Skip to content
This repository was archived by the owner on Oct 22, 2026. It is now read-only.

build(node): Bump Node 16/18 to 24 - #190

Open
sentry-junior[bot] wants to merge 1 commit into
masterfrom
vuln-3216/node-24
Open

sentry-junior[bot] wants to merge 1 commit into
masterfrom
vuln-3216/node-24

Conversation

@sentry-junior

@sentry-junior sentry-junior Bot commented Oct 21, 2026

Copy link
Copy Markdown

Moves .nvmrc (16.14.2), Volta and engines (18.19.1) to Node 24.22.1, and the Cloud Functions deploy runtime from nodejs18 to nodejs24. Node 16 and 18 are end of life and got no release for the eMudhra/emSign CA compromise; Node 24.22.1 updates the bundled root store to NSS 3.131.1 and rejects TLS chains that contain the compromised keys. CI picks up the new version via node-version-file: package.json.

The npm pin (10.2.4) is unchanged.

Refs VULN-3216. Release notes: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

via Geoff Goldsmith.

--

View Junior Session [Sentry]

Co-Authored-By: Geoff Goldsmith <geoff.goldsmith@sentry.io>
@linear-code

linear-code Bot commented Oct 21, 2026

Copy link
Copy Markdown

VULN-3216

This branch has not been deployed

No deployments
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants