Repository navigation
security - patch Node and dependency advisories (23 Oct 2026) - #192
Conversation
Move off end-of-life Node 25.8.2 to Node 24.22.1 (.nvmrc, both Dockerfiles, linter and test workflows) for the 21 Oct 2026 Node.js security release; engines and every lockfile engine range accept 24. Take in-range updates of lodash, dompurify, vue, vue-router, reka-ui and vite, which clear the high audit findings in lodash, dompurify, defu, picomatch, postcss, nanoid, source-map-js, @vue/server-renderer and vite.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe configured Node.js version changes from 25.8.2 to 24.22.1 across local, CI and Docker configuration. Five runtime dependency ranges and the Vite development dependency range also increase. ChangesNode.js version alignment
Package dependency range updates
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title names the security focus and the two kinds of change in the PR, Node runtime and dependency advisories. The changeset moves Node from 25.8.2 to 24.22.1 across .nvmrc, Dockerfiles and workflo… |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Title check
-
Explanation
The title names the security focus and the two kinds of change in the PR, Node runtime and dependency advisories. The changeset moves Node from 25.8.2 to 24.22.1 across .nvmrc, Dockerfiles and workflows, and raises the ranges of lodash, dompurify, vue, vite, vue-router and reka-ui. The title is specific and matches the main change. Its date reference (23 Oct 2026) and its generic 'security' prefix add little, but they do not make it misleading.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (6 skipped: 6 unsupported.)
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Changes
.nvmrc,docker/Dockerfile,docker/Dockerfile.caddy-watcher(NODE_VERSION),.github/workflows/linter.yml,.github/workflows/test.yml25.8.2→24.22.1engines(^20.19.0 || >=22.12.0) and every engine range inpnpm-lock.yamlaccept 24.22.1.docker/Dockerfilepackage.json,pnpm-lock.yamllodash4.17.23 → 4.18.1,dompurify3.3.3 → 3.4.17,vue3.5.30 → 3.5.44,vite8.0.0 → 8.3.5,vue-router5.0.3 → 5.4.0,reka-ui2.9.2 → 2.11.0 (pulls indefu6.1.7), pluspostcss8.5.31,nanoid3.3.20,source-map-js1.2.2,picomatch4.0.7Checks
pnpm audit --prod --audit-level high: before 11 high, after 0 high (2 moderate left)pnpm install --frozen-lockfile,pnpm test(207/207),pnpm lint(0 errors),pnpm format:check,pnpm build: passdocker/nodejs-keyring.kbxverifies the v24.22.1SHASUMS256.txt.asc(good signature, Antoine du Hamel). A local image build could not run: Docker Hub returned 429 fordebian:bookworm-slim.Follow-ups
caddy:2.10.0-alpine(the artefact stage and thecaddy-localservice) is a frozen tag on Alpine 3.21.4 withca-certificates20250619, so it lacks the eMudhra refresh (CVE-2026-111943). Onlycaddy:2-alpine(2.11.7, Alpine 3.23.7,ca-certificates20261020-r0) carries it, which means a Caddy minor upgrade. I left it out of this patch.🤖 Generated with Claude Code
Summary by CodeRabbit