chore: upgrade Node.js from 20 to 24 LTS (CM-1280)

[skwowet]

Summary

Node 20 reached EOL on 30 Apr 2026 and no longer receives security updates. This PR moves CDP to Node 24 LTS (Krypton), the current Active LTS.

Node 22 is already in Maintenance. Node 26 is Current and does not become LTS until October 2026. Odd-numbered lines are not LTS.

• Runtime and CI: .nvmrc, Docker images, setup-node from .nvmrc, GitHub JS action on node24, @types/node ^24
• Dependencies that fail on Node 24: bcrypt 6, config 3.3.12, jsonwebtoken 9, plus tsx, undici, axios, @slack/web-api, snowflake-sdk, and dd-trace
• Typecheck fixes for the new Node types

https://linuxfoundation.atlassian.net/browse/CM-1280

Test plan

• Local install and native addon smoke on Node 24
• Backend / services / frontend lint and typecheck
• pnpm test:server
• Docker smoke: backend, merge-suggestions-worker, frontend
• Staging: remaining services boot cleanly

[Copilot]

Pull request overview

Migrates CDP’s supported runtime from Node.js 20 to Node.js 24 LTS across development, CI, Docker images, and TypeScript definitions.

Changes:

• Updates Node.js runtime requirements, CI actions, Docker images, and @types/node.
• Upgrades backend bcrypt for Node.js 24 compatibility.
• Adjusts fetch dispatcher typing and affiliation fallback indexing.

Reviewed changes

Copilot reviewed 90 out of 91 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
.nvmrc	Selects Node.js 24.
package.json	Requires Node.js 24+.
README.md	Documents Node.js 24 requirement.
pnpm-lock.yaml	Locks updated Node types and bcrypt dependencies.
backend/package.json	Upgrades bcrypt and Node types.
frontend/Dockerfile	Builds frontend with Node.js 24.
.github/actions/node/package.json	Updates action Node types.
.github/actions/node/builder/action.yaml	Uses the Node.js 24 action runtime.
.github/workflows/backend-lint.yaml	Runs backend and service lint on Node.js 24.
.github/workflows/frontend-lint.yml	Adds Node.js 24 setup.
.github/workflows/server-tests.yml	Runs server tests using .nvmrc.
services/archetypes/consumer/package.json	Updates Node types.
services/archetypes/standard/package.json	Updates Node types.
services/archetypes/worker/package.json	Updates Node types.
services/apps/automatic_projects_discovery_worker/package.json	Updates Node types.
services/apps/cache_worker/package.json	Updates Node types.
services/apps/categorization_worker/package.json	Updates Node types.
services/apps/cron_service/package.json	Updates Node types.
services/apps/data_sink_worker/package.json	Updates Node types.
services/apps/entity_merging_worker/package.json	Updates Node types.
services/apps/exports_worker/package.json	Updates Node types.
services/apps/integration_run_worker/package.json	Updates Node types.
services/apps/integration_stream_worker/package.json	Updates Node types.
services/apps/kafka_connect_monitor/package.json	Updates Node types.
services/apps/members_enrichment_worker/package.json	Updates Node types.
services/apps/merge_suggestions_worker/package.json	Updates Node types.
services/apps/nango_webhook_api/package.json	Updates Node types.
services/apps/nango_worker/package.json	Updates Node types.
services/apps/organizations_enrichment_worker/package.json	Updates Node types.
services/apps/packages_worker/package.json	Updates Node types.
services/apps/packages_worker/src/npm/fetchDownloads.ts	Adapts dispatcher typing for Node.js 24.
services/apps/packages_worker/src/npm/fetchPackument.ts	Adapts dispatcher typing for Node.js 24.
services/apps/packages_worker/src/packagist/fetchPackage.ts	Adapts Packagist dispatcher typing.
services/apps/packages_worker/src/packagist/listPackages.ts	Adapts package-list dispatcher typing.
services/apps/packages_worker/src/pypi/fetchProject.ts	Adapts PyPI dispatcher typing.
services/apps/profiles_worker/package.json	Updates Node types.
services/apps/projects_evaluation_worker/package.json	Updates Node types.
services/apps/script_executor_worker/package.json	Updates Node types.
services/apps/search_sync_api/package.json	Updates Node types.
services/apps/search_sync_worker/package.json	Updates Node types.
services/apps/security_best_practices_worker/package.json	Updates Node types.
services/apps/template_consumer/package.json	Updates Node types.
services/apps/template_worker/package.json	Updates Node types.
services/apps/temporal_codec_server/package.json	Updates Node types.
services/apps/webhook_api/package.json	Updates Node types.
services/libs/anthropic-aws/package.json	Updates Node types.
services/libs/audit-logs/package.json	Updates Node types.
services/libs/common/package.json	Updates Node types.
services/libs/common_services/package.json	Updates Node types.
services/libs/data-access-layer/package.json	Updates Node types.
services/libs/data-access-layer/src/affiliations/index.ts	Replaces .at(0) with indexed access.
services/libs/database/package.json	Updates Node types.
services/libs/integrations/package.json	Updates Node types.
services/libs/logging/package.json	Updates Node types.
services/libs/nango/package.json	Updates Node types.
services/libs/opensearch/package.json	Updates Node types.
services/libs/queue/package.json	Updates Node types.
services/libs/redis/package.json	Updates Node types.
services/libs/slack/package.json	Updates Node types.
services/libs/snowflake/package.json	Updates Node types.
services/libs/telemetry/package.json	Updates Node types.
services/libs/temporal/package.json	Updates Node types.
services/libs/test-kit/package.json	Updates Node types.
services/libs/types/package.json	Updates Node types.
scripts/services/docker/Dockerfile.automatic_projects_discovery_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.backend	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.cache_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.categorization_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.cron_service	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.data_sink_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.entity_merging_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.exports_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.integration_run_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.integration_stream_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.kafka_connect_monitor	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.members_enrichment_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.merge_suggestions_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.nango_webhook_api	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.nango_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.organizations_enrichment_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.packages	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.pcc_sync_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.profiles_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.projects_evaluation_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.script_executor	Uses Node.js 24.
scripts/services/docker/Dockerfile.script_executor_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.search_sync_api	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.search_sync_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.security_best_practices_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.snowflake_connectors_worker	Uses Node.js 24 images.
scripts/services/docker/Dockerfile.webhook_api	Uses Node.js 24 images.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (1)

