Skip to content

chore: restore Node 24.22.1 now that Workers Builds ships it - #1327

Merged
Zach Dunn (zachdunn) merged 1 commit into
mainfrom
cursor/restore-node-24-22-1-9ecc
Oct 28, 2026
Merged

Zach Dunn (zachdunn) merged 1 commit into
mainfrom
cursor/restore-node-24-22-1-9ecc

Conversation

@zachdunn

Copy link
Copy Markdown
Member

.nvmrc is back on Node 24.22.1. Zach Dunn (@zachdunn) pinned 24.18.0 in #1256 because Workers Builds could not install 24.22.1. The Oct 23 build image includes 24.22.1, and that release fixes the actively exploited Brotli RCE (CVE-2026-111497 / GHSA-9v8h-qqgm-4m35).

What it does

  • Sets .nvmrc to 24.22.1.
  • Points GitHub Actions back at .nvmrc. Actions was already on 24.22.1 through a hardcoded NODE_VERSION while .nvmrc stayed on 24.18.0.

What it is not

  • No dependency or override changes. engines stays >=24.
  • The Workers runtime is unchanged. This only affects local tooling and CI.

Test plan

  • Lint & Format
  • Test
Open in Web Open in Cursor 

Node 24.22.1 fixes the Brotli RCE (CVE-2026-111497 / GHSA-9v8h-qqgm-4m35).
Workers Builds images include that release as of 2026-10-23, which was the
blocker for the 24.18.0 pin in #1256. CI reads .nvmrc again.

Co-authored-by: Zach Dunn <zachdunn@users.noreply.github.com>
@changeset-bot

changeset-bot Bot commented Oct 28, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: fe55163

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coderabbitai

coderabbitai Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 2
  • coderabbit:review
  • review
🚫 Excluded labels (none allowed): 1
  • wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 5b7c5743-e3d3-4226-8698-146d832b006e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@zachdunn
Zach Dunn (zachdunn) merged commit e262b54 into main Oct 28, 2026
5 checks passed
@zachdunn
Zach Dunn (zachdunn) deleted the cursor/restore-node-24-22-1-9ecc branch October 28, 2026 13:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants