Repository navigation
fix(staging): pin engines.node to exact 22.23.4 for CF buildpack compatibility - #2961
Merged
Merged
Conversation
…atibility CF nodejs_buildpack v1.9.6 rejects compound semver ranges (>=x.y.z <n) with "improper constraint" — it only accepts simple ranges like 22.x or exact versions. The >=22.23.4 <23 range (set in the CVE-2026-111497 fix) caused BuildpackCompileFailed on all three deployed modules during the 2026-11-01 DEV deploy. Exact pin 22.23.4 satisfies the CVE floor requirement and is accepted by the buildpack resolver. Updated: package.json, srv-qa/package.json, srv-mcp/package.json.
This was referenced Nov 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
>=22.23.4 <23with "improper constraint" — it only accepts22.xor exact versions>=22.23.4 <23range introduced by the CVE-2026-111497 fix causedBuildpackCompileFailedon all three deployed modules during the 2026-11-01 DEV deploypackage.jsonfiles to exact pin22.23.4, which satisfies the CVE floor and is accepted by the buildpack resolverFiles changed:
package.json,srv-qa/package.json,srv-mcp/package.jsonTest plan
tutorials-srvstaging (was failing withUnable to install node: improper constraint: >=22.23.4 <23)cf app tutorials-srvshows Node 22.23.4 post-deploysrv-qaor MCP modules