Skip to content

Conversation

@evereq
Copy link
Member

@evereq evereq commented Dec 21, 2025

PR

Please note: we will close your PR without comment if you do not check the boxes above and provide ALL requested information.



Summary by cubic

Upgraded Node.js across Dockerfiles and CI to v24.12.0 and npm to 11.6.2, and bumped Angular to 19.2.17 to keep environments consistent and more secure.

  • Dependencies

    • Docker base images updated to node:24.12.0-alpine3.23 for api, mcp, mcp-auth, and webapp.
    • All GitHub workflows now use Node 24.12.0 and npm 11.6.2; .nvmrc set to 24.
    • Angular packages upgraded to 19.2.17 across apps and libs; updated Angular CLI/devkit/build tools; removed migrations.json and added it to .gitignore.
  • Migration

    • Use Node 24.12.0 and npm 11.6.2 locally.
    • Rebuild Docker images; if native modules fail, clear node_modules and reinstall.

Written for commit a9ede6e. Summary will update automatically on new commits.

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Dec 21, 2025

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch develop

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@socket-security
Copy link

socket-security bot commented Dec 21, 2025

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm entities is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: ?npm/[email protected]

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm entities is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: ?npm/[email protected]

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 16 files

@greptile-apps
Copy link
Contributor

greptile-apps bot commented Dec 21, 2025

Greptile Summary

This PR upgrades Node.js to v24.12.0 across Dockerfiles and GitHub Actions workflows, also updating npm to v11.6.2 and Alpine Linux to v3.23.

Key Changes:

  • Dockerfiles: Updated from Node.js v20.18.1-alpine3.19 to v24.12.0-alpine3.23 (4 files)
  • GitHub Actions workflows: Updated from Node.js v22.21.1 to v24.12.0 and npm from v10.9.4 to v11.6.2 (12 files)

Critical Issues:

  • .nvmrc file not updated - still specifies v21 instead of v24
  • package.json engines field not updated - still requires >=20.18.1 instead of >=24.12.0

Additional Concerns:

  • PR description is incomplete (checklist boxes not checked per custom rule)
  • No explanation of why this upgrade is being done or what testing was performed
  • Major version upgrade (v20/v22 → v24) may introduce breaking changes that should be documented

Confidence Score: 2/5

  • This PR has critical inconsistencies that will cause environment mismatches
  • Score reflects two critical issues: .nvmrc and package.json not updated to match the new Node.js version, which will cause developers using nvm or package managers to use different Node.js versions than Docker/CI environments. The PR also lacks proper description and testing documentation for a major version upgrade.
  • .nvmrc and package.json require immediate updates to maintain consistency across environments

Important Files Changed

Filename Overview
.deploy/api/Dockerfile Updated Node.js from v20.18.1 to v24.12.0 and Alpine from 3.19 to 3.23 across all build stages
.github/workflows/agent-prod.yml Updated Node.js from v22.21.1 to v24.12.0 and npm from v10.9.4 to v11.6.2 across all jobs
.nvmrc NOT UPDATED - still specifies v21, creating version mismatch with Docker/CI (v24.12.0)
package.json NOT UPDATED - engines field still requires >=20.18.1, creating version mismatch

Sequence Diagram

sequenceDiagram
    participant Dev as Developer
    participant NVM as .nvmrc/nvm
    participant PKG as package.json
    participant Docker as Dockerfiles
    participant CI as GitHub Actions
    
    Dev->>NVM: Read Node.js version
    NVM-->>Dev: v21 (not updated!)
    
    Dev->>PKG: Check engines requirement
    PKG-->>Dev: >=20.18.1 (not updated!)
    
    Dev->>Docker: Build Docker images
    Docker-->>Dev: Using Node.js v24.12.0 + Alpine 3.23
    
    Dev->>CI: Trigger CI workflows
    CI-->>Dev: Using Node.js v24.12.0 + npm v11.6.2
    
    Note over Dev,CI: Version mismatch!<br/>Local (v21) ≠ Docker/CI (v24.12.0)
Loading

Copy link
Contributor

@greptile-apps greptile-apps bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Additional Comments (2)

  1. .nvmrc, line 1 (link)

    logic: .nvmrc still specifies v21 but all Dockerfiles and workflows are upgrading to v24.12.0. Update this to maintain consistency.

