Repository navigation
[chore]: run CI on Node.js 24.22.1 or later and upgrade pip and certifi for the release scripts - #1478
Merged
Conversation
A major-only node-version is satisfied by any 24.x already in the runner's tool cache, so '24' picked up 24.21.0 on the last build-and-test run, and the Storybook deploy still asked for 18.x. Node.js 24.22.1 updates the bundled root certificates to NSS 3.131.1 and rejects chains through the eMudhra (emSign) intermediates whose keys were reported compromised in October 2026. npm, yarn and corepack verify TLS with the CA store of the Node that runs them, so they follow the same version. All six setup-node steps now ask for '>=24.22.1 <25'. A cached 24.x that satisfies the range is used as before; otherwise setup-node downloads the newest matching release from its manifest. The upper bound keeps the workflows on the 24 line the repository already builds and publishes with. The Storybook deploy moves from 18 to 24 with this. `yarn build:storybook` on 24.22.1 produces the same 56 index entries as the Storybook currently published from 18.20.8.
The release job installed requests with the runner's system pip3 and ran its helper scripts on the system python3, so nothing in the workflow set the pip version or a floor for certifi. requests verifies TLS against certifi's bundle rather than the OS store, so a runner image update does not reach it. Python 3.12 is now set up as the first step, pip is upgraded, and requests is installed with certifi>=2026.10.19, the release that drops the affected emSign root (pip 26.2.2 vendors the same one). The existing python3 and pip3 calls resolve to that interpreter, and because the setup comes first, the rollback step finds it in place whichever later step fails. The install step prints the pip and certifi versions it ended up with.
|
| CVE | Package | Version | Fix |
|---|---|---|---|
| CVE-2024-21539 | @eslint/plugin-kit |
0.2.0 |
0.2.3 |
| CVE-2026-111755 | follow-redirects |
1.16.0 |
1.16.1 |
| CVE-2026-111756 | follow-redirects |
1.16.0 |
1.16.1 |
| CVE-2026-111181 | body-parser |
1.20.8 |
1.20.9 |
| CVE-2026-112942 | launch-editor |
2.14.1 |
2.14.2 |
🟡 Medium · 4 findings
| CVE | Package | Version | Fix |
|---|---|---|---|
| CVE-2026-110180 | fast-uri |
3.1.8 |
3.1.9 |
| CVE-2026-110306 | fast-uri |
3.1.8 |
3.1.9 |
| CVE-2026-112944 | launch-editor |
2.14.1 |
2.14.2 |
| CVE-2026-112943 | launch-editor |
2.14.1 |
2.14.2 |
🟢 Low · 4 findings
| CVE | Package | Version | Fix |
|---|---|---|---|
| CVE-2026-110725 | fast-uri |
3.1.8 |
3.1.9 |
| CVE-2026-115897 | serialize-javascript |
4.0.0 |
7.1.3 |
| CVE-2026-110095 | fast-uri |
3.1.8 |
3.1.9 |
| CVE-2026-115897 | serialize-javascript |
6.0.2 |
7.1.3 |
✅ Resolved · 2 findings
| CVE | Package | Version |
|---|---|---|
| CVE-2026-97058 | sprintf-js |
1.0.3 |
| CVE-2026-93687 | braces |
3.0.3 |
View full analysis in Upwind Console
Scan completed in 15s
Scan history (1 scan)
| Commit | Scanned at | New | Resolved | Net |
|---|---|---|---|---|
5517d33 < |
2026-10-26 06:29 UTC | +13 | -2 | +11 |
Last scanned: 5517d33 · 2026-10-26 06:29 UTC
✅ Deploy Preview for sendbird-uikit-react ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
| Commit | Scanned at | New | Resolved | Net |
|---|---|---|---|---|
5517d33 < |
2026-10-26 06:29 UTC | 0 | 0 | 0 |
Last scanned: 5517d33 · 2026-10-26 06:29 UTC
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
sf-tyler-jeong
added a commit
that referenced
this pull request
Oct 26, 2026
Both setup-node steps asked for '24', which any 24.x in the runner's tool cache satisfies; the last run of this workflow used the cached 24.21.0. Node.js 24.22.1 updates the bundled root certificates to NSS 3.131.1 and rejects chains through the eMudhra (emSign) intermediates whose keys were reported compromised in October 2026. The E2E jobs install packages, download the browser and call the Platform API through that Node. Ask for '>=24.22.1 <25' in the shard and merge-report jobs, the same range #1478 sets for the other workflows.
