[GH-ISSUE #6283] Raise Node.js runtime floors for the October 2026 security releases #3802

New issue

Closed

opened 2026-10-31 00:44:13 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:44:13 +00:00

Owner

Originally created by @GamerDubz on GitHub (Oct 22, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6283

Node.js published security releases on 21 October 2026: 22.23.4, 24.22.1 and 26.12.1.

REA's current upstream .nvmrc still pins 24.18.0. The published rea-agents@6.7.0 package still declares ^22.19.0 || ^24.11.0 || >=26.0.0, so the documented/runtime requirements continue to accept older affected releases.

Source: Node.js October 2026 security release announcement.

Please raise the supported security floors to:

^22.23.4 || ^24.22.1 || >=26.12.1

Pin .nvmrc to 24.22.1 and keep package engines/lock metadata, the shared runtime predicate, installer checks, CI pins, Doctor/Setup messages and installation documentation consistent. Explicit CI versions below the new minimum also need updating.

Regression coverage should reject 22.23.3, 24.22.0 and 26.12.0, accept the exact fixed versions, and preserve the installer's prerelease/build-metadata handling.

I checked the fork/upstream PRs, upstream issues and the published npm release and did not find a matching fix. A local candidate on the GamerDubz fork passed focused runtime/Doctor/Setup tests and 18 Git Bash installer boundary cases; that patch has not been published. This report concerns the Node runtime requirement and does not establish a REA-specific exploit path.

Originally created by @GamerDubz on GitHub (Oct 22, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6283 Node.js published security releases on 21 October 2026: **22.23.4, 24.22.1 and 26.12.1**. REA's current upstream `.nvmrc` still pins **24.18.0**. The published `rea-agents@6.7.0` package still declares `^22.19.0 || ^24.11.0 || >=26.0.0`, so the documented/runtime requirements continue to accept older affected releases. Source: [Node.js October 2026 security release announcement](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Please raise the supported security floors to: ```text ^22.23.4 || ^24.22.1 || >=26.12.1 ``` Pin `.nvmrc` to `24.22.1` and keep package engines/lock metadata, the shared runtime predicate, installer checks, CI pins, Doctor/Setup messages and installation documentation consistent. Explicit CI versions below the new minimum also need updating. Regression coverage should reject `22.23.3`, `24.22.0` and `26.12.0`, accept the exact fixed versions, and preserve the installer's prerelease/build-metadata handling. I checked the fork/upstream PRs, upstream issues and the published npm release and did not find a matching fix. A local candidate on the GamerDubz fork passed focused runtime/Doctor/Setup tests and 18 Git Bash installer boundary cases; that patch has not been published. This report concerns the Node runtime requirement and does not establish a REA-specific exploit path.

bsakaguchi closed this issue

2026-10-31 00:44:13 +00:00

bsakaguchi commented

2026-10-31 00:44:14 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 22, 2026):

赞同升级：既然 21 Oct 安全通告已发布 22.23.4/24.22.1/26.12.1 修复版，把 engines 下限与 .nvmrc、CI pins、Doctor/Setup 消息一起抬齐是正确做法，避免"文档已升但安装器/CI 仍在旧版"的错位。特别认可你已覆盖的安装器 prerelease/build-metadata 处理与 Git Bash 边界用例——这类升级最容易在 parse 分支上漏改。建议把拒绝 22.23.3/24.22.0/26.12.0、接受修复版的回归断言收敛到共享 runtime 谓词的单元测试里，单一事实源，后续再抬 floor 只需改一处。

@XinwangTao commented on GitHub (Oct 22, 2026): 赞同升级：既然 21 Oct 安全通告已发布 22.23.4/24.22.1/26.12.1 修复版，把 engines 下限与 .nvmrc、CI pins、Doctor/Setup 消息一起抬齐是正确做法，避免"文档已升但安装器/CI 仍在旧版"的错位。特别认可你已覆盖的安装器 prerelease/build-metadata 处理与 Git Bash 边界用例——这类升级最容易在 parse 分支上漏改。建议把拒绝 22.23.3/24.22.0/26.12.0、接受修复版的回归断言收敛到共享 runtime 谓词的单元测试里，单一事实源，后续再抬 floor 只需改一处。

bsakaguchi referenced this issue

2026-10-31 01:10:21 +00:00

[PR #3802] [CLOSED] fix(reconstruction): evaluate declared dependency closure and risks #5907

bsakaguchi referenced this issue

2026-10-31 01:12:30 +00:00

[PR #4337] [CLOSED] fix(domain): fail closed on conflicting reconstruction proofs and evaluate required claim surfaces #6181

bsakaguchi referenced this issue

2026-11-01 21:11:07 +00:00

[GH-ISSUE #5654] [Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #3425