[Aymericr]

What does this PR do?

Picks up the October 21, 2026 Node.js security release (22.23.4 / 24.22.1 / 26.12.1, all flagged security: true in https://nodejs.org/dist/index.json). It covers several high-severity CVEs: the Brotli decoder out-of-bounds write CVE-2026-111497, the dns.resolve NUL truncation CVE-2026-105482, and the TLS hostname bypasses CVE-2026-105483 and CVE-2026-106069.

• Dockerfile build stage. oven/bun:1.4.4-alpine is Alpine 3.24.3, checked from the image's rootfs layer. Alpine v3.24/main ships nodejs 24.22.1-r0 (built 2026-10-23) for both x86_64 and aarch64, per pkgs.alpinelinux.org and the APKINDEX, and 24.22.1 is the patched 24.x release. The stage now installs 'nodejs>=24.22.1-r0'. That's a minimum rather than an exact pin, so later Alpine rebuilds still install, but a stale or unpatched index fails the build. Bun stays at 1.4.4.
• Runtime stage. Already on node:22.23.4-alpine, the patched release. Unchanged.
• engines.node. Raised to >=22.23.4 in the root package.json (was >=22.18) and packages/cli/package.json (was >=22.13.0). No other package declares engines.

Impact on @pascal-app/cli users. engines is advisory. npm prints an EBADENGINE warning but still installs and runs the package unless the user has turned on engine-strict. The repo's own .npmrc is empty. Nothing in the repo reads engines. The runtime check in pascal doctor (packages/cli/src/diagnostics.ts) still accepts 22.13+, and the README/skills docs still say "Node.js 22.13 or newer". Both are left alone to keep this PR free of app-code changes. No functional break below 22.23.4, only the warning.

How to test

1. docker buildx build --load -t pascal-editor:test . should succeed. The build log shows Installing nodejs (24.22.1-r0) in build 3/7, and bun install --frozen-lockfile passes.
2. docker run --rm oven/bun:1.4.4-alpine sh -c "apk add --no-cache 'nodejs>=24.22.1-r0' && node --version && bun --version" should print v24.22.1 and 1.4.4.
3. docker run -p 3999:3000 pascal-editor:test: GET /api/health and GET / both return 200, and node --version in the container prints v22.23.4.

All three were run locally on amd64.

Screenshots / screen recording

N/A — non-visual change

Checklist

• I've tested this locally with bun dev
• My code follows the existing code style (run bun check to verify)
• I've updated relevant documentation (if applicable)
• This PR targets the main branch

  

---

Note

Low Risk
Version and packaging constraints only; no application logic changes, though Docker builds will fail if Alpine cannot satisfy the new Node minimum.

^{Reviewed by Cursor Bugbot for commit 9e8a977. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T13:42:39.420917Z	9e8a977	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9e8a9775f0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restrict each Node major to its patched release

For users running newer Node majors, this range does not enforce the security floor described by the change: semver considers vulnerable releases such as Node 24.21.0 and 26.11.0—and unsupported Node 23/25 releases—to satisfy >=22.23.4, so npm emits no engine warning. Express the patched floors per supported major, for example >=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1 <27, and apply the same correction to the root manifest.

Useful? React with 👍 / 👎.

[cursor]

Addressed in #1144 (#1144): engines.node is now ^22.23.4 || ^24.22.1 || >=26.12.1 in the root and CLI package.json. That excludes vulnerable 24.x and 26.x releases and the EOL 23 and 25 lines.