Skip to content

chore: upgrade Node.js to 22.22.0 for security fix - #5469

Merged
tomiir merged 2 commits into
mainfrom
devin/1768462323-security-nodejs-upgrade
Jan 21, 2026
Merged

chore: upgrade Node.js to 22.22.0 for security fix#5469
tomiir merged 2 commits into
mainfrom
devin/1768462323-security-nodejs-upgrade

Conversation

@devin-ai-integration

Copy link
Copy Markdown
Contributor

Description

Upgrades the Node.js version in Dockerfile.canary from node:22-bullseye to node:22.22.0-bullseye to address a critical security vulnerability affecting virtually every production Node.js app.

Reference: https://x.com/matteocollina/status/2011137343323865196

Patched Node.js versions are: 20.20.0, 22.22.0, 24.13.0, 25.3.0

Type of change

  • Chore (non-breaking change that addresses non-functional tasks, maintenance, or code quality improvements)
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

Associated Issues

N/A - Security patch in response to Node.js security advisory

Checklist

  • Code in this PR is covered by automated tests (Unit tests, E2E tests)
  • My changes generate no new warnings
  • I have reviewed my own code
  • I have filled out all required sections
  • I have tested my changes on the preview link
  • Approver of this PR confirms that the changes are tested on the preview link

Human Review Checklist

  • Verify the Docker image builds successfully with Node.js 22.22.0
  • Confirm canary tests pass with the updated image

Link to Devin run: https://app.devin.ai/sessions/fe3816d19c9046e19f1c9a2ee5273c2d
Requested by: Ben Kremer (@bkrem)

Addresses critical Node.js security vulnerability affecting production apps.
See: https://x.com/matteocollina/status/2011137343323865196

Patched versions: Node.js 20.20.0, 22.22.0, 24.13.0, 25.3.0

Co-Authored-By: Ben Kremer <ben@reown.com>
@changeset-bot

changeset-bot Bot commented Jan 15, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 24f81b8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@vercel

vercel Bot commented Jan 15, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Review Updated (UTC)
appkit-basic-html Ready Ready Preview, Comment Jan 15, 2026 11:23am
appkit-demo Ready Ready Preview, Comment Jan 15, 2026 11:23am
appkit-gallery Ready Ready Preview, Comment Jan 15, 2026 11:23am
appkit-headless-sample-app Ready Ready Preview, Comment Jan 15, 2026 11:23am
appkit-laboratory Ready Ready Preview, Comment Jan 15, 2026 11:23am
10 Skipped Deployments
Project Deployment Review Updated (UTC)
appkit-basic-example Ignored Ignored Jan 15, 2026 11:23am
appkit-basic-sign-client-example Ignored Ignored Jan 15, 2026 11:23am
appkit-basic-up-example Ignored Ignored Jan 15, 2026 11:23am
appkit-ethers5-bera Ignored Ignored Jan 15, 2026 11:23am
appkit-nansen-demo Ignored Ignored Jan 15, 2026 11:23am
appkit-vue-solana Ignored Ignored Jan 15, 2026 11:23am
appkit-wagmi-cdn-example Ignored Ignored Jan 15, 2026 11:23am
ethereum-provider-wagmi-example Ignored Ignored Jan 15, 2026 11:23am
next-wagmi-solana-bitcoin-example Ignored Ignored Jan 15, 2026 11:23am
vue-wagmi-example Ignored Ignored Jan 15, 2026 11:23am

@devin-ai-integration
devin-ai-integration Bot requested a review from bkrem January 15, 2026 07:33
@devin-ai-integration

Copy link
Copy Markdown
Contributor Author

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment and CI monitoring

@github-actions

github-actions Bot commented Jan 15, 2026

Copy link
Copy Markdown
Contributor

Visual Regression Test Results ✅ Passed

⚠️ 15 visual change(s) detected

Chromatic Build: https://www.chromatic.com/build?appId=6493191bf4b10fed8ca7353f&number=645
Storybook Preview: https://6493191bf4b10fed8ca7353f-xmwnfjhwwz.chromatic.com/

👉 Please review the visual changes in Chromatic and accept or reject them.

@github-actions

github-actions Bot commented Jan 15, 2026

Copy link
Copy Markdown
Contributor

📦 Bundle Size Check

All bundles are within size limits

📊 View detailed bundle sizes

> @reown/appkit-monorepo@1.7.1 size /home/runner/work/appkit/appkit


> size-limit

@reown/appkit - Main Entry
Size limit:   80 kB
Size:         75.21 kB with all dependencies, minified and gzipped
Loading time: 1.5 s    on slow 3G
Running time: 324 ms   on Snapdragon 410
Total time:   1.8 s
@reown/appkit/react
Size limit:   235 kB
Size:         233.03 kB with all dependencies, minified and gzipped
Loading time: 4.6 s     on slow 3G
Running time: 734 ms    on Snapdragon 410
Total time:   5.3 s
@reown/appkit/vue
Size limit:   80 kB
Size:         75.21 kB with all dependencies, minified and gzipped
Loading time: 1.5 s    on slow 3G
Running time: 317 ms   on Snapdragon 410
Total time:   1.8 s
@reown/appkit-scaffold-ui
Size limit:   220 kB
Size:         213.09 kB with all dependencies, minified and gzipped
Loading time: 4.2 s     on slow 3G
Running time: 605 ms    on Snapdragon 410
Total time:   4.8 s
@reown/appkit-ui
Size limit:   500 kB
Size:         13.16 kB with all dependencies, minified and gzipped
Loading time: 258 ms   on slow 3G
Running time: 63 ms    on Snapdragon 410
Total time:   320 ms

@github-actions

github-actions Bot commented Jan 15, 2026

Copy link
Copy Markdown
Contributor

Coverage Report

Status Category Percentage Covered / Total
🔵 Lines 78.64% 39381 / 50075
🔵 Statements 78.64% 39381 / 50075
🔵 Functions 76.34% 4244 / 5559
🔵 Branches 86.73% 9570 / 11034
File CoverageNo changed files found.
Generated in workflow #16696 for commit 24f81b8 by the Vitest Coverage Report Action

@bkrem
bkrem requested review from 0xmkh and tomiir and removed request for bkrem January 15, 2026 08:09
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants