[PR #6315] [MERGED] fix(runtime)!: require patched Node.js security releases #7275

New issue

Closed

opened 2026-11-01 21:46:41 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:46:41 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6315
Author: @ShikamaruNaaraa
Created: 10/22/2026
Status: ✅ Merged
Merged: 10/23/2026
Merged by: @gensokyo-dev

Base: main ← Head: fix/node-security-floors

📝 Commits (6)

7bb17e0 fix(runtime): raise Node.js security floors to 22.23.4, 24.22.1 and 26.12.1
0d384ed fix(ci): bump SQLite runtime Node 24 pin to 24.22.1
b7bb6e2 chore(runtime): reconcile Node security floors with current main
82c3ddf test(runtime): use explicit Node configuration values
b1ba39e test(electron): assert listener identity across Node versions
c9a62c5 test(mcp): bind HTTP calls to their advertised tool schema

📊 Changes

19 files changed (+142 additions, -108 deletions)

View changed files

📝 .github/workflows/ci.yml (+1 -1)
📝 .github/workflows/sqlite-runtime.yml (+1 -1)
📝 .nvmrc (+1 -1)
📝 README.md (+1 -1)
📝 docs/installation.md (+1 -1)
📝 docs/user-visible-errors.csv (+7 -7)
📝 docs/windows-ghidra-p0.md (+1 -1)
📝 install.sh (+7 -3)
📝 package-lock.json (+1 -1)
📝 package.json (+1 -1)
📝 src/application/Doctor.fixture.ts (+1 -1)
📝 src/application/Doctor.test.ts (+2 -1)
📝 src/application/Setup.fixture.ts (+1 -1)
📝 src/domain/runtimeVersion.test.ts (+14 -9)
📝 src/domain/runtimeVersion.ts (+2 -2)
📝 tests/boundary/browser/electronActiveHook.test.ts (+38 -23)
📝 tests/boundary/filesystem/installScript.test.ts (+40 -32)
📝 tests/boundary/mcp/streamableHttpMcp.test.ts (+21 -15)
📝 tests/boundary/process/regexMatcher.test.ts (+1 -6)

📄 Description

Fixes #6283. Part of #6480.

Summary

Require patched Node.js releases: ^22.23.4 || ^24.22.1 || >=26.12.1, with the development pin at 24.22.1. Previously accepted releases below these floors are rejected before installation/setup proceeds.

Update the shared runtime predicate, package engines/lock, installer admission and recovery text, Doctor/Setup fixtures, relevant CI pins and core installation guidance. Installer cases cover each patch boundary, prerelease rejection and build metadata. Related translated guidance and environment-image updates remain in #6316.

Maintainer follow-up merged current main, preserved its setup-host documentation during conflict resolution, and separated installer runtime-admission cases to retain every assertion within the existing lint limit.

Contract and boundary impact

The runtime predicate owns Node admission; the standalone shell installer applies the same floors before invoking npm. CLI/MCP schemas, Evidence semantics, provider authority and cleanup contracts are unchanged. This is routine security maintenance within existing contribution scope; a new-provider scope decision is not applicable. Build outputs and local audit artifacts are excluded.

Migration: Node 22.23.3, 24.22.0 and 26.12.0 were accepted previously and are now unsupported. Upgrade to 22.23.4, 24.22.1, 26.12.1 or a newer supported release before installing/updating REA. The installer does not install or upgrade Node/npm.

Validation performed

Maintainer-executed on Linux x64 with Node 24.22.1 and the pinned npm 11.16.0:

