Repository navigation
fix(security): update Node.js to v24.22.1 - #1943
jennifer-shehane merged 1 commit into
Conversation
e9bf213 to
99b36d2
Compare
|
@jennifer-shehane, it looks like Firefox timed out during the CI run. Would you be able to re-run it? I don't have the permissions, it seems, to do it myself.
|
|
@jennifer-shehane, I just wanted to say thank you so much for the super quick turnaround on this. I really appreciate it! 🙇🏼 |
|
🎉 This PR is included in version 7.4.7 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
@matthewbraddock We've had our eye on this one in a few other threads. Thanks for the PR! |
|
The version of Node.js that Cypress runs under is determined by the GitHub Actions runner. The changes in this PR don't affect that version.
This repo is currently being served with runner v2.338.0 which provides Node.js 24.22.0. https://github.com/actions/runner/releases/tag/v2.338.1 was released on Oct 22, 2026 and updates the runner version to The repo has no influence on the rollout of this version. The PR did not warrant the commit message |
|
Logs show that Cypress uses the version of Node.js provided by the runner in This is unrelated to whatever version is set up in workflows. ====================================================================================================
(Run Starting)
┌────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Cypress: 16.2.0 │
│ Browser: Chrome 155 (headless) │
│ Node Version: v24.21.0 (/home/runner/actions-runner/cached/2.338.0/externals/node24/bin/node │
│ ) │
│ Specs: 1 found (spec.cy.js) │
│ Searched: cypress/e2e/**/*.cy.{js,jsx,ts,tsx} │
└────────────────────────────────────────────────────────────────────────────────────────────────┘
──────────────────────────────────────────────────────────────────────────────────────────────────── |
|
@MikeMcC399, that is correct. On Friday, I realized my changes only affected the CI pipeline and didn’t address the action’s runtime as I’d intended. Thank you for catching that, explaining the distinction, and putting together the follow-up PR to properly address the version inconsistencies. I appreciate it! |
|
The fast-track merge of this PR (16 minutes from start to finish) was at the expense of having no community review. Apart from introducing inconsistencies, it wasn't otherwise harmful though, even if it didn't achieve the objectives you thought it would. The scope for exploiting vulnerabilities in a typical sandboxed Cypress testing environment is generally limited, when the testing environment is in full control of the data being used and the results of testing are simply to identify successful and failed tests. If you are concerned about the use of Node.js versions lower than the Oct 21, 2026 security release versions, you can run Cypress in a Docker image such as The previous runner update took about 1 week before it was provisioned here in this repo. I can imagine that the 2.338.1 release with the security update to Node.js 24.22.1 will also take about the same time, however there is no way of knowing in advance. The job logs show what has been used in the past: 
You should also be aware of the open issue cypress-io/cypress#35124 regarding the current release of Cypress (16.2.0) that bundles an unpatched Electron version. |
Summary
Update Node.js from
24.22.0to24.22.1in the GitHub Actions workflows to address security vulnerabilities, including the eMudhra Intermediate CA compromise.Node.js
24.22.1was released on October 21, 2026, as part of the official security updates.Changes
24.22.1in.github/workflows/check-dist.yml.24.22.1in.github/workflows/main.yml.References