chore: update node js from 20 to 24 #678
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
**Dropped Support:** - 32-bit Windows (x86) - dropped in v23 - 32-bit Linux ARMv7 - dropped in v24 **Minimum Requirements Increased:** - macOS: now requires 13.5+ (Ventura) - Linux: glibc 2.28+ (unchanged from v22) **OpenSSL Upgrade:** - Node.js 24 includes OpenSSL 3.5 with security level 2 (enforces stronger encryption) - Prohibits RSA/DSA/DH keys <2048 bits and ECC keys <224 bits - Disables RC4 cipher suites **Permission Model Stabilized:** - Experimental permission model (introduced in v20) now stable with `--permission` flag - Provides granular control over filesystem, network, and environment access **npm v11 Security Enhancements:** - Enhanced vulnerability detection and security reporting - Lifecycle script hardening (--ignore-scripts applies to all scripts) - Prevents unsafe script execution **Recent CVE Fixes (2024-2025):** - HTTP/2 server crash vulnerabilities (CVE-2024-27983) - HTTP request smuggling fixes (CVE-2024-27982, CVE-2025-23167) - Path traversal protections (CVE-2024-36138, CVE-2025-27210) - Cryptographic DoS protections (CVE-2025-23166)
There was a problem hiding this comment.
Pull request overview
This PR updates the Node.js dependency from version 20.17.0 to 24.11.1, bringing security enhancements, bug fixes, and improved features while dropping support for older platforms.
- Updates Node.js to v24 with OpenSSL 3.5 and enhanced security level 2
- Incorporates npm v11 with improved vulnerability detection and lifecycle script hardening
- Includes fixes for multiple CVEs related to HTTP/2, request smuggling, and path traversal
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Checklist
Description of change
Dropped Support:
Minimum Requirements Increased:
OpenSSL Upgrade:
Permission Model Stabilized:
--permissionflagnpm v11 Security Enhancements:
Recent CVE Fixes (2024-2025):