Runtime predicate before/after probe: the three versions immediately below the new floors changed from accepted to rejected; all three floor versions remained accepted.
Exact tests for runtimeVersion, Doctor, Setup.recovery, setupEnvironment and installScript: 168 passed. After grouping cleanup, all 13 runtime-admission cases passed again; the other 28 installer cases were deliberately outside that subset.
Release-configuration conformance: 5 passed, including package engines/shared runtime-range parity.
The upgraded runtime reproduced a config-file probe failure: Node 24.18.0 executed the split --experimental-config-file PATH form, whereas 24.22.1 searched for node.config.json and exited 9. Real probes now use the explicit =PATH form; conservative unknown assertions for split argv remain. Both regex boundary/module files then passed: 63 tests. Probe failures now include Node stderr.
Node EventEmitter control: once wrapper names changed from bound onceWrapper (24.18.0) to wrapper (24.22.1), while .listener still identifies the original callback. Registration/removal fixtures now compare actual callback identity and preserve receiver, ordering, invocation and gap assertions. All 101 Electron hook boundary tests passed on 24.22.1 and separately on 24.18.0; the older-runtime run is a fixture compatibility control, not a supported-runtime claim.
HTTP attribution matrix: a 24.22.1 client also failed against a 24.18.0 server, while a 24.18.0 client passed against the 24.22.1 server. The SDK compiled the entire held tool catalog before the first call (observed approximately 11.6 seconds between listing and dispatch). The HTTP fixture now reuses the advertised-schema helper, binds the requested tool per fresh session, and validates that schema explicitly. All 2 HTTP boundary tests passed, preserving initialize/list/call/DELETE/replacement/Host checks; the replaced session must report Session not found, and clients have test-scoped cleanup. This does not claim a general upstream SDK/Undici fix.
npm run check: 6/6 tasks passed, module-boundary and architecture guards passed; lint had 0 errors and 2,271 existing warnings.
npm run docs:check: passed, including 9 README consistency tests.
npm run verify:package: passed the actual packed-package install/update, CLI analysis, setup/uninstall, Evidence and stdio MCP flows; 220 tools and 6 prompts verified. Lifecycle scripts were disabled for installation. This completed at b7bb6e254; the subsequent corrections change only tests, with production/package inputs unchanged. MCP first catalog: 1,878 ms, sampled startup RSS approximately 134 MiB on the constrained local run; this is an observation, not a before/after speedup claim.

Resource controls: one CPU per local command, one test worker, serial Turbo tasks, and bounded runtime settings. Focused tests took 96.9 s / 95.7 CPU s, sampled process-family RSS 1,290 MiB; the final successful complete static check took 55.7 s / 52.9 CPU s, sampled RSS 1,681 MiB. Descendant RSS is sampled every 100 ms and can double-count shared pages or miss short-lived processes. Agent token cost was not measured.

Real Hopper/Ghidra execution and macOS provider verification were not performed locally; this change does not modify those adapters. Current-head GitHub CI/review results remain the merge gate.

