Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

security: update bundled Node v24.16.0 to v24.22.1 (October security release)

クローズ
  • 何か問題がありますか？
#2,780 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

関連するプルリクエストがすでにマージされています。

  • #2817 @colbymchenry による — マージ済み

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
52/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
github-actions, node.js
領域
build-system, release

調査の方向性

Start with scripts/build-bundle.sh and the release workflow at .github/workflows/release.yml, which invokes the build without a Node version override. Update the default to a patched Node 24 release, then check how release validation handles each platform bundle and release notes. Done when rebuilt supported bundles contain the patched runtime, validation checks the bundled executable's version, and the release notes state that version.

索引モデルが issue の本文から書いたものです。

説明

Summary

Please update the bundled Node runtime to v24.22.1 or a newer patched Node 24 release and publish rebuilt platform bundles. Updating the host's Node installation does not update the runtime that CodeGraph actually uses.

As of October 22, 2026, the latest CodeGraph release is v1.6.2 (published October 3). Its official macOS ARM64 bundle still runs Node v24.16.0. The current build script also still defaults to that version.

Verified observations

  • Installed npm package: @colbymchenry/[email protected], macOS ARM64.
  • Host Node was updated to v24.22.1; the installed CodeGraph platform package's node --version still returns v24.16.0.
  • Independently downloaded the latest v1.6.2 codegraph-darwin-arm64.tar.gz, verified it against both the GitHub asset digest and release SHA256SUMS, then extracted only its Node executable. That executable also returns v24.16.0 and is byte-identical to the one in the installed 1.6.0 package.

Verified v1.6.2 archive SHA-256:

d74d1bfb4060db63ec3c2b72c4e17f76c31978af3bad6ace4370d1501ac0662e

Bundled macOS ARM64 Node executable SHA-256:

1ee75375e33b94fc34b3b19aede049e11dae90efb63b374dc96d6bdace70c4b8

Reproduction with an installed npm package

node --version
# v24.22.1

CODEGRAPH_PACKAGE="$(npm root -g)/@colbymchenry/codegraph"
"$CODEGRAPH_PACKAGE/node_modules/@colbymchenry/codegraph-darwin-arm64/node" --version
# v24.16.0

The npm shim delegates to the platform bundle. The platform launcher ultimately executes its own "$DIR/node", so changing nvm's default, the host PATH, or the Node that launches the npm shim does not replace this runtime.

Relevant current source at commit 929c65c83a681b4db3f705c3ad9cda03e755527c:

Why v24.22.1

Node v24.22.1, released October 21, 2026, is a security release containing fixes in TLS, DNS, Brotli, HTTP, crypto, and the permission model. This report concerns shipping the patched runtime; it does not establish that every listed CVE is reachable through CodeGraph's MCP or CLI interfaces.

Related existing work:

  • #2617 tracks the Windows shutdown crash in the bundled v24.16.0 runtime.
  • #2619 is open and proposes v24.21.0. That target predates the October 21 security release, so please consider updating the target to at least v24.22.1 before merging and publishing.
  • #1584 is an older open proposal to update the default to v24.19.0.

Requested change

  1. Bump the default bundled runtime to at least v24.22.1 and rebuild/release the supported platform bundles.
  2. Verify the bundled executable's version in release validation, rather than only the Node version running CI or the npm shim.
  3. Document the bundled Node version in release notes so users can check security patch coverage independently of their host Node installation.

No CodeGraph package files or vendor binaries were modified during this verification.

主要言語
C
スター
73.2k
フォーク
4.7k
平均マージ
3時間
マージ済み PR（30日）
623

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

colbymchenry/codegraph のほかの issue

colbymchenry/codegraph の issue をすべて見る

似ている issue

C の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。