Repository navigation
Conversation
Node.js 20 reached end-of-life in April 2026 and no longer receives security fixes, including the October 2026 security release (CVE-2026-111497 and others). Node.js 24 is the current LTS line.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
Description
Moves the three workflows that set up Node.js (
docs-deploy,release,stats) from Node.js 20 to Node.js 24.Why: Node.js 20 reached end-of-life on 2026-04-30 and no longer receives security fixes. The October 21, 2026 Node.js security release fixed 10 vulnerabilities, including a high-severity RCE in the Brotli decoder (CVE-2026-111497), but only for 22.x, 24.x, and 26.x. With
node-version: 20, these jobs stay on an unpatched runtime. Node.js 24 is the current LTS line.Type of Change
Changes Made
.github/workflows/docs-deploy.yml:node-version: 20→24.github/workflows/release.yml:node-version: "20"→"24".github/workflows/stats.yml:node-version: 20→24website/package.jsonalready declares"node": ">=20.9.0", so no other changes are needed.Compatibility / Package Source
Testing/Screenshots/Recordings
cd Server && uv run pytest tests/ -v)Documentation Updates
tools/UPDATE_DOCS_PROMPT.md(recommended)Related Issues
None.
Additional Notes
This only changes the Node.js version used by CI, so it doesn't touch the Unity package or the Python server. Checked locally on Node.js v24.22.1:
website:npm ci && npm run buildsucceeds (the same stepsdocs-deployruns).node website/scripts/fetch-stats.mjsruns without errors (thestatsjob).python3 tools/generate_mcpb.pybuilds the.mcpbbundle throughnpx @anthropic-ai/mcpb pack(the Node step in thereleasejob).The
docs-deployrun on this PR also builds the site on Node.js 24.Summary by CodeRabbit