  2. package.json, line 694 (link)

    logic: package.json engines still requires >=20.18.1 but the PR upgrades to v24.12.0. Update the minimum Node.js version requirement.

16 files reviewed, 2 comments

Edit Code Review Agent Settings | Greptile

syns2191 and others added 2 commits December 22, 2025 23:12
…#9291)

* chore: upgrade angular dependencies version from v19.2.10 to v19.2.17

* chore: upgrade @angular/material and other deps related to angular version

* Delete migrations.json

* Update .gitignore

---------

Co-authored-by: Ruslan Konviser <[email protected]>
@socket-security
Copy link

@evereq evereq changed the title chore: upgrade node version from v20.18.1 to v24.12.0 (#9286) Stage Dec 22, 2025
@evereq evereq merged commit 1a8db2c into stage Dec 22, 2025
19 of 25 checks passed
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2 issues found across 60 files (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="apps/desktop/package.json">

<violation number="1" location="apps/desktop/package.json:99">
P2: Node engine constraint `&gt;=22` is inconsistent with the PR goal of upgrading to Node 24.12.0. Consider using `&gt;=24` or `&gt;=24.12.0` to ensure local development matches CI/production environments and catches any Node 24-specific compatibility issues.</violation>
</file>

<file name="packages/plugins/integration-activepieces/package.json">

<violation number="1" location="packages/plugins/integration-activepieces/package.json:69">
P3: Consider updating `@types/node` in devDependencies to match the new Node.js version requirement. Currently `@types/node` is at `^20.14.9` but engines now requires Node `&gt;=22`. This mismatch could result in missing type definitions for newer Node 22/24 APIs.</violation>
</file>

Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR

"engines": {
"node": ">=20.18.1",
"yarn": ">=1.22.19"
"node": ">=22",
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Dec 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Node engine constraint >=22 is inconsistent with the PR goal of upgrading to Node 24.12.0. Consider using >=24 or >=24.12.0 to ensure local development matches CI/production environments and catches any Node 24-specific compatibility issues.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/desktop/package.json, line 99:

<comment>Node engine constraint `&gt;=22` is inconsistent with the PR goal of upgrading to Node 24.12.0. Consider using `&gt;=24` or `&gt;=24.12.0` to ensure local development matches CI/production environments and catches any Node 24-specific compatibility issues.</comment>

<file context>
@@ -96,8 +96,8 @@
 	&quot;engines&quot;: {
-		&quot;node&quot;: &quot;&gt;=20.18.1&quot;,
-		&quot;yarn&quot;: &quot;&gt;=1.22.19&quot;
+		&quot;node&quot;: &quot;&gt;=22&quot;,
+		&quot;yarn&quot;: &quot;&gt;=1.22&quot;
 	},
</file context>
Fix with Cubic

"engines": {
"node": ">=20.18.1",
"yarn": ">=1.22.19"
"node": ">=22",
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Dec 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: Consider updating @types/node in devDependencies to match the new Node.js version requirement. Currently @types/node is at ^20.14.9 but engines now requires Node >=22. This mismatch could result in missing type definitions for newer Node 22/24 APIs.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/plugins/integration-activepieces/package.json, line 69:

<comment>Consider updating `@types/node` in devDependencies to match the new Node.js version requirement. Currently `@types/node` is at `^20.14.9` but engines now requires Node `&gt;=22`. This mismatch could result in missing type definitions for newer Node 22/24 APIs.</comment>

<file context>
@@ -66,8 +66,8 @@
 	&quot;engines&quot;: {
-		&quot;node&quot;: &quot;&gt;=20.18.1&quot;,
-		&quot;yarn&quot;: &quot;&gt;=1.22.19&quot;
+		&quot;node&quot;: &quot;&gt;=22&quot;,
+		&quot;yarn&quot;: &quot;&gt;=1.22&quot;
 	},
</file context>
Fix with Cubic

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants