Repository navigation
[#620] Update Node runtime for October security fixes - #621
Conversation
Adr1an04
added
Bug
📝 Walkthrough
Priority: ⬆️ High Severity of issue fixed: High Merge Risk: 🔵 Low · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Out of Scope Changes check |  |
The change to packages/api/src/tests/integration/hackathon-portal-configuration.test.ts replaces direct pool shutdown with trackTestPoolShutdown. This test teardown change does not implement Node … |
Revert the unrelated changes in packages/api/src/tests/integration/hackathon-portal-configuration.test.ts, including the trackTestPoolShutdown import, closePool variable, setup call, and altered afterAll cleanup. |
-
Check name Status Explanation Title check The title starts with issue number [ #620], describes the Node runtime security update, and is 53 characters long.Description check The description directly explains the Node runtime updates, affected files, validation results, and deployment follow-up. Linked Issues check Issue #620requires Node 24.22.1 across development, CI, and Node Docker stages, updated setup documentation, and recorded validation. The PR updates.nvmrc, root engines, documentation, and all rep…Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1… No Hardcoded Secrets No changed line introduces a hardcoded API key, password, token, or secret. Dockerfile secret-related settings continue to reference ${FORGE_BUILD_PLACEHOLDER}. The test fixture token is unchanged f…Validated Env Access No new direct process.envusage was added. The only match in the changed files is the pre-existingprocess.env.DATABASE_URLassignment in `packages/api/src/tests/integration/hackathon-portal-confi…No Typescript Escape Hatches No TypeScript escape hatch was introduced. The only TypeScript change adds a typed pool-close callback and optional chaining; added lines contain no any,@ts-ignore,@ts-expect-error, or non-nul…Full details: Linked Issues check
-
Explanation
Issue
#620requires Node 24.22.1 across development, CI, and Node Docker stages, updated setup documentation, and recorded validation. The PR updates.nvmrc, root engines, documentation, and all reported Node stages. The feature status records passing format, lint, typecheck, build, and focused native/runtime checks under Node 24.22.1. It also records the required production rebuild and redeploy follow-up. Dependency remediation remains excluded as required.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.
Full details: No Hardcoded Secrets
-
Explanation
No changed line introduces a hardcoded API key, password, token, or secret. Dockerfile secret-related settings continue to reference
${FORGE_BUILD_PLACEHOLDER}. The test fixture token is unchanged from the base revision.
Full details: Validated Env Access
-
Explanation
No new direct
process.envusage was added. The only match in the changed files is the pre-existingprocess.env.DATABASE_URLassignment inpackages/api/src/tests/integration/hackathon-portal-configuration.test.ts; the PR only adds pool shutdown tracking around it.
Full details: No Typescript Escape Hatches
-
Explanation
No TypeScript escape hatch was introduced. The only TypeScript change adds a typed pool-close callback and optional chaining; added lines contain no
any,@ts-ignore,@ts-expect-error, or non-null assertion.
-
Full details: Out of Scope Changes check
-
Explanation
The change to
packages/api/src/tests/integration/hackathon-portal-configuration.test.tsreplaces direct pool shutdown withtrackTestPoolShutdown. This test teardown change does not implement Node runtime alignment, documentation, or validation for issue#620.Resolution
Revert the unrelated changes in
packages/api/src/tests/integration/hackathon-portal-configuration.test.ts, including thetrackTestPoolShutdownimport,closePoolvariable, setup call, and alteredafterAllcleanup.
✨ Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
Some tools did not complete. Review the errors below.
🔧 ESLint
-
If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.
packages/api/src/tests/integration/hackathon-portal-configuration.test.ts
-
ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.
-
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Wait for pooled connections to close before dropping the disposable database, using the existing shutdown tracker. Co-authored-by: Codex <codex@openai.com>
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to GitHub limitations.
🟡 Minor · Align the Playwright skill with the Node 24.22.1 baseline. · package.json:7-9
.claude/skills/playwright-skill/package.json:7-9
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAlign the Playwright skill with the Node 24.22.1 baseline.
The standalone skill is outside the root workspace, so the root engine constraint does not apply. Its documented
npm run setupandnodecommands can run under Node 14. Change its engine range to the patched baseline.Suggested fix
- "node": ">=14.0.0" + "node": "^24.22.1"
ℹ️ Review info
⚙️ Run configuration
- Source mode: Auto
- Repository: KnightHacks/forge
- Branch: main
- File: .coderabbit.yml
- Commit: 8097334
- Layers: Repository YAML
- Review profile: QUIET
- Plan: Advanced
- Run ID:
7e0a18a2-e8db-499c-9682-4999ab7fcb8e
📒 Files selected for processing: 1
packages/api/src/tests/integration/hackathon-portal-configuration.test.ts
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Why
Forge's development/CI pin used EOL Node 25.6.1, its engine range admitted obsolete runtimes, and Docker builds used floating Node 24 tags. Align them with Node 24.22.1, which includes the October 21 security fixes.
What
Closes: #620
.nvmrcand all 18 Node stages across 13 Dockerfiles to 24.22.1; restrict root engines to patched 24.x releases..nvmrc.Test Plan
Completed locally under checksum-verified Node 24.22.1, with Turbo cache bypassed:
pnpm format: passed, 24 tasks.pnpm lint: passed, 31 tasks; existing warnings, no errors.pnpm typecheck: passed, 33 tasks.pnpm build: passed, 21 tasks, with checked-in example environment values and one task at a time.git diff --checkpassed.Full application Docker image builds were not completed. Production was not accessed: after merge, rebuild/redeploy Coolify resources and verify Node 24.22.1 in the Node runners. Local
engineschecks remain advisory. Other upstream CVEs were not individually reproduced.Dependency remediation is explicitly excluded: the supplementary audit still reports 6 critical and 69 high counts, documented separately. No UI changes; screenshots are not applicable.
Checklist