From d2e9c4361cf27790f6d93287841141b72b1ce389 Mon Sep 17 00:00:00 2001 From: Savio Dias Date: Tue, 10 Nov 2026 16:32:02 +0530 Subject: [PATCH 1/2] chore(security): pin CI/publish Node to 24.22.1, raise engines floor to 22.23.4 CI, publish, and release workflows were building, testing, and publishing on floating and EOL Node tags (22.x, lts/*), which can silently resolve to Node releases carrying known CVEs. Following the October-2026 Node security release that fixed the Brotli decoder out-of-bounds write (CVE-2026-111497), this pins every workflow to Node 24.22.1 and runs CI against a fixed matrix of 22.23.4 (supported floor) and 24.22.1 (target). - .github/workflows/mcp-ci.yml: matrix node-version [22.x] -> [22.23.4, 24.22.1] - .github/workflows/npm-publish.yml: 22.x -> 24.22.1 - .github/workflows/beta-release.yml: 22.x -> 24.22.1 - .github/workflows/bump-version.yml: 22.x -> 24.22.1 - .github/workflows/mcp-registry-publish.yml: "lts/*" -> 24.22.1 - package.json: engines.node ">=20.9.0" -> ">=22.23.4" The engines field stays advisory (no engine-strict / .npmrc), so customers on older Node get a warning, not a hard install failure. node-version-notice.ts is intentionally left unchanged: its major-22 floor is correct now that Node 22 LTS is patched. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/beta-release.yml | 2 +- .github/workflows/bump-version.yml | 2 +- .github/workflows/mcp-ci.yml | 2 +- .github/workflows/mcp-registry-publish.yml | 2 +- .github/workflows/npm-publish.yml | 2 +- package.json | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/beta-release.yml b/.github/workflows/beta-release.yml index 5944ac73..fb2d5718 100644 --- a/.github/workflows/beta-release.yml +++ b/.github/workflows/beta-release.yml @@ -19,7 +19,7 @@ jobs: - name: "Set up Node.js" uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 22.x + node-version: 24.22.1 registry-url: "https://registry.npmjs.org/" - name: "Install dependencies" diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml index 52b7d66e..0614bd3d 100644 --- a/.github/workflows/bump-version.yml +++ b/.github/workflows/bump-version.yml @@ -38,7 +38,7 @@ jobs: - name: "Set up Node.js" uses: actions/setup-node@v4 with: - node-version: 22.x + node-version: 24.22.1 - name: "Compute and apply version bump" id: bump diff --git a/.github/workflows/mcp-ci.yml b/.github/workflows/mcp-ci.yml index bcb8e119..40d1f2f2 100644 --- a/.github/workflows/mcp-ci.yml +++ b/.github/workflows/mcp-ci.yml @@ -14,7 +14,7 @@ jobs: strategy: matrix: - node-version: [22.x] + node-version: [22.23.4, 24.22.1] steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 diff --git a/.github/workflows/mcp-registry-publish.yml b/.github/workflows/mcp-registry-publish.yml index fda676b4..653fd67f 100644 --- a/.github/workflows/mcp-registry-publish.yml +++ b/.github/workflows/mcp-registry-publish.yml @@ -20,7 +20,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 with: - node-version: "lts/*" + node-version: 24.22.1 - name: Install dependencies run: npm ci diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 4493d7e8..94623611 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -20,7 +20,7 @@ jobs: - name: "Set up Node.js" uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 22.x + node-version: 24.22.1 registry-url: "https://registry.npmjs.org/" - name: "Install dependencies" diff --git a/package.json b/package.json index deb59cc3..ce8ce741 100644 --- a/package.json +++ b/package.json @@ -37,7 +37,7 @@ "automation" ], "engines": { - "node": ">=20.9.0" + "node": ">=22.23.4" }, "author": "", "license": "AGPL-3.0-only", From 26c12169c0c15e77cbb437133379080d16b126e3 Mon Sep 17 00:00:00 2001 From: Savio Dias Date: Thu, 12 Nov 2026 11:57:01 +0530 Subject: [PATCH 2/2] chore(ci): bump pinned Node to 24.22.3 / 22.23.5 (latest security releases) Node shipped 24.22.3 (Nov 10) and 22.23.5 (Nov 11) as security releases. Move every pinned runtime onto them so CI, publish, and release builds stay on current, patched Node. - mcp-ci matrix -> [22.23.5, 24.22.3] - npm-publish / beta-release / bump-version / mcp-registry-publish -> 24.22.3 - bump-version: pin actions/setup-node to its v4.4.0 SHA (was moving @v4) - engines floor -> >=22.23.5 (advisory; no engine-strict) - .nvmrc -> 24.22.3 (was v22.1.0); README / llms-install doc floor refreshed Exact pins, no floating tags. Full build/test/boot verified on Node 22.23.5 and 24.22.3: 2112 tests, contract gate, tsc, and a stdio initialize+tools/list handshake (52 tools) all pass. