From e0ef6264ddc785f3e9aae85e8a468802bd9f4275 Mon Sep 17 00:00:00 2001 From: Tonia Vertsinskaya Date: Wed, 28 Oct 2026 13:21:56 +0000 Subject: [PATCH 1/2] Pin Node.js to eMudhra-patched versions in docs and JS toolchains CVE-2026-111943 (eMudhra intermediate CA compromise): Node.js bundles its own CA trust store, so the OS-level ca-certificates patch already in CI does not protect npm/yarn/Antora TLS. Only Node 22.23.4 / 24.22.1 / 26.12.1+ distrust the compromised intermediates. - Add engines.node range admitting only patched release lines (^22.23.4 || ^24.22.1 || >=26.12.1) to docs/antora and js-applet - Enforce it for npm via engine-strict=true in docs/antora/.npmrc (yarn already fails on incompatible engines) - Add .nvmrc (24.22.1) for local dev - Add a setup-node step to the antora-docs job, which previously ran npm ci on the runner's ambient Node with no version control Refs GDS-473, INC-1013. Co-Authored-By: Claude Code --- .github/workflows/render-docs.yml | 7 +++++++ .nvmrc | 1 + docs/antora/.npmrc | 1 + docs/antora/package.json | 3 +++ js-applet/package.json | 3 +++ 5 files changed, 15 insertions(+) create mode 100644 .nvmrc create mode 100644 docs/antora/.npmrc diff --git a/.github/workflows/render-docs.yml b/.github/workflows/render-docs.yml index e348a8f6..dda33061 100644 --- a/.github/workflows/render-docs.yml +++ b/.github/workflows/render-docs.yml @@ -71,6 +71,13 @@ jobs: sudo apt-get install --only-upgrade -y ca-certificates sudo update-ca-certificates --fresh + - name: Set up Node + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: "lts/*" + cache: npm + cache-dependency-path: docs/antora/package-lock.json + - name: Build Antora docs (fail on warnings) run: | npm ci diff --git a/.nvmrc b/.nvmrc new file mode 100644 index 00000000..ce62013c --- /dev/null +++ b/.nvmrc @@ -0,0 +1 @@ +24.22.1 diff --git a/docs/antora/.npmrc b/docs/antora/.npmrc new file mode 100644 index 00000000..b6f27f13 --- /dev/null +++ b/docs/antora/.npmrc @@ -0,0 +1 @@ +engine-strict=true diff --git a/docs/antora/package.json b/docs/antora/package.json index c7580b88..50bf576a 100644 --- a/docs/antora/package.json +++ b/docs/antora/package.json @@ -23,6 +23,9 @@ ], "author": "Neo4j", "license": "ISC", + "engines": { + "node": "^22.23.4 || ^24.22.1 || >=26.12.1" + }, "dependencies": { "@neo4j-antora/aliases-redirects": "^0.2.5", "@neo4j-antora/antora-add-notes": "^0.3.2", diff --git a/js-applet/package.json b/js-applet/package.json index 29d150f3..1ccbb406 100644 --- a/js-applet/package.json +++ b/js-applet/package.json @@ -3,6 +3,9 @@ "version": "0.3.7", "license": "GPL-3.0-only", "type": "module", + "engines": { + "node": "^22.23.4 || ^24.22.1 || >=26.12.1" + }, "scripts": { "dev": "concurrently -n widget,html,jupyter -c cyan,magenta,green \"npm:dev:widget\" \"npm:dev:html\" \"npm:dev:jupyter\"", "dev:widget": "vite build --watch", From 8881154c84d7656b1c3132d3c6352eea6e89f1e1 Mon Sep 17 00:00:00 2001 From: Tonia Vertsinskaya Date: Wed, 28 Oct 2026 13:32:00 +0000 Subject: [PATCH 2/2] Use .nvmrc as single Node version source; fix oxfmt key order CI jobs (build-js action, js-code-style, antora-docs) now read the Node version from .nvmrc via node-version-file instead of the lts/* alias, which resolved inconsistently across runners (24.22.1 on one, unpatched 24.21.0 on another) and made yarn fail the engines check. Bumping Node is now a one-line change to .nvmrc. Also move the engines block to the end of js-applet/package.json as required by oxfmt's package.json key ordering. Refs GDS-473, INC-1013. Co-Authored-By: Claude Code --- .github/actions/build-js/action.yml | 2 +- .github/workflows/js-code-style.yml | 2 +- .github/workflows/render-docs.yml | 2 +- js-applet/package.json | 6 +++--- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/actions/build-js/action.yml b/.github/actions/build-js/action.yml index 710bbe04..d1f5b398 100644 --- a/.github/actions/build-js/action.yml +++ b/.github/actions/build-js/action.yml @@ -7,7 +7,7 @@ runs: - name: Setup Node uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: "lts/*" + node-version-file: .nvmrc cache: yarn cache-dependency-path: js-applet/yarn.lock diff --git a/.github/workflows/js-code-style.yml b/.github/workflows/js-code-style.yml index 65e4931b..d81d5a9c 100644 --- a/.github/workflows/js-code-style.yml +++ b/.github/workflows/js-code-style.yml @@ -40,7 +40,7 @@ jobs: - name: Set up Node uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: "lts/*" + node-version-file: .nvmrc - name: Install dependencies run: yarn diff --git a/.github/workflows/render-docs.yml b/.github/workflows/render-docs.yml index dda33061..41ca25af 100644 --- a/.github/workflows/render-docs.yml +++ b/.github/workflows/render-docs.yml @@ -74,7 +74,7 @@ jobs: - name: Set up Node uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: "lts/*" + node-version-file: .nvmrc cache: npm cache-dependency-path: docs/antora/package-lock.json diff --git a/js-applet/package.json b/js-applet/package.json index 1ccbb406..a33b8d5c 100644 --- a/js-applet/package.json +++ b/js-applet/package.json @@ -3,9 +3,6 @@ "version": "0.3.7", "license": "GPL-3.0-only", "type": "module", - "engines": { - "node": "^22.23.4 || ^24.22.1 || >=26.12.1" - }, "scripts": { "dev": "concurrently -n widget,html,jupyter -c cyan,magenta,green \"npm:dev:widget\" \"npm:dev:html\" \"npm:dev:jupyter\"", "dev:widget": "vite build --watch", @@ -51,5 +48,8 @@ "vite": "^8.3.0", "vite-plugin-singlefile": "^2.3.3", "vitest": "^5.0.1" + }, + "engines": { + "node": "^22.23.4 || ^24.22.1 || >=26.12.1" } }