Repository navigation
chore(security): floor Node engines at the October 2026 patched releases - #3301
Draft
miguelg719 wants to merge 2 commits into
Draft
miguelg719 wants to merge 2 commits into
miguelg719 wants to merge 2 commits into
Conversation
Node 22.23.4 / 24.22.1 / 26.12.1 fix 10 CVEs (4 high). Every engines range moves to ^22.23.4 || ^24.22.1 || >=26.12.1 (24-only packages: ^24.22.1 || >=26.12.1), which also excludes EOL 25.x. The Browse CLI enforces engines at startup, so it now exits on unpatched Node. Docs that state the minimum Node version follow.
🦋 Changeset detectedLatest commit: 9dba1e1 The changes in this PR will be included in the next version bump. This PR includes changesets to release 21 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Rejects unpatched 22/24/26 releases and EOL 20/25; accepts the first patched release on each supported line.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
why
Follow-up to #3298. Node's Oct 21 security release (10 CVEs, 4 high) is fixed in 22.23.4 / 24.22.1 / 26.12.1; our engines ranges still admit unpatched versions and EOL 25.x.
what changed
engines.node→^22.23.4 || ^24.22.1 || >=26.12.1; packages that were 24-only →^24.22.1 || >=26.12.1@browserbasehq/stagehand,@browserbasehq/eve,browse(patch changeset)browseenforces engines at startup (bin/run.js), so it now exits on unpatched Node instead of just warning at installtest plan
browse --versionruns on 24.22.1 and exits with the upgrade message on 24.18.0Summary by cubic
Floors all Node.js engine ranges at the October 2026 patched releases (22.23.4, 24.22.1, 26.12.1) to fix 10 CVEs, 4 of them high severity. The new ranges also exclude EOL Node 25.x.
engines.noderange becomes^22.23.4 || ^24.22.1 || >=26.12.1; 24-only packages use^24.22.1 || >=26.12.1.browseCLI now exits at startup on unpatched Node instead of only warning during install.Written for commit 9dba1e1. Summary will update on new commits.