OnestarLee
approved these changes
Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A major-only
node-versionis satisfied by whatever matching release the runner already has in its tool cache, so'24'picked up the cached 24.21.0 on the latest build-and-test run, and the Storybook deploy still asked for18.x. Node.js 24.22.1 updates the bundled root certificates to NSS 3.131.1 and rejects certificate chains through the eMudhra (emSign) intermediates whose private keys were reported compromised in October 2026. npm, yarn and corepack verify TLS with the CA store of the Node that runs them, so every workflow now asks for 24.22.1 or later.The release job also runs Python helper scripts that use
requests, which verifies TLS against certifi's bundle rather than the OS store, so a runner image update does not reach it. Those scripts ran on the runner's system Python and pip with no version set by the workflow. The job now sets up its own Python, upgrades pip, and installs certifi 2026.10.19 or later, the release that drops the affected emSign root (pip 26.2.2 vendors the same one).Changes
actions/setup-nodestep now setsnode-version: '>=24.22.1 <25':build-and-test.yml,coverage.yml,deploy-github-pages.yml,package-publish.yml,prepare-changelog.yml,release-workflow.yml. A cached 24.x that satisfies the range is used as before; otherwise setup-node downloads the newest matching release from theactions/node-versionsmanifest. The upper bound keeps every workflow on the 24 line that build-and-test and the release already use.deploy-github-pages.ymlmoves from Node 18 to 24 with this.bitovi/github-actions-storybook-to-github-pagesis a composite action that runsyarn installandyarn build:storybookon the Node set up in the step before it, so this input alone decides which Node builds Storybook.release-workflow.ymlnow starts withactions/setup-python@v7(Python 3.12) and a step that upgrades pip, installsrequestswithcertifi>=2026.10.19, and prints the pip and certifi versions it ended up with. The existingpip3 install requestsandpython3 …calls resolve to this interpreter and findrequestsalready installed. Both steps come first so thatJira - Rollback on failure, which runs when any later step fails, gets the same interpreter.actions/setup-pythonis referenced by tag, as every other action in these workflows is.Backward compatibility
No changes to the published package — only files under
.github/workflows/change.yarn api:snapshotleavesapi/surface.d.tsunchanged andyarn package:checkpasses.Testing
Setup Node.jsstep resolved'>=24.22.1 <25'to Node.js 24.22.1 (Acquiring 24.22.1 - x64 from …/node-24.22.1-linux-x64.tar.gz; node v24.22.1, npm 11.19.1, yarn 3.5.0), and every step passed with 1330 tests passing, 9 skipped (job log).yarn install --immutable,yarn lint,yarn typecheck,yarn build,yarn api:snapshot(no change toapi/surface.d.ts),yarn package:check,yarn test(1330 passed, 9 skipped) — all pass.yarn installandyarn build:storybooksucceed, and the generatedindex.jsonhas the same 56 entries as the Storybook currently published to GitHub Pages, which was built on Node 18.20.8.'>=24.22.1 <25'evaluated withsemveragainst theactions/node-versionsmanifest resolves to 24.22.1; the cached 24.21.0 does not satisfy it.yarn lint·yarn typecheck·yarn build·yarn test·yarn build:apps:testing·yarn api:snapshot·yarn package:checkpass on Node.js 24.22.1.Changelogs