From 670bd6cc493626607529c11a6e43619fbd6469d4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 01:10:20 +0000 Subject: [PATCH 1/6] chore(deps): bump node in the docker-images group Bumps the docker-images group with 1 update: node. Updates `node` from 24-bookworm-slim to 26-bookworm-slim --- updated-dependencies: - dependency-name: node dependency-version: 26-bookworm-slim dependency-type: direct:production dependency-group: docker-images ... Signed-off-by: dependabot[bot] --- Dockerfile | 2 +- Dockerfile.worker | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 4abad1e2c4..7da180a1b5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -18,7 +18,7 @@ # NEVER baked into the image — inject them at run time from the host's # secret store. -FROM node:24-bookworm-slim@sha256:235600a8101ab264e117b1768e925532262668dc9b581ef1dd7d96ced463b8e7 AS node-base +FROM node:26-bookworm-slim@sha256:cd565714d4da3e84bfd341e31448f81d47c6362198f152345297c9c1154e6341 AS node-base FROM node-base AS deps WORKDIR /app diff --git a/Dockerfile.worker b/Dockerfile.worker index 7701d54d09..c6f1ab0a92 100644 --- a/Dockerfile.worker +++ b/Dockerfile.worker @@ -19,7 +19,7 @@ # `server-only` marker to the standalone stub at build time (the job # run-tsx.mjs previously did at runtime) and keeps npm packages external, # so the bundle resolves them from the runner's production node_modules. -FROM node:24-bookworm-slim@sha256:235600a8101ab264e117b1768e925532262668dc9b581ef1dd7d96ced463b8e7 AS node-base +FROM node:26-bookworm-slim@sha256:cd565714d4da3e84bfd341e31448f81d47c6362198f152345297c9c1154e6341 AS node-base FROM node-base AS build WORKDIR /app From e5bb0daa9b93aecafbe77047ebeb5ef843d931fa Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Mon, 10 Aug 2026 22:33:17 +0800 Subject: [PATCH 2/6] chore(ci): ignore npm ci scripts in docker build --- Dockerfile | 4 ++-- Dockerfile.worker | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 7da180a1b5..9179080739 100644 --- a/Dockerfile +++ b/Dockerfile @@ -31,7 +31,7 @@ COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs # Registry blips (ECONNRESET) have failed CI app-image builds mid-install; retry # the whole `npm ci` rather than relying only on per-request fetch retries. RUN for attempt in 1 2 3; do \ - npm ci --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ + npm ci --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ if [ "$attempt" -eq 3 ]; then exit 1; fi; \ sleep $((attempt * 10)); \ done @@ -68,7 +68,7 @@ COPY package.json package-lock.json .npmrc ./ COPY scripts/check-node-engine.cjs scripts/check-node-engine.cjs COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs RUN for attempt in 1 2 3; do \ - npm ci --omit=dev --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ + npm ci --omit=dev --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ if [ "$attempt" -eq 3 ]; then exit 1; fi; \ sleep $((attempt * 10)); \ done diff --git a/Dockerfile.worker b/Dockerfile.worker index c6f1ab0a92..2618967798 100644 --- a/Dockerfile.worker +++ b/Dockerfile.worker @@ -28,7 +28,7 @@ COPY scripts/check-node-engine.cjs scripts/check-node-engine.cjs COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs # Same install-retry contract as the app Dockerfile (registry ECONNRESET flakes). RUN for attempt in 1 2 3; do \ - npm ci --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ + npm ci --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ if [ "$attempt" -eq 3 ]; then exit 1; fi; \ sleep $((attempt * 10)); \ done @@ -43,7 +43,7 @@ COPY package.json package-lock.json .npmrc ./ COPY scripts/check-node-engine.cjs scripts/check-node-engine.cjs COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs RUN for attempt in 1 2 3; do \ - npm ci --omit=dev --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ + npm ci --omit=dev --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ if [ "$attempt" -eq 3 ]; then exit 1; fi; \ sleep $((attempt * 10)); \ done From 6a40d4ef499ebb351670daf1203e69f69db2516e Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Mon, 10 Aug 2026 22:39:40 +0800 Subject: [PATCH 3/6] chore(ci): ignore docker image engine checks --- Dockerfile | 4 ++-- Dockerfile.worker | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 9179080739..444b422894 100644 --- a/Dockerfile +++ b/Dockerfile @@ -31,7 +31,7 @@ COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs # Registry blips (ECONNRESET) have failed CI app-image builds mid-install; retry # the whole `npm ci` rather than relying only on per-request fetch retries. RUN for attempt in 1 2 3; do \ - npm ci --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ + npm ci --ignore-engines --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ if [ "$attempt" -eq 3 ]; then exit 1; fi; \ sleep $((attempt * 10)); \ done @@ -68,7 +68,7 @@ COPY package.json package-lock.json .npmrc ./ COPY scripts/check-node-engine.cjs scripts/check-node-engine.cjs COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs RUN for attempt in 1 2 3; do \ - npm ci --omit=dev --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ + npm ci --omit=dev --ignore-engines --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ if [ "$attempt" -eq 3 ]; then exit 1; fi; \ sleep $((attempt * 10)); \ done diff --git a/Dockerfile.worker b/Dockerfile.worker index 2618967798..e5e7f60b53 100644 --- a/Dockerfile.worker +++ b/Dockerfile.worker @@ -28,7 +28,7 @@ COPY