Skip to content

@tus/server: require patched Node releases for tooling - #895

Merged
kvz merged 2 commits into
mainfrom
node-security
Oct 21, 2026
Merged

kvz merged 2 commits into
mainfrom
node-security

Conversation

@kvz

@kvz kvz commented Oct 21, 2026 •

Copy link
Copy Markdown
Member

Maintainer builds used unsupported Node 20, while the release selector could reuse a cached Node 24 runtime older than the October security fixes.

Use ^22.23.4 for build/lint and ^24.22.1 for release tooling, with check-latest: true for both. Retain the existing Node 20 secret-backed test job as a compatibility check for the published support contract. Consumers still need to update their own deployed Node runtime.

Validation: workflow YAML parsing, git diff --check, and council review passed. Following this repository's instructions, build/lint and integration qualification run in PR CI rather than local tests. The release workflow has not been invoked.

Build/lint CI passed on Node 22.23.4. Secret-backed compatibility tests passed on the retained Node 20 lane. No Devin workflow or review was present on this PR.

🤖 Claimed by kvz on framework1/tus-node-server since 2026-10-21 · resume: codex resume 01a15e32-a05f-7153-89c2-0b1273795a49

@kvz kvz self-assigned this Oct 21, 2026
@changeset-bot

changeset-bot Bot commented Oct 21, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 04bd0d3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@kvz
kvz marked this pull request as ready for review October 21, 2026 17:39

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Devin Review

@kvz
kvz merged commit fb55c98 into main Oct 21, 2026
5 checks passed
@kvz
kvz deleted the node-security branch October 21, 2026 19:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant