fix(nix): build with Node.js 22 now that nixpkgs marks Node 20 insecure

[clay-good]

Status: Approved by @TabishB; ready to merge.

What was wrong: The Nix flake pinned nodejs_20 in both the package build and the dev shell. Node.js 20 reached end of life on 2026-04-30, and nixpkgs now marks it insecure (NixOS/nixpkgs#511784). Anyone consuming the flake against current nixpkgs — the normal case for downstream flakes that follows their own nixpkgs — gets a hard evaluation failure before the build even starts, exactly as reported in #1119.

How it was fixed: Both nodejs_20 references now use nodejs_22 (maintenance LTS until April 2027). This stays within the package's declared support range (engines: node >=20.19.0) and matches the fix the issue suggests.

Replication / proof:

• Repro: evaluate the flake against current nixos-unstable — nixpkgs refuses nodejs_20 as insecure (full trace in [build] Nix build fails because NodeJS 20 was marked as insecure in nixpkgs #1119).
• Proof: the nix-flake-validate CI job runs nix build on every flake.nix change and verifies result/bin/openspec exists, so this PR's green check is a real build with Node 22.

Notes:

• Per maintainer decision in review, this PR stays on nodejs_22; moving the flake to nodejs_24 (which would outlast nixpkgs' insecure threshold by an extra year) is deferred as a follow-up down the line.
• The broader Node 20 sweep Tabish requested (GitHub Actions runtimes, devcontainer image) landed separately as ci: clear Node 20 deprecation warnings by bumping action runtimes #1407.
• The committed flake.lock still pins nixpkgs from 2026-01-05, which is why in-repo CI kept passing while downstream users broke. This PR deliberately leaves the lock alone to stay surgical; a follow-up nix flake update would let CI exercise the same nixpkgs users are on.
• Supersedes fix: use Node.js 22 in Nix flake #1177, which made the identical change but was closed by its author without a way to verify the build.
• The nodejs_20 mentions under openspec/changes/archive/2026-01-07-add-nix-flake-support/ are historical records of that change and are intentionally untouched; no live spec references a Node version.

Fixes #1119

🤖 Generated with Claude Code

[coderabbitai]

📝 Walkthrough

Walkthrough

The Nix flake replaces Node.js 20 with Node.js 22 in the package derivation and development shell inputs.

Changes

Nix Node.js runtime update

Layer / File(s)	Summary
Update Nix runtime inputs flake.nix	The package derivation’s nativeBuildInputs and development shell’s buildInputs now use nodejs_22.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: tabishb, tabishb

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR updates both flake.nix Node.js 20 references to Node.js 22, matching issue #1119's requested fix for insecure Node 20.
Out of Scope Changes check	✅ Passed	The diff is limited to the Node.js version bump in flake.nix, with no unrelated build, shell, or workflow changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the change from Node.js 20 to Node.js 22 to address nixpkgs insecurity.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/nix-nodejs-22

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[TabishB]

Looks good, might be worth doing a sweep of node version across the board. I noticed this warning on our build-deploy CI earlier too:

build-and-deployNode.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, pnpm/action-setup@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
--


[build-and-deploy](https://github.com/xianzheTM/OpenSpec/actions/runs/29812867479/job/88577515496#step:13:2)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, pnpm/action-setup@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

[clay-good]

@TabishB Done — the sweep is up as #1407: it bumps every node20-runtime action to its current Node 24 major (checkout v5, setup-node v6, pnpm/action-setup v6, upload-artifact v6, paths-filter v4, create-github-app-token v3; changesets/action is already node24) and moves the devcontainer off the EOL Node 20 image. Each target major was verified against the action's action.yml/release notes; details and the deliberate non-changes are in that PR's description.

Two things the sweep deliberately leaves alone, for the record:

• node-version: '20.19.0' in CI stays — the runner warning is about the actions' own runtime, not the node-version input, and 20.19.0 is the only guard on the declared engines: >=20.19.0 floor. Raising the floor itself would be a semver-major decision.
• This PR stays on nodejs_22. One honest caveat from a deeper review pass: nixpkgs' insecure threshold is versionOlder "22" today, so 22 re-arms the same breakage around April 2027 when Node 22 leaves maintenance; nodejs_24 (already nixpkgs' default nodejs) would buy an extra year. Happy to swap this PR to nodejs_24 if you prefer — otherwise merging as-is is safe (verified: nodejs_22 exists in the locked rev, the pnpmDeps hash doesn't depend on the node input, and dist output is tsc-deterministic across node majors).

[TabishB]

@clay-good We can leave at 22 for now, we'll do 24 down the line