Require patched Node runtimes

Merged
CO
1d ago
+7-7

Summary

Intent: Prevent CI and billing image builds from selecting Node versions affected by the October security advisory. Pin Node 22.23.4 and restrict supported workspace engines to patched release ranges.

Tracks ANLG-525. Production Vercel patch verification and coordinated Stripe key rotation remain separate follow-up work; this PR does not establish production remediation.

Demo

N/A — runtime and build configuration only; no user-facing UI changes.

Verification

  • Changed-file dprint formatting/check passed.
  • Repository CI Node tests: 95 passed; license-boundary checks passed with Python 3.12.
  • Stripe typecheck passed; billing tests: 105 passed, 5 isolated-Postgres tests skipped.
  • docker build --target billing-runtime -f apps/api/Dockerfile . passed.
  • Changelog/version consistency checks passed.
  • Offline zizmor scan completed with findings on existing workflow configuration; authenticated audits were unavailable.

Summary by cubic

Pins CI workflows and the billing Docker image to Node 22.23.4 and restricts workspace engines to patched releases so builds avoid Node versions affected by the October security advisory.

  • Updates the node-version pin in all five CI setup steps and the billing Docker base image.
  • Replaces the engines range >=22 with ^22.23.4 || ^24.22.1 || >=26.12.1.

Tracks ANLG-525. Production Vercel and Stripe key rotation remain separate follow-ups.