml runtime (Codacy CLI only) | node@22.2.0 | node@22.23.4 |
Left as is, because they already float to the newest patch on rebuild: node:26-trixie-slim (desktop Linux Dockerfiles) and node-version: 26 / '26' (build, egress-audit, graphql-schema, mirror-releases-to-r2 workflows). engines (>=26) and @types/node (^26.6.5) are ranges, not pins.
node:26.12.1-alpine3.24 exists on Docker Hub. No tests run, per the owner's instruction for this security bump.
🤖 Generated with Claude Code
Summary by cubic
Bumps every pinned Node.js 26 reference from 26.11.1 to 26.12.1 to pick up the 2026-10-21 security release. This covers .nvmrc, all 17 Dockerfile stages, and every setup-node version across the agent, desktop, server, server-api, and server-mcp workflows.
- Codacy CLI runtime bumps from node@22.2.0 to node@22.23.4 (same major).
- Floating refs (
node-version: 26,node:26-trixie-slim) are left alone; they resolve to the newest patch on rebuild. - Same major version, no runtime migration needed.