Repository navigation
chore: raise Node floor to the Oct 2026 security releases; bump vitest, happy-dom, ext-apps, ip-address - #2852
Merged
Conversation
…eases (#2822) engines.node goes from >=22.19.0 to ^22.23.4 || ^24.22.1 || >=26.12.1, the patched release on each supported line, so npm warns (EBADENGINE) on an unpatched runtime. A per-line range is what keeps an unpatched 24.x or 26.x from satisfying it. Every doc that states the floor is updated. The code comments that reasoned from the 22.19 floor were re-read rather than replaced: - NODE_USE_ENV_PROXY was "unsupported at our floor"; it was added in 22.21.0, so it exists at 22.23.4. It is still no substitute: opt-in at process start and Stability 1.1. The comments now say that. - The short-GCM-tag note said only Node 22 accepts a truncated tag. The floor now spans 22 and 24, and 24 only runtime-deprecates it (DEP0182); Node 26 is where it is end-of-life. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: cliffhall <cliff@futurescale.com>
Lockfile-only: ^2.0.0 already admits 2.0.4. Upstream calls it a patch of example and dependency changes with no library API change; its exports map and dependency set are identical to 2.0.3, so the bundler externals need no change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: cliffhall <cliff@futurescale.com>
The four-edit vitest bump: the exact pins on vitest and @vitest/coverage-v8 (root) and @vitest/browser-playwright (web), plus web's vitest overrides entry. Clears GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp, and the @storybook/addon-vitest finding that was only inherited from vitest. ip-address (transitive, via server-legacy -> express-rate-limit ^10.2.0) is an in-range npm update, so no overrides entry. fast-uri was already fixed at 3.1.9 by #2820. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: cliffhall <cliff@futurescale.com>
happy-dom 21 turns iframe page loading off by default. The web unit project already stopped child-frame navigation, but with loading off every sandbox iframe now logs a NotSupportedError and gets no contentWindow. Turning enableIframePageLoading back on restores the previous behavior; the navigation flag still stops the frame before it fetches anything. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: cliffhall <cliff@futurescale.com>
This was
linked to
issues
Oct 29, 2026
Closed
Closed
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are identified for the runtime and dependency updates.
No open issues 🎉
1 file not reviewed
clients/web/package-lock.json: Generated file
What changed in this PR
This PR updates Inspector’s runtime requirements and dependencies to address the security and maintenance work tracked in #2822, #2814, #2813, and #2811.
Changes:
- Raises the Node requirement to
^22.23.4 || ^24.22.1 || >=26.12.1and updates documentation and runtime-related comments. - Updates Vitest to 4.1.12, happy-dom to 21.0.4, ext-apps to 2.0.4, and ip-address to 10.7.5.
- Adjusts the web test configuration for happy-dom 21, enabling iframe creation while keeping child-frame navigation disabled.
| File | Description |
|---|---|
specification/v2_cli_tui_launcher.md |
Updates the Node requirement beside build-target documentation. |
scripts/verify-typecheck-coverage.mjs |
Updates the Node floor in a compatibility comment. |
README.md |
States the patched Node requirements. |
package.json |
Raises Node requirements and pins updated Vitest packages. |
package-lock.json |
Locks the Node requirement and root dependency updates. |
docs/v1-to-v2-migration.md |
Explains the new Node requirements and their security rationale. |
docs/cli-smoke-testing.md |
Updates smoke-test prerequisites. |
core/mcp/remote/node/server.ts |
Corrects the native proxy-support comment. |
core/mcp/node/proxyFetch.ts |
Refreshes the proxy compatibility comment. |
core/auth/node/file-secret-store.ts |
Clarifies Node-version behavior for short authentication tags. |
clients/web/vite.config.ts |
Preserves test iframe creation without child-frame navigation. |
clients/web/src/test/setup.ts |
Updates the happy-dom version in a comment. |
clients/web/src/test/integration/mcp/remote/server-extra-coverage.test.ts |
Corrects the proxy-support test comment. |
clients/web/src/test/integration/auth/node/file-secret-store.test.ts |
Clarifies authentication-tag test comments across Node versions. |
clients/web/package.json |
Updates happy-dom, the Vitest browser provider, and the Vitest override. |
clients/web/package-lock.json |
Locks the web testing dependency updates. |
clients/cli/README.md |
Updates Node requirements and explains native proxy limitations. |
AGENTS.md |
Updates the development Node requirement. |
.github/ISSUE_TEMPLATE/1-bug_report.yml |
Updates Node-version guidance and its example. |
.claude/skills/local-dev/SKILL.md |
Aligns installation prerequisites with the new Node requirement. |
Review effort: Balanced
Member
Author
|
Copilot review loop closed: round 1 was clean (no inline comments, nothing in the headline, no suppressed comments). Per pr-flow 7c, one clean round ends the loop. |
This was referenced Oct 29, 2026
Closed
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2822
Closes #2814
Closes #2813
Closes #2811
One PR for four issues because they all edit the same manifests and lockfiles. There is one commit per issue.