Author readiness

Human owner: @ShikamaruNaaraa

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6315 **Author:** [@ShikamaruNaaraa](https://github.com/ShikamaruNaaraa) **Created:** 10/22/2026 **Status:** ✅ Merged **Merged:** 10/23/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `fix/node-security-floors` --- ### 📝 Commits (6) - [`7bb17e0`](https://github.com/morluto/rea/commit/7bb17e0e64581732a9f7f4c25d2c13de0d4482d6) fix(runtime): raise Node.js security floors to 22.23.4, 24.22.1 and 26.12.1 - [`0d384ed`](https://github.com/morluto/rea/commit/0d384ed7240ae73b9a9a653d6ab66f5287c0d208) fix(ci): bump SQLite runtime Node 24 pin to 24.22.1 - [`b7bb6e2`](https://github.com/morluto/rea/commit/b7bb6e254c15ca8f3691b413944681ddf5f777da) chore(runtime): reconcile Node security floors with current main - [`82c3ddf`](https://github.com/morluto/rea/commit/82c3ddf757e0218f8fe4d2e6c186817386386052) test(runtime): use explicit Node configuration values - [`b1ba39e`](https://github.com/morluto/rea/commit/b1ba39eb2b56e6c2ac9c4576c72b6c5e2654d9db) test(electron): assert listener identity across Node versions - [`c9a62c5`](https://github.com/morluto/rea/commit/c9a62c555324da4471dd0ec8670f521852e33bc2) test(mcp): bind HTTP calls to their advertised tool schema ### 📊 Changes **19 files changed** (+142 additions, -108 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+1 -1) 📝 `.github/workflows/sqlite-runtime.yml` (+1 -1) 📝 `.nvmrc` (+1 -1) 📝 `README.md` (+1 -1) 📝 `docs/installation.md` (+1 -1) 📝 `docs/user-visible-errors.csv` (+7 -7) 📝 `docs/windows-ghidra-p0.md` (+1 -1) 📝 `install.sh` (+7 -3) 📝 `package-lock.json` (+1 -1) 📝 `package.json` (+1 -1) 📝 `src/application/Doctor.fixture.ts` (+1 -1) 📝 `src/application/Doctor.test.ts` (+2 -1) 📝 `src/application/Setup.fixture.ts` (+1 -1) 📝 `src/domain/runtimeVersion.test.ts` (+14 -9) 📝 `src/domain/runtimeVersion.ts` (+2 -2) 📝 `tests/boundary/browser/electronActiveHook.test.ts` (+38 -23) 📝 `tests/boundary/filesystem/installScript.test.ts` (+40 -32) 📝 `tests/boundary/mcp/streamableHttpMcp.test.ts` (+21 -15) 📝 `tests/boundary/process/regexMatcher.test.ts` (+1 -6) </details> ### 📄 Description Fixes #6283. Part of #6480. ## Summary Require patched Node.js releases: `^22.23.4 || ^24.22.1 || >=26.12.1`, with the development pin at 24.22.1. Previously accepted releases below these floors are rejected before installation/setup proceeds. Update the shared runtime predicate, package engines/lock, installer admission and recovery text, Doctor/Setup fixtures, relevant CI pins and core installation guidance. Installer cases cover each patch boundary, prerelease rejection and build metadata. Related translated guidance and environment-image updates remain in #6316. Maintainer follow-up merged current main, preserved its setup-host documentation during conflict resolution, and separated installer runtime-admission cases to retain every assertion within the existing lint limit. ## Contract and boundary impact The runtime predicate owns Node admission; the standalone shell installer applies the same floors before invoking npm. CLI/MCP schemas, Evidence semantics, provider authority and cleanup contracts are unchanged. This is routine security maintenance within existing contribution scope; a new-provider scope decision is not applicable. Build outputs and local audit artifacts are excluded. Migration: Node 22.23.3, 24.22.0 and 26.12.0 were accepted previously and are now unsupported. Upgrade to 22.23.4, 24.22.1, 26.12.1 or a newer supported release before installing/updating REA. The installer does not install or upgrade Node/npm. ## Validation performed Maintainer-executed on Linux x64 with Node 24.22.1 and the pinned npm 11.16.0: - Runtime predicate before/after probe: the three versions immediately below the new floors changed from accepted to rejected; all three floor versions remained accepted. - Exact tests for runtimeVersion, Doctor, Setup.recovery, setupEnvironment and installScript: **168 passed**. After grouping cleanup, all **13 runtime-admission cases passed** again; the other 28 installer cases were deliberately outside that subset. - Release-configuration conformance: **5 passed**, including package engines/shared runtime-range parity. - The upgraded runtime reproduced a config-file probe failure: Node 24.18.0 executed the split `--experimental-config-file PATH` form, whereas 24.22.1 searched for `node.config.json` and exited 9. Real probes now use the explicit `=PATH` form; conservative unknown assertions for split argv remain. Both regex boundary/module files then passed: **63 tests**. Probe failures now include Node stderr. - Node EventEmitter control: `once` wrapper names changed from `bound onceWrapper` (24.18.0) to `wrapper` (24.22.1), while `.listener` still identifies the original callback. Registration/removal fixtures now compare actual callback identity and preserve receiver, ordering, invocation and gap assertions. All **101 Electron hook boundary tests passed on 24.22.1 and separately on 24.18.0**; the older-runtime run is a fixture compatibility control, not a supported-runtime claim. - HTTP attribution matrix: a 24.22.1 client also failed against a 24.18.0 server, while a 24.18.0 client passed against the 24.22.1 server. The SDK compiled the entire held tool catalog before the first call (observed approximately 11.6 seconds between listing and dispatch). The HTTP fixture now reuses the advertised-schema helper, binds the requested tool per fresh session, and validates that schema explicitly. All **2 HTTP boundary tests passed**, preserving initialize/list/call/DELETE/replacement/Host checks; the replaced session must report `Session not found`, and clients have test-scoped cleanup. This does not claim a general upstream SDK/Undici fix. - `npm run check`: **6/6 tasks passed**, module-boundary and architecture guards passed; lint had 0 errors and 2,271 existing warnings. - `npm run docs:check`: passed, including **9 README consistency tests**. - `npm run verify:package`: passed the actual packed-package install/update, CLI analysis, setup/uninstall, Evidence and stdio MCP flows; **220 tools and 6 prompts** verified. Lifecycle scripts were disabled for installation. This completed at `b7bb6e254`; the subsequent corrections change only tests, with production/package inputs unchanged. MCP first catalog: 1,878 ms, sampled startup RSS approximately 134 MiB on the constrained local run; this is an observation, not a before/after speedup claim. Resource controls: one CPU per local command, one test worker, serial Turbo tasks, and bounded runtime settings. Focused tests took 96.9 s / 95.7 CPU s, sampled process-family RSS 1,290 MiB; the final successful complete static check took 55.7 s / 52.9 CPU s, sampled RSS 1,681 MiB. Descendant RSS is sampled every 100 ms and can double-count shared pages or miss short-lived processes. Agent token cost was not measured. Real Hopper/Ghidra execution and macOS provider verification were not performed locally; this change does not modify those adapters. Current-head GitHub CI/review results remain the merge gate. ## Author readiness Human owner: @ShikamaruNaaraa - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:46:41 +00:00