[ralph-bitgo]

Description

Bumps the Nix dev shell to a patched Node 22 (October 2026 security
remediation).

What

• flake.nix: nixpkgs-nodejs input pin 6ad174a6… (nodejs_22 =
  22.14.0) → 8bd525757851975db0aebe3af18073b7f52d6f34 (nixpkgs
  master; nodejs_22 = 22.23.4). The trailing comment now records the
  new version.
• flake.lock: nixpkgs-nodejs re-locked to the same revision
  (narHash sha256-vgbDVD3b…BMr7aA=); the separate nixpkgs input is
  untouched.
• flake.nix: short comment recording that the Node 22 dev shell and
  the root .nvmrc (Node 24) are independent decisions.
• No Docker, .nvmrc, CI, or application changes.

Why

• The shell's nodejs_22 (22.14.0) is below the patched floor of the
  Node October 2026 security release. PLAT-2213 asks the shell to land
  on 22.23.4, matching the BitGo Express runtime update (WCN-3321,
  fix(express): bump Dockerfile Node base image to 22.23.4 #10022, node:22.23.4-bookworm-slim).
• The dev shell intentionally stays on Node 22 (the Express runtime
  major) while the root .nvmrc keeps the separate Node 24 SDK
  toolchain decision (WCN-3186). Both majors are preserved on purpose,
  so devs running the shell get the same major the service runs.

Issue Number

PLAT-2213 — https://linear.app/bitgo/issue/PLAT-2213/update-bitgojs-nix-dev-shell-to-patched-node-22

Prerequisite: WCN-3321 is complete — #10022 merged; the Express
Dockerfile stages select Node 22.23.4
(node:22.23.4-bookworm-slim@sha256:de170b39…22f38d).

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

(Toolchain pin fix — no consumer-facing behaviour change, and the dev
shell major stays 22, so this is not a breaking change.)

How Has This Been Tested?

Run in the dev shell on x86_64-linux from this branch:

• nix develop --command node --version → v22.23.4
• nix develop --command npm --version → 10.9.9 — npm bundled with
  the selected Node package (…-nodejs-slim-22.23.4-npm store output)
• nix develop --command yarn --version → 1.22.22 (the shell's
  yarn.override { nodejs = nodejs_22; } still resolves)
• nix flake check → all checks passed! (devShell evaluates)
• yarn install --frozen-lockfile (with NOYARNPOSTINSTALL=1) → ok
• yarn check-versions → pass

The code-quality job runs on every PR regardless of changed paths, so
I ran its full check set in the shell too:

• yarn run check-commits → 0 problems (commit-lint)
• yarn run check-deps → pass
• yarn run check-fmt → pass (all modules)
• yarn run lint → pass (all modules)
• yarn run test:scripts → 12 passing

Resolved nixpkgs revision: 8bd525757851975db0aebe3af18073b7f52d6f34
(nixpkgs master; nodejs_22 bumped to 22.23.4 in commit fb7f563bfe).
Reproduce by running the two version commands above on this branch.

Note: the diff touches only flake.nix/flake.lock, which match none
of the changed-path filters in .github/workflows/ci.yml, so the
path-gated jobs (unit-test, browser-test, docker, vendor) skip this PR;
code-quality is not path-gated and runs, per the set above.
(check-fmt was OOM-killed in the sandbox in its CI-style --parallel
form and passed serialized via lerna run check-fmt --concurrency 1;
the kill is sandbox memory, not formatting.)

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• My code compiles correctly for both Node and Browser environments (flake-only change; nix flake check passes)
• I have commented my code, particularly in hard-to-understand areas (the shell/.nvmrc major distinction)
• My commits follow Conventional Commits and I have properly described any BREAKING CHANGES
• The ticket or github issue was included in the commit message as a reference
• I have made corresponding changes to the documentation and on any new/updated functions and/or methods (flake.nix comment; jsdoc n/a)
• I have added tests that prove my fix is effective or that my feature works (n/a — toolchain pin; verified by the version/build checks above)
• New and existing unit tests pass locally with my changes (yarn test:scripts: 12 passing)

[linear-code]

PLAT-2213

[ralph-bitgo]

I picked this revision because nixpkgs master is currently the only branch carrying nodejs_22 = 22.23.4 — both nixos-unstable and nixpkgs-unstable still resolve 22.23.3, below the remediation floor. The 22.23.4 bump landed in master commit fb7f563bfe; this pin is a master rev at/after it that I verified still exposes yarn with the nodejs override argument this flake relies on, and the toolchain came straight from the binary cache (no source build needed).