[peakematt]

Why

Part of the November 2026 Node.js security release rollout (High severity: HTTP/2, TLS, llhttp, undici and others; advisory). The repo pinned only the Node major in .nvmrc (20), so the version a build got depended on when it ran. This pins the patched release exactly.

What changed

• .nvmrc: 20 → 22.23.5.
• Node 20 is EOL and gets no fix in this release, so this moves to 22.23.5 instead of pinning 20.
• The CI matrix node-version: [20.x] is now [22.23.5] in all four jobs.
• Not changed: the Dockerfile and Dockerfile.dev build FROM node:18-alpine (also EOL). Docker Hub hasn't published node:22.23.5-alpine yet, so that pin will come in a follow-up once the tag exists.

package.json engines ranges are unchanged. They describe compatibility, not the version we build with.

Link to Devin session: https://app.devin.ai/sessions/827b6f7f4f5c4db69b167f83971f02df
Open in Devin Desktop: https://app.devin.ai/desktop/session/827b6f7f4f5c4db69b167f83971f02df?variant=devin
Requested by: @peakematt

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from Matt Peake

SYSTEM:
<latest_message>
Matt Peake (U0BQ539BLBG) [ts=1794400900.139529]: @Devin NodeJS announced that they are going to release security updates today or tomorrow: <https://nodejs.org/en/blog/vulnerability/november-2026-security-releases|nodejs.org/en/blog/vulnerability/november-2026-security-releases>.

Set up an automation that checks for the Node security release every 15 minutes until it is announced. Once it is announced, read the notion page linked in this thread and issue PRs on all of the repos described in that notion doc to update node. Add links to PRs and update the status field in Notion accordingly.
</latest_message>

=== BEGIN THREAD HISTORY (in #team-security) ===
Matt Peake (U0BQ539BLBG) [ts=1794400756.414429]: November 2026 NodeJS Updates 🧵

Matt Peake (U0BQ539BLBG) [ts=1794400768.394649]: Tracking sheet: <https://app.notion.com/p/workos/Node-js-security-release-rollout-November-2026-847d458aea8b83649076810cd59daea0?source=copy_link|app.notion.com/p/workos/Node-js-security-release-rollout-November-2026…?source=copy_link>

:large_green_circle: Node.js security release rollout - November 2026

Matt Peake (U0BQ539BLBG) [ts=1794400900.139529]: @Devin NodeJS announced that they are going to release security updates today or tomorrow: <https://nodejs.org/en/blog/vulnerability/november-2026-security-releases|nodejs.org/en/blog/vulnerability/november-2026-security-releases>.

Set up an automation that checks for the Node security release every 15 minutes until it is announced. Once it is announced, read the notion page linked in this thread and issue PRs on all of the repos described in that notion doc to update node. Add links to PRs and update the status field in Notion accordingly.

[Slack unfurl — this is an automatic link preview, not a user message]
Preview of a link: https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
> # nodejs.org
> #``# [Node.js — Wednesday, November 11, 2026 Security Releases](https://nodejs.org/en/blo... (811 chars truncated...)

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

Devin Review

🟢 Devin Review found nothing to fix · View findings

[greptile-apps]

Confidence Score: 5/5

[Low impact] The PR appears safe to merge based on the reviewed changes.

Summary

Pins local development and all four CI jobs to Node 22.23.5.

• Local setups and all CI jobs now use Node 22.23.5.
• The database schema check uses a fixed Ubuntu runner.

_{Reviews (2) · Last reviewed commit: "Run database_updated on ubuntu-24.04" · Reviewed by Greptile}