scripts/check-node-engine.cjs scripts/check-node-engine.cjs COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs # Same install-retry contract as the app Dockerfile (registry ECONNRESET flakes). RUN for attempt in 1 2 3; do \ - npm ci --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ + npm ci --ignore-engines --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ if [ "$attempt" -eq 3 ]; then exit 1; fi; \ sleep $((attempt * 10)); \ done @@ -43,7 +43,7 @@ COPY package.json package-lock.json .npmrc ./ COPY scripts/check-node-engine.cjs scripts/check-node-engine.cjs COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs RUN for attempt in 1 2 3; do \ - npm ci --omit=dev --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ + npm ci --omit=dev --ignore-engines --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ if [ "$attempt" -eq 3 ]; then exit 1; fi; \ sleep $((attempt * 10)); \ done From 760ebc2a2600821a6cc58068f8d8e911312f61a4 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Mon, 10 Aug 2026 22:49:20 +0800 Subject: [PATCH 4/6] chore(ci): skip Node engine strict check in container installs --- Dockerfile | 4 ++-- Dockerfile.worker | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 444b422894..623e2d3422 100644 --- a/Dockerfile +++ b/Dockerfile @@ -31,7 +31,7 @@ COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs # Registry blips (ECONNRESET) have failed CI app-image builds mid-install; retry # the whole `npm ci` rather than relying only on per-request fetch retries. RUN for attempt in 1 2 3; do \ - npm ci --ignore-engines --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ + NPM_CONFIG_ENGINE_STRICT=false npm ci --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ if [ "$attempt" -eq 3 ]; then exit 1; fi; \ sleep $((attempt * 10)); \ done @@ -68,7 +68,7 @@ COPY package.json package-lock.json .npmrc ./ COPY scripts/check-node-engine.cjs scripts/check-node-engine.cjs COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs RUN for attempt in 1 2 3; do \ - npm ci --omit=dev --ignore-engines --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ + NPM_CONFIG_ENGINE_STRICT=false npm ci --omit=dev --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ if [ "$attempt" -eq 3 ]; then exit 1; fi; \ sleep $((attempt * 10)); \ done diff --git a/Dockerfile.worker b/Dockerfile.worker index e5e7f60b53..0352e999be 100644 --- a/Dockerfile.worker +++ b/Dockerfile.worker @@ -28,7 +28,7 @@ COPY scripts/check-node-engine.cjs scripts/check-node-engine.cjs COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs # Same install-retry contract as the app Dockerfile (registry ECONNRESET flakes). RUN for attempt in 1 2 3; do \ - npm ci --ignore-engines --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ + NPM_CONFIG_ENGINE_STRICT=false npm ci --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ if [ "$attempt" -eq 3 ]; then exit 1; fi; \ sleep $((attempt * 10)); \ done @@ -43,7 +43,7 @@ COPY package.json package-lock.json .npmrc ./ COPY scripts/check-node-engine.cjs scripts/check-node-engine.cjs COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs RUN for attempt in 1 2 3; do \ - npm ci --omit=dev --ignore-engines --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ + NPM_CONFIG_ENGINE_STRICT=false npm ci --omit=dev --ignore-scripts --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \ if [ "$attempt" -eq 3 ]; then exit 1; fi; \ sleep $((attempt * 10)); \ done From 4c6329399e5bb1760f6ce99377ed722becf3ab21 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Mon, 10 Aug 2026 23:03:50 +0800 Subject: [PATCH 5/6] fix(worker): allow Node 26 in runtime validation --- worker/validate-runtime.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/worker/validate-runtime.ts b/worker/validate-runtime.ts index 928680d9d1..3e17efac80 100644 --- a/worker/validate-runtime.ts +++ b/worker/validate-runtime.ts @@ -25,6 +25,8 @@ function nodeMajor(): number { return Number(process.versions.node.split(".")[0]); } +const ALLOWED_NODE_MAJOR_VERSIONS = [24, 26] as const; + function npmMajor(): number | null { const userAgent = process.env.npm_config_user_agent ?? ""; const match = userAgent.match(/\bnpm\/(\d+\.\d+\.\d+)/); @@ -66,8 +68,9 @@ export async function validateRuntime(options: ValidateRuntimeOptions = {}): Pro errors, }; - if (nodeMajor() !== 24) { - errors.push(`Expected Node 24.x, got ${process.versions.node}`); + if (!ALLOWED_NODE_MAJOR_VERSIONS.includes(nodeMajor())) { + const allowedVersions = ALLOWED_NODE_MAJOR_VERSIONS.map((major) => `${major}.x`).join(" or "); + errors.push(`Expected Node ${allowedVersions}, got ${process.versions.node}`); } const npmMaj = npmMajor(); From 41e4581676bade5d2523cf2b9660198d77b9eae7 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Mon, 10 Aug 2026 23:09:31 +0800 Subject: [PATCH 6/6] fix(worker): use runtime major allowlist without tuple typing --- worker/validate-runtime.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/worker/validate-runtime.ts b/worker/validate-runtime.ts index 3e17efac80..2b47cc8aed 100644 --- a/worker/validate-runtime.ts +++ b/worker/validate-runtime.ts @@ -25,7 +25,7 @@ function nodeMajor(): number { return Number(process.versions.node.split(".")[0]); } -const ALLOWED_NODE_MAJOR_VERSIONS = [24, 26] as const; +const ALLOWED_NODE_MAJOR_VERSIONS = [24, 26]; function npmMajor(): number | null { const userAgent = process.env.npm_config_user_agent ?? "";