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/beta-release.yml | 2 +- .github/workflows/bump-version.yml | 4 ++-- .github/workflows/mcp-ci.yml | 2 +- .github/workflows/mcp-registry-publish.yml | 2 +- .github/workflows/npm-publish.yml | 2 +- .nvmrc | 2 +- README.md | 8 ++++---- llms-install.md | 4 ++-- package-lock.json | 2 +- package.json | 2 +- 10 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/beta-release.yml b/.github/workflows/beta-release.yml index fb2d5718..5a64813f 100644 --- a/.github/workflows/beta-release.yml +++ b/.github/workflows/beta-release.yml @@ -19,7 +19,7 @@ jobs: - name: "Set up Node.js" uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 24.22.1 + node-version: 24.22.3 registry-url: "https://registry.npmjs.org/" - name: "Install dependencies" diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml index 0614bd3d..fe99aae5 100644 --- a/.github/workflows/bump-version.yml +++ b/.github/workflows/bump-version.yml @@ -36,9 +36,9 @@ jobs: fetch-depth: 0 - name: "Set up Node.js" - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 24.22.1 + node-version: 24.22.3 - name: "Compute and apply version bump" id: bump diff --git a/.github/workflows/mcp-ci.yml b/.github/workflows/mcp-ci.yml index 40d1f2f2..a1b745d2 100644 --- a/.github/workflows/mcp-ci.yml +++ b/.github/workflows/mcp-ci.yml @@ -14,7 +14,7 @@ jobs: strategy: matrix: - node-version: [22.23.4, 24.22.1] + node-version: [22.23.5, 24.22.3] steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 diff --git a/.github/workflows/mcp-registry-publish.yml b/.github/workflows/mcp-registry-publish.yml index 653fd67f..83562229 100644 --- a/.github/workflows/mcp-registry-publish.yml +++ b/.github/workflows/mcp-registry-publish.yml @@ -20,7 +20,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 with: - node-version: 24.22.1 + node-version: 24.22.3 - name: Install dependencies run: npm ci diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 94623611..ccfd597d 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -20,7 +20,7 @@ jobs: - name: "Set up Node.js" uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 24.22.1 + node-version: 24.22.3 registry-url: "https://registry.npmjs.org/" - name: "Install dependencies" diff --git a/.nvmrc b/.nvmrc index 379b25d1..229b3ce8 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -v22.1.0 +24.22.3 diff --git a/README.md b/README.md index d021324d..d160605b 100644 --- a/README.md +++ b/README.md @@ -54,11 +54,11 @@ Click on the buttons below to install MCP in your respective IDE or assistant: For manual setup in any MCP client, see [Install the MCP server locally](https://www.browserstack.com/docs/browserstack-mcp-server/get-started/local-mcp) or [Set up the remote MCP server](https://www.browserstack.com/docs/browserstack-mcp-server/get-started/remote-mcp-server). -#### Note : Ensure you are using Node version >= `22` -- Check your node version using `node --version`. Recommended version: `v22.15.0` (LTS) +#### Note : Ensure you are using Node version >= `22.23.5` +- Check your node version using `node --version`. Recommended version: `v24.22.3` (current), minimum `v22.23.5`. - To Upgrade Node : -- 1. On macOS `(Homebrew) - brew update && brew upgrade node or if using (nvm) - nvm install 22.15.0 && nvm use 22.15.0 && nvm alias default 22.15.0` -- 2. On Windows `(nvm-windows) : nvm install 22.15.0 && nvm use 22.15.0` +- 1. On macOS `(Homebrew) - brew update && brew upgrade node or if using (nvm) - nvm install 24.22.3 && nvm use 24.22.3 && nvm alias default 24.22.3` +- 2. On Windows `(nvm-windows) : nvm install 24.22.3 && nvm use 24.22.3` - 👉 Or directly download the Node.js LTS Installer ## 🪄 Agent-assisted setup diff --git a/llms-install.md b/llms-install.md index cf1b8598..cb093f30 100644 --- a/llms-install.md +++ b/llms-install.md @@ -9,7 +9,7 @@ Exposes BrowserStack's Test Platform as MCP tools: run and debug tests on real b ## Prerequisites - A BrowserStack account. Sign up at https://www.browserstack.com/users/sign_up. Open-source projects can request a free plan at https://www.browserstack.com/open-source. -- For the local (stdio) install only: Node.js 20.9 or newer. Node 22 LTS is recommended. Check with `node --version`. +- For the local (stdio) install only: Node.js 22.23.5 or newer (24.22.3 recommended). Check with `node --version`. ## Option A: hosted remote server (recommended, no install) @@ -133,7 +133,7 @@ Optional environment variables for the local server: ## Troubleshooting - `401` or OAuth loop on the remote server: the user must complete the sign-in in the browser window the client opens. If the client does not support OAuth, use Option B. -- Local server fails to start: check `node --version` is 20.9 or newer, and that both env vars are set with no surrounding quotes or whitespace. +- Local server fails to start: check `node --version` is 22.23.5 or newer, and that both env vars are set with no surrounding quotes or whitespace. - Tools missing from the list: some clients cap the number of tools they load. The server exposes about 50 tools; if the client has a limit, disable other servers or use its tool filter. - Further help: https://github.com/browserstack/mcp-server/issues diff --git a/package-lock.json b/package-lock.json index f717cbb5..1b685236 100644 --- a/package-lock.json +++ b/package-lock.json @@ -40,7 +40,7 @@ "vitest": "^4.0.16" }, "engines": { - "node": ">=20.9.0" + "node": ">=22.23.5" } }, "node_modules/@emnapi/runtime": { diff --git a/package.json b/package.json index ce8ce741..769d969c 100644 --- a/package.json +++ b/package.json @@ -37,7 +37,7 @@ "automation" ], "engines": { - "node": ">=22.23.4" + "node": ">=22.23.5" }, "author": "", "license": "AGPL-3.0-only",