Repository navigation
Conversation
Node.js 22.23.4, 24.22.1 and 26.12.1 fix CVE-2026-111497, a high-severity out-of-bounds write in the Brotli decoder. Raise .nvmrc (which the shared CI workflows read) and the engines floor so earlier, affected releases warn on install. Ref: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
1 open issue
What changed in this PR
Updates the project’s required Node.js versions to ensure developers/CI use patched releases that address CVE-2026-111497, and aligns onboarding docs accordingly.
Changes:
- Bumped
package.jsonengines.nodeto require patched Node versions. - Updated
.nvmrcto pin a patched Node version used by shared CI workflows. - Adjusted getting-started documentation to match the new minimum Node version.
| File | Description |
|---|---|
| package.json | Raises the Node engine range to patched versions to prevent use of vulnerable runtimes. |
| docs/getting-started.md | Updates the stated minimum Node version to match .nvmrc. |
| .nvmrc | Pins Node to a patched version used by tooling/CI that reads .nvmrc. |
Review effort: Lite
| }, | ||
| "engines": { | ||
| "node": "^22.22.2 || ^24.15.0 || >=26.0.0" | ||
| "node": "^22.23.4 || ^24.22.1 || >=26.12.1" |
npm treats engines as advisory, so an affected Node only got an EBADENGINE warning. engine-strict makes npm ci / npm i (including Composer's npm i hook) fail instead. Patched 22.23.4 and 24.22.1 still install cleanly.
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
3 open issues
Review effort: Lite
Comment on lines
+11
to
+13
| ; Fail the install, instead of only warning, on a Node outside package.json | ||
| ; engines, so releases affected by CVE-2026-111497 are refused. | ||
| engine-strict = true |
| - **Composer 2** | ||
| - **PHP 8.2+** (for Composer and the host-side PHPCS/PHPStan checks) | ||
| - **Node and npm** matching [`.nvmrc`](../.nvmrc) (Node 22.22.2 or later) — use `nvm` or another version manager | ||
| - **Node and npm** matching [`.nvmrc`](../.nvmrc) (Node 22.23.4 or later) — use `nvm` or another version manager |
engine-strict turned the engines floor into a hard install failure. Node here only runs dev tooling (build, lint, tests, wp-env), so CVE-2026-111497 exposure is minimal, and the security ask is the .nvmrc and engines bump, not enforcement. engine-strict also failed CI, since the shared wp-ci@v1 installs the runner-cached Node 22.23.3 instead of reading .nvmrc (rtCamp/wp-shared-workflows#47). Affected releases still get an npm EBADENGINE warning. This reverts commit 940b514. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
"22.23.4 or later" read as if any newer Node were fine, but 24.21.0 is newer and still affected, and engines rejects it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
5 open issues
>=26.12.1allows future major versions (e.g., 27.x/28.x) without an explicit allowlist. If… · Newengine-strict = trueapplies to all packages being installed (including transitive…engines.node….nvmrcversion with alternativeengines-compatible ranges, which can… · New
Review effort: Lite
| }, | ||
| "engines": { | ||
| "node": "^22.22.2 || ^24.15.0 || >=26.0.0" | ||
| "node": "^22.23.4 || ^24.22.1 || >=26.12.1" |
| - **Composer 2** | ||
| - **PHP 8.2+** (for Composer and the host-side PHPCS/PHPStan checks) | ||
| - **Node and npm** matching [`.nvmrc`](../.nvmrc) (Node 22.22.2 or later) — use `nvm` or another version manager | ||
| - **Node and npm** matching [`.nvmrc`](../.nvmrc) (Node 22.23.4; 24.22.1+ and 26.12.1+ also meet `engines` in `package.json`) — use `nvm` or another version manager |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Raises
.nvmrcto 22.23.4 and theenginesfloor to^22.23.4 || ^24.22.1 || >=26.12.1, so installing on a Node release affected by CVE-2026-111497 (high, Brotli decoder OOB write) shows an npmEBADENGINEwarning. The getting-started docs now name each patched line.enginesstays advisory on purpose. Node only runs dev tooling here (build, lint, tests,wp-env), never in production, so the exposure is minimal. Anengine-strictcommit was added and then reverted: it made installs fail on affected Node, which also broke CI. The sharedwp-ci.yml@v1doesn't read.nvmrcyet and installs the runner's cached Node 22.23.3. rtCamp/wp-shared-workflows#47 fixes that, and once it's merged andv1is moved, CI here runs on 22.23.4.Ref: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
Fixes/Covers issue
N/A