services/apps/packages_worker/src/packagist/fetchPackage.ts:126

• Casting the entire options object to RequestInit disables validation for every standard fetch field, so later typos or invalid values can pass typecheck. Keep the compatibility escape hatch on dispatcher only and let TypeScript check the rest of the object.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 90 out of 91 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[Copilot]

Pull request overview

Copilot reviewed 90 out of 91 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (6)

services/apps/packages_worker/src/packagist/fetchPackage.ts:121

• This explanatory comment lacks a link to the external incompatibility. Since the adjacent narrow cast already makes the workaround clear, remove the comment (or replace it with a linked upstream reference).
  services/apps/packages_worker/src/pypi/fetchProject.ts:27
• This explanatory comment lacks a link to the external incompatibility. Since the adjacent narrow cast already makes the workaround clear, remove the comment (or replace it with a linked upstream reference).
  services/apps/packages_worker/src/npm/fetchPackument.ts:28
• This explanatory comment lacks a link to the external incompatibility. Since the adjacent narrow cast already makes the workaround clear, remove the comment (or replace it with a linked upstream reference).
  services/apps/packages_worker/src/npm/fetchDownloads.ts:12
• This explanatory comment lacks a link to the external incompatibility. Since the adjacent narrow cast already makes the workaround clear, remove the comment (or replace it with a linked upstream reference).
  services/apps/packages_worker/src/packagist/listPackages.ts:88
• This explanatory comment lacks a link to the external incompatibility. Since the adjacent narrow cast already makes the workaround clear, remove the comment (or replace it with a linked upstream reference).
  services/apps/packages_worker/src/packagist/fetchPackage.ts:57
• This explanatory comment lacks a link to the external incompatibility. Since the adjacent narrow cast already makes the workaround clear, remove the comment (or replace it with a linked upstream reference).

This issue also appears on line 121 of the same file.

[Copilot]

Pull request overview

Copilot reviewed 92 out of 93 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 92 out of 93 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 92 out of 93 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 94 out of 95 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 95 out of 97 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• frontend/package-lock.json: Generated file

[Copilot]

Pull request overview

Copilot reviewed 95 out of 97 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• frontend/package-lock.json: Generated file

Suppressed comments (2)

scripts/services/docker/Dockerfile.pcc_sync_worker:1

• Debian 11 Bullseye reaches end of LTS on 2026-08-31, after which the official Node image project plans to remove the 24/bullseye* variants. This would leave both stages on a frozen base without ongoing OS/Node image updates shortly after this security-driven upgrade. Use the supported Bookworm variant for both stages.
  scripts/services/docker/Dockerfile.snowflake_connectors_worker:1
• Debian 11 Bullseye reaches end of LTS on 2026-08-31, after which the official Node image project plans to remove the 24/bullseye* variants. This would leave both stages on a frozen base without ongoing OS/Node image updates shortly after this security-driven upgrade. Use the supported Bookworm variant for both stages.

[Copilot]

Pull request overview

Copilot reviewed 93 out of 95 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• frontend/package-lock.json: Generated file

[Copilot]

Pull request overview

Copilot reviewed 94 out of 96 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• frontend/package-lock.json: Generated file

Suppressed comments (5)

scripts/services/docker/Dockerfile.snowflake_connectors_worker:14

• Bullseye LTS security support ends on 31 August 2026, leaving the deployed runner without Debian security updates. Move the runtime stage to Bookworm as part of this security-driven runtime upgrade.
  scripts/services/docker/Dockerfile.pcc_sync_worker:14
• Bullseye LTS security support ends on 31 August 2026, leaving the deployed runner without Debian security updates. Move the runtime stage to Bookworm as part of this security-driven runtime upgrade.
  scripts/services/docker/Dockerfile.snowflake_connectors_worker:1
• Bullseye LTS security support ends on 31 August 2026, so this new Node 24 image will stop receiving Debian security fixes almost immediately. Use the Bookworm variant for the builder stage.

This issue also appears on line 14 of the same file.
scripts/services/docker/Dockerfile.pcc_sync_worker:1

• Bullseye LTS security support ends on 31 August 2026, so this new Node 24 image will stop receiving Debian security fixes almost immediately. Use the Bookworm variant for the builder stage.

This issue also appears on line 14 of the same file.
services/libs/logging/src/logger.ts:25

• This comment only restates the catch fallback, which conflicts with the repository rule that comments must explain a non-obvious invariant or external constraint (CLAUDE.md:72-84). Keep the catch non-empty by returning the fallback directly.