Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

security: update bundled Node v24.16.0 to v24.22.1 (October security release)

Chiusa
  • Qualcosa non va?
#2,780 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Una pull request collegata è già stata integrata.

  • #2817 di @colbymchenry — integrata

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
52/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github-actions, node.js
Ambito
build-system, release

Direzione di ricerca

Start with scripts/build-bundle.sh and the release workflow at .github/workflows/release.yml, which invokes the build without a Node version override. Update the default to a patched Node 24 release, then check how release validation handles each platform bundle and release notes. Done when rebuilt supported bundles contain the patched runtime, validation checks the bundled executable's version, and the release notes state that version.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

Please update the bundled Node runtime to v24.22.1 or a newer patched Node 24 release and publish rebuilt platform bundles. Updating the host's Node installation does not update the runtime that CodeGraph actually uses.

As of October 22, 2026, the latest CodeGraph release is v1.6.2 (published October 3). Its official macOS ARM64 bundle still runs Node v24.16.0. The current build script also still defaults to that version.

Verified observations

  • Installed npm package: @colbymchenry/[email protected], macOS ARM64.
  • Host Node was updated to v24.22.1; the installed CodeGraph platform package's node --version still returns v24.16.0.
  • Independently downloaded the latest v1.6.2 codegraph-darwin-arm64.tar.gz, verified it against both the GitHub asset digest and release SHA256SUMS, then extracted only its Node executable. That executable also returns v24.16.0 and is byte-identical to the one in the installed 1.6.0 package.

Verified v1.6.2 archive SHA-256:

d74d1bfb4060db63ec3c2b72c4e17f76c31978af3bad6ace4370d1501ac0662e

Bundled macOS ARM64 Node executable SHA-256:

1ee75375e33b94fc34b3b19aede049e11dae90efb63b374dc96d6bdace70c4b8

Reproduction with an installed npm package

node --version
# v24.22.1

CODEGRAPH_PACKAGE="$(npm root -g)/@colbymchenry/codegraph"
"$CODEGRAPH_PACKAGE/node_modules/@colbymchenry/codegraph-darwin-arm64/node" --version
# v24.16.0

The npm shim delegates to the platform bundle. The platform launcher ultimately executes its own "$DIR/node", so changing nvm's default, the host PATH, or the Node that launches the npm shim does not replace this runtime.

Relevant current source at commit 929c65c83a681b4db3f705c3ad9cda03e755527c:

Why v24.22.1

Node v24.22.1, released October 21, 2026, is a security release containing fixes in TLS, DNS, Brotli, HTTP, crypto, and the permission model. This report concerns shipping the patched runtime; it does not establish that every listed CVE is reachable through CodeGraph's MCP or CLI interfaces.

Related existing work:

  • #2617 tracks the Windows shutdown crash in the bundled v24.16.0 runtime.
  • #2619 is open and proposes v24.21.0. That target predates the October 21 security release, so please consider updating the target to at least v24.22.1 before merging and publishing.
  • #1584 is an older open proposal to update the default to v24.19.0.

Requested change

  1. Bump the default bundled runtime to at least v24.22.1 and rebuild/release the supported platform bundles.
  2. Verify the bundled executable's version in release validation, rather than only the Node version running CI or the npm shim.
  3. Document the bundled Node version in release notes so users can check security patch coverage independently of their host Node installation.

No CodeGraph package files or vendor binaries were modified during this verification.

Lingua principale
C
Stelle
73.2k
Fork
4.7k
Merge medio
11h 28m
PR unite (30g)
596

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di colbymchenry/codegraph

Tutte le issue di colbymchenry/codegraph

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.