[yenienserrano]

Description

Node.js 22.22.0 is affected by the Node.js security release of October 21, 2026 (CVE-2026-111497, CVE-2026-106069 and CVE-2026-105482, High severity). 22.23.4 is the fixed release in the same 22.x LTS line. The upstream OpenSearch Dashboards 3.6 branch still uses 22.22.0, so the bump is applied here.

Closes #1752

Proposed Changes

• Bump .nvmrc and .node-version to 22.23.4. The package build (src/dev/build/lib/config.ts) reads .nvmrc to download the bundled Node.js binary, and the CI workflows read it through node-version-file, so both follow automatically.
• Update the hardcoded NODE_VERSION defaults and examples in dev-tools/:
  • build-dev-image/wzd.dockerfile, build-dev-image/build-multiarch.sh, build-dev-image/README.md
  • build-packages/base-packages-to-base/base-packages.Dockerfile, run-docker-compose.sh, README.md
• Add the CHANGELOG.md entry.

The engines.node range in package.json (>=14.20.1 <23) already accepts 22.23.4, so it is unchanged.

This matches the upstream bump to 22.23.4 (opensearch-project#13037). Upstream opensearch-project#12270, which reduces .nvmrc to the major version (22) and moves the exact version to .node-version, is not adopted here. The package build (src/dev/build/lib/config.ts) and the dev image workflow still read the exact version from .nvmrc, and src/dev/node_versions_must_match.test.ts requires both files to match.

Results and Evidence

Run on the host with the version from .nvmrc (nvm use):

$ node --version
v22.23.4

$ yarn osd bootstrap
 succ [opensearch-dashboards] bootstrap complete
Done in 78.93s.

$ yarn test:jest src/dev/build
Test Suites: 17 passed, 17 total
Tests:       79 passed, 79 total

$ yarn test:jest src/dev/node_versions_must_match.test.ts
Tests:       2 passed, 2 total

$ npx prettier <changed files> --check --ignore-unknown
All matched files use Prettier code style!

$ bash -n build-multiarch.sh run-docker-compose.sh
(no syntax errors)

$ git grep -n "22\.22\.0" -- ':!release-notes' ':!*.lock'
(no matches outside upstream release notes)

Package build

Build run 43047016873 (system=both, architecture=amd64, revision=0, reference_plugins=5.0.0) finished with every job in success, including Generate packages, Test package and Upload package for both DEB and RPM.

The dashboard build downloads and bundles Node.js 22.23.4, with the checksum verified:

Build dashboard / Build (tar.gz)
debg Downloading shasum values for node version 22.23.4 from https://nodejs.org/dist/v22.23.4/SHASUMS256.txt
debg Attempting download of https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-x64.tar.gz b8492284c76a54baf58d61668dd0e41ee0fc98adabf9503d30f05d08f55b4406
debg Downloaded https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-x64.tar.gz and verified checksum

Every build job, including all plugin builds and both package generation jobs, ran on node: v22.23.4.

Generated packages:

• wazuh-dashboard_5.0.0-0_amd64_8c9250e3-f914589-97c31cd-2f39968-d5f3909-7d315e8-de53dc9.deb
• wazuh-dashboard_5.0.0-0_x86_64_8c9250e3-f914589-97c31cd-2f39968-d5f3909-7d315e8-de53dc9.rpm

Node.js bundled in each package, extracted and run in a linux/amd64 container:

# DEB (debian:12-slim)
$ dpkg-deb -x wazuh-dashboard_5.0.0-0_amd64_8c9250e3-....deb /x
$ /x/usr/share/wazuh-dashboard/node/bin/node --version
v22.23.4

# RPM (rockylinux:9)
$ rpm2cpio wazuh-dashboard_5.0.0-0_x86_64_8c9250e3-....rpm | cpio -idm ./usr/share/wazuh-dashboard/node/bin/node
$ /x/usr/share/wazuh-dashboard/node/bin/node --version
v22.23.4

Artifacts Affected

• DEB and RPM packages (bundled Node.js runtime)
• Base package builder image and dev Docker image (NODE_VERSION default)

Configuration Changes

None.

Documentation Updates

• dev-tools/build-dev-image/README.md
• dev-tools/build-packages/base-packages-to-base/README.md

Tests Introduced

None. Version bump only; existing unit tests run with Node.js 22.23.4.

Review Checklist

• Code changes reviewed
• Relevant evidence provided
• Tests cover the new functionality
• Configuration changes documented
• Developer documentation reflects the changes
• Meets requirements and/or definition of done
• No unresolved dependencies with other issues
• PR is linked to the relevant issue(s)
• Correct labels applied (e.g., no-changelog)
• DEB/RPM packages built and node --version returns v22.23.4
• Base package builder and dev images rebuilt and published, if needed

🤖 Generated with Claude Code