Repository navigation
Conversation
CVE-2026-111943 (eMudhra intermediate CA compromise): Node.js bundles its own CA trust store, so the OS-level ca-certificates patch already in CI does not protect npm/yarn/Antora TLS. Only Node 22.23.4 / 24.22.1 / 26.12.1+ distrust the compromised intermediates. - Add engines.node range admitting only patched release lines (^22.23.4 || ^24.22.1 || >=26.12.1) to docs/antora and js-applet - Enforce it for npm via engine-strict=true in docs/antora/.npmrc (yarn already fails on incompatible engines) - Add .nvmrc (24.22.1) for local dev - Add a setup-node step to the antora-docs job, which previously ran npm ci on the runner's ambient Node with no version control Refs GDS-473, INC-1013. Co-Authored-By: Claude Code <noreply@anthropic.com>
CI jobs (build-js action, js-code-style, antora-docs) now read the Node version from .nvmrc via node-version-file instead of the lts/* alias, which resolved inconsistently across runners (24.22.1 on one, unpatched 24.21.0 on another) and made yarn fail the engines check. Bumping Node is now a one-line change to .nvmrc. Also move the engines block to the end of js-applet/package.json as required by oxfmt's package.json key ordering. Refs GDS-473, INC-1013. Co-Authored-By: Claude Code <noreply@anthropic.com>
tyndria
deleted the
gds-473-nodejs-version-unpinned-in-gds-docs-toolchains-antora-apply
branch
October 28, 2026 13:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes GDS-477 (sub-issue of GDS-473) — the
python-graph-visualizationportion of the eMudhra intermediate CA compromise remediation (CVE-2026-111943, INC-1013).Why
Node.js bundles its own CA trust store, independent of the OS store — so the
ca-certificatespatch step already present in CI does not protectnpm/yarn/Antora during TLS. Only patched Node releases (22.23.4 / 24.22.1 / 26.12.1) distrust the compromised intermediates. Until now, both toolchains in this repo ran on an unpinned Node version.Notably, the
antora-docsCI job had nosetup-nodestep at all and rannpm cion the runner's ambient Node.Changes
docs/antora/package.json,js-applet/package.json— addengines.node: "^22.23.4 || ^24.22.1 || >=26.12.1", admitting only patched release lines (the never-patched 25.x line and pre-fix versions are rejected)docs/antora/.npmrc—engine-strict=true, so npm fails on an incompatible Node instead of only warning (yarn already enforces engines natively).nvmrc—24.22.1(current LTS), the single source of truth for the Node version.github/actions/build-js/action.yml,.github/workflows/js-code-style.yml,.github/workflows/render-docs.yml— CI reads the Node version from.nvmrcvianode-version-file(thelts/*alias resolved inconsistently across runners, including an unpatched 24.21.0 that the engines check then correctly rejected)Bumping Node in the future is a one-line change to
.nvmrc; theenginesrange already allows all patched versions.How to validate
nvm usein the repo root picks up.nvmrcnpm installindocs/antorafails withEBADENGINE;yarninjs-appletfails with an engine incompatibility errorThe other three toolchains listed in GDS-473 (graph-data-science → GDS-478, graph-data-science-client → GDS-479, graph-analytics → GDS-480) live in separate repos and follow the same pattern.
Refs GDS-477, GDS-473, INC-1013.
🤖 Generated with Claude Code