#2822: Node engines floor
engines.nodechanges from>=22.19.0to^22.23.4 || ^24.22.1 || >=26.12.1inpackage.jsonand in the lockfile root entry.docs/cli-smoke-testing.md,docs/v1-to-v2-migration.md(keeps theundici@^8history and adds the security reason), the bug-report template, and the floor line inclients/cli/README.md. Two more mentions are updated too:specification/v2_cli_tui_launcher.mdand the floor note inscripts/verify-typecheck-coverage.mjs.NODE_USE_ENV_PROXY: the comments said it was "unsupported at our 22.19 floor". It was added in 22.21.0, so it exists at 22.23.4. It still doesn't replace our proxy handling, because it's opt-in at process start and only Stability 1.1. The comments now say that, incore/mcp/remote/node/server.ts,server-extra-coverage.test.ts, and the proxy paragraph ofclients/cli/README.md.core/mcp/node/proxyFetch.tsonly named the floor, and that is reworded.file-secret-store.tsand its test): the comments said only "Node 22 (the floor)" accepts a truncated tag. The floor now admits 22 and 24. Node 24 only runtime-deprecates DEP0182, so it still authenticates a 4-byte tag, and Node 26 is where that behavior is end-of-life. The comments now name all three.mcr.microsoft.com/playwright:v1.64.0-noble) ships Node 24.21.0, so itsnpm installnow printsEBADENGINE. It is only a warning and the smoke passes. It does show the new floor doing its job. Raising the image's Node is out of scope here.#2814: vitest 4.1.12, ip-address
vitestand@vitest/coverage-v8at the root,@vitest/browser-playwrightin web, and web'svitestoverridesentry, all at4.1.12. Novitest.shared.mtspin covers a vitest package, so none moves.@storybook/addon-vitest(10.6.2) was flagged only through its vitest dependency, and the flag clears with no change to it.ip-address10.7.2 → 10.7.5 is an in-rangenpm update: it is transitive viaserver-legacy→express-rate-limit(^10.2.0), so nooverridesentry is needed.fast-uriwas already fixed at 3.1.9 by chore(deps): update fast-uri to 3.1.9 past four moderate advisories (ships via ajv) #2820 (3be6b50). I checked:ajv→fast-uri@3.1.9, and the advisory doesn't appear in the audit.#2813: happy-dom 21.0.4
clients/webhappy-domis now^21.0.4(it was at 20.14.5).NotSupportedError: Iframe page loading is disabled(107 times in the unit run) and got nocontentWindow. The unit project already setnavigation.disableChildFrameNavigation, which stops that frame before it fetches anything. SettingenableIframePageLoading: truealongside it restores the 20.x behavior exactly, and still sends no request. I confirmed this inBrowserFrameNavigator:validateFrameNavigationreturns before anyFetch. The unit run is quiet again.#2811: ext-apps 2.0.4
^2.0.0already admits it). The issue has no automated analysis comment, only the triage comment. Upstream's notes say "No changes to the library API". Theexportsmap and dependency set match 2.0.3 exactly, so the bundler externals don't change.verify:bundle-externalspasses in the gate.Versions and audit
npm auditrootnpm auditclients/webLockfile churn stays inside the bumped packages. Besides them, only
chai,std-env,tinyrainbow(vitest's own dependencies) and@types/ws(happy-dom's) moved. No lockfile was deleted.verify:dep-locksteppasses.npm run local:gateis green.🤖 Generated with Claude Code