From a998c4fd33ab32a1e5a9b0ea37a47945687fc62e Mon Sep 17 00:00:00 2001
From: bitgobot <bitgobot@bitgo.com>
Date: Thu, 22 Oct 2026 16:57:45 +0000
Subject: [PATCH] build(root): bump Nix dev shell to Node 22.23.4

The flake's nixpkgs-nodejs input was pinned to a nixpkgs revision
whose nodejs_22 was 22.14.0, below the patched floor for the Node
October 2026 security release. Move the pin to nixpkgs master
8bd52575 (verified nodejs_22 = 22.23.4) so the Node 22 dev shell
matches the BitGo Express runtime update in WCN-3321 (22.23.4).

The dev shell intentionally stays on Node 22 while the root .nvmrc
keeps the separate Node 24 SDK toolchain; a comment in flake.nix now
records that the two majors are independent decisions.

Verified in the shell: node v22.23.4, npm 10.9.9 (bundled with the
Node toolchain), yarn 1.22.22; nix flake check passes and flake.lock
matches the input pin.

Ticket: PLAT-2213
Session-Id: 43e5ef1d-2bb5-49a8-8dd2-7c4a9fd4fd47
Task-Id: e5e0b452-7fb4-4ea6-98c2-7e96e3c91dd8
---
 flake.lock | 8 ++++----
 flake.nix  | 5 ++++-
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/flake.lock b/flake.lock
index c0679747a03..b5748c36840 100644
--- a/flake.lock
+++ b/flake.lock
@@ -17,17 +17,17 @@
     },
     "nixpkgs-nodejs": {
       "locked": {
-        "lastModified": 1749174413,
-        "narHash": "sha256-urN9UMK5cd1dzhR+Lx0xHeTgBp2MatA5+6g9JaxjuQs=",
+        "lastModified": 1792686473,
+        "narHash": "sha256-vgbDVD3b0TBw8dYsMK4WC+a4ilx4aJIslhTQjBMr7aA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6ad174a6dc07c7742fc64005265addf87ad08615",
+        "rev": "8bd525757851975db0aebe3af18073b7f52d6f34",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6ad174a6dc07c7742fc64005265addf87ad08615",
+        "rev": "8bd525757851975db0aebe3af18073b7f52d6f34",
         "type": "github"
       }
     },
diff --git a/flake.nix b/flake.nix
index df2f2f3068d..2c49b516446 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,7 +1,10 @@
 {
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs";
-    nixpkgs-nodejs.url = "github:nixos/nixpkgs/6ad174a6dc07c7742fc64005265addf87ad08615"; # Node.js 22.14.0
+    # Node 22 is intentional here: the dev shell mirrors the BitGo Express
+    # runtime major, while the root .nvmrc pins the separate Node 24 SDK
+    # toolchain. Keep the two decisions independent.
+    nixpkgs-nodejs.url = "github:nixos/nixpkgs/8bd525757851975db0aebe3af18073b7f52d6f34"; # Node.js 22.23.4
   };
 
   outputs = {