[khvn26]

Changes

Eight eMudhra intermediate CAs had trivially recoverable private keys (Mozilla bug 2083449, details). Browsers block them via OneCRL/CRLSets, but runtimes and libraries that ship their own CA bundle keep trusting them until updated.

• frontend/.nvmrc, docs/.nvmrc: v24.21.0 → v24.22.2 (fix in 24.22.1). Used by the frontend PR, deploy, Chromatic, e2e and docs workflows.
• api/.nvmrc: 20 → 24. Node 20 is EOL and won't get the fix.
• uv 0.11.18/0.12.19 → 0.13.7 (fix in 0.13.5): mcp/Dockerfile UV_VERSION, the uv-pre-commit rev, and the required-version floors in api/ and mcp/ so they stay in sync.

No Python changes needed: certifi is already at 2026.10.23 in both lockfiles, and botocore uses certifi's bundle when it's installed, so the boto3<1.36 pin can stay.

flagsmith-ee will pick this up on its next OSS merge.

How did you test this code?

• uv lock --check passes for api/ and mcp/ with uv 0.13.7.
• CI exercises the new Node version through frontend/.nvmrc.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 6, 2026 2:44pm UTC
flagsmith-frontend-preview	Ready	Preview	Nov 6, 2026 2:44pm UTC
flagsmith-frontend-staging	Ready	Preview	Nov 6, 2026 2:44pm UTC

[coderabbitai]

Walkthrough

The configured Node.js version changes from 20 to 24 for the API, and from v24.21.0 to v24.22.2 for documentation and frontend. The configured uv version changes from 0.11.18 to 0.13.7 in API and MCP requirements, the MCP Docker image, and the pre-commit revision.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: Low · up to 4686a

API Docker builds using a cached older uv image can fail against the new minimum version. Pinning or refreshing that image avoids the failure; the Node pins also leave existing security-remediation gaps to address.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-api-test:pr-8898	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api:pr-8898	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-8898	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-8898	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-e2e:pr-8898	Finished ✅	Skipped

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.90%. Comparing base (773f1c0) to head (4686a4c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8898   +/-   ##
=======================================
  Coverage   98.90%   98.90%           
=======================================
  Files        1698     1698           
  Lines       71491    71491           
=======================================
  Hits        70707    70707           
  Misses        784      784           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #22922 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 4 passed

Details

 4 tests across 4 suites
 45.9 seconds
 4686a4c
 🔄 Run: #22922 (attempt 1)

🗂️ Previous results

✅ private-cloud · depot-ubuntu-latest-16 — run #22922 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 4 passed

Details

 4 tests across 4 suites
 41.9 seconds
 4686a4c
 🔄 Run: #22922 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #22922 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 35.8 seconds
 4686a4c
 🔄 Run: #22922 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #22922 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 31.5 seconds
 4686a4c
 🔄 Run: #22922 (attempt 1)

[github-actions]

Visual Regression

24 screenshots compared. See report for details.
View full report

[coderabbitai]

Actionable comments posted: 3

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 552b940b-2237-405d-982b-b2fd004d0fb5

Commits

Reviewing files that changed from the base of the PR and between 773f1c0 and 4686a4c.

Files selected for processing: 7

• .pre-commit-config.yaml
• api/.nvmrc
• api/pyproject.toml
• docs/.nvmrc
• frontend/.nvmrc
• mcp/Dockerfile
• mcp/pyproject.toml

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.