fix: Bump Node to 22.23.4 / 24.22.1 for October 2026 security release

.github/workflows/ci.yml

@@ -306,7 +306,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: ['22.21.0', '24.16.0']
+        node-version: ['22.23.4', '24.22.1']
     defaults:
       run:
         working-directory: packages/code
@@ -343,7 +343,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          node-version: 24.16.0
+          node-version: 24.22.1
       - run: npm ci
       - run: npm run build
       - name: Selected project root containment tests
@@ -370,7 +370,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          node-version: 24.16.0
+          node-version: 24.22.1
       - name: Install bubblewrap
         run: |
           sudo apt-get update -qq

.github/workflows/extraction.yml

@@ -14,7 +14,7 @@ jobs:
             - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
             - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
               with:
-                  node-version: 24.16.0
+                  node-version: 24.22.1
                   cache: npm
                   cache-dependency-path: packages/extraction/package-lock.json
             - run: npm ci --ignore-scripts

api/Dockerfile

@@ -35,7 +35,7 @@ COPY api/src/spec-guard.c /tmp/spec-guard.c
 COPY api/src/tool-call-pipe-bridge.c /tmp/tool-call-pipe-bridge.c
 COPY api/src/anonymous-pipes.c /tmp/anonymous-pipes.c
 COPY api/src/supervisor-policy.c /tmp/supervisor-policy.c
-COPY --from=node:22-slim /usr/local/include/node /usr/local/include/node
+COPY --from=node:22.23.4-slim /usr/local/include/node /usr/local/include/node
 COPY docker/rootfs-setup.c /tmp/rootfs-setup.c
 RUN gcc -shared -fPIC -O2 -Wall -Wextra -Werror -I/usr/local/include/node -o /usr/local/lib/anonymous-pipes.node /tmp/anonymous-pipes.c \
     && gcc -O2 -static -Wall -Wextra -Werror -o /usr/local/bin/sandbox-supervisor-policy /tmp/supervisor-policy.c \
@@ -49,7 +49,7 @@ FROM nsjail-builder AS nsjail-ipc-test
 ENV SANDBOX_PIPE_ADDON=/usr/local/lib/anonymous-pipes.node
 COPY docker/python-runtime /python-runtime
 RUN python3 /python-runtime/install.py
-COPY --from=node:22-slim /usr/local/bin/node /usr/local/bin/node
+COPY --from=node:22.23.4-slim /usr/local/bin/node /usr/local/bin/node
 COPY --from=oven/bun:1.4.2-debian /usr/local/bin/bun /usr/local/bin/bun
 
 # ============================================================================
@@ -138,7 +138,7 @@ RUN chmod +x /usr/sbin/nsjail
 # The per-invocation broker starts Node after restore, so its OpenSSL process
 # state is not captured in the MicroVM snapshot. Pulling the Node binary
 # is ~30 MB and avoids inheriting npm/node_modules from a full apt install.
-COPY --from=node:22-slim /usr/local/bin/node /usr/local/bin/node
+COPY --from=node:22.23.4-slim /usr/local/bin/node /usr/local/bin/node
 
 WORKDIR /sandbox_api
 

build-packages.sh

@@ -9,7 +9,7 @@
 #
 # Environment Variables:
 #   PYTHON_VERSION=3.14.4    # Python version to install
-#   NODE_VERSION=24.15.0     # Node.js version to install
+#   NODE_VERSION=24.22.1     # Node.js version to install
 #   BUN_VERSION=1.4.2       # Bun version to install
 #   BASH_PACKAGE_VERSION=5.2.0 # Bash package registration version (semver-like x.y.z)
 #   SKIP_PYTHON_PACKAGES=1   # Skip Python pip packages
@@ -27,7 +27,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "$SCRIPT_DIR"
 
 PYTHON_VERSION="${PYTHON_VERSION:-3.14.4}"
-NODE_VERSION="${NODE_VERSION:-24.15.0}"
+NODE_VERSION="${NODE_VERSION:-24.22.1}"
 BUN_VERSION="${BUN_VERSION:-1.4.2}"
 PACKAGES_DIR="./data/pkgs"
 JS_PACKAGE_MANIFEST="${JS_PACKAGE_MANIFEST:-${SCRIPT_DIR}/javascript-packages.txt}"

docker/Dockerfile.worker-sandbox

@@ -48,7 +48,7 @@ COPY api/src/spec-guard.c /tmp/spec-guard.c
 COPY api/src/tool-call-pipe-bridge.c /tmp/tool-call-pipe-bridge.c
 COPY api/src/anonymous-pipes.c /tmp/anonymous-pipes.c
 COPY api/src/supervisor-policy.c /tmp/supervisor-policy.c
-COPY --from=node:22-slim /usr/local/include/node /usr/local/include/node
+COPY --from=node:22.23.4-slim /usr/local/include/node /usr/local/include/node
 COPY docker/rootfs-setup.c /tmp/rootfs-setup.c
 RUN gcc -shared -fPIC -O2 -Wall -Wextra -Werror -I/usr/local/include/node -o /usr/local/lib/anonymous-pipes.node /tmp/anonymous-pipes.c \
     && gcc -O2 -static -Wall -Wextra -Werror -o /usr/local/bin/sandbox-supervisor-policy /tmp/supervisor-policy.c \
@@ -160,7 +160,7 @@ COPY --from=nsjail-builder /usr/local/bin/sandbox-supervisor-policy /usr/local/b
 COPY --from=nsjail-builder /usr/local/lib/anonymous-pipes.node /usr/local/lib/anonymous-pipes.node
 ENV SANDBOX_PIPE_ADDON=/usr/local/lib/anonymous-pipes.node
 RUN chmod +x /usr/sbin/nsjail
-COPY --from=node:22-slim /usr/local/bin/node /usr/local/bin/node
+COPY --from=node:22.23.4-slim /usr/local/bin/node /usr/local/bin/node
 
 WORKDIR /sandbox_api
 

docker/package-init.sh

@@ -20,7 +20,7 @@ PYTHON_ALIAS="python${PYTHON_SITE_VERSION}"
 # below — that's inherent to installing unpinned packages, not specific to uv.
 PYTHON_PACKAGE_INSTALLER="${PYTHON_PACKAGE_INSTALLER:-uv}"
 UV_VERSION="${UV_VERSION:-0.11.26}"
-NODE_VERSION="${NODE_VERSION:-24.15.0}"
+NODE_VERSION="${NODE_VERSION:-24.22.1}"
 BUN_VERSION="${BUN_VERSION:-1.4.2}"
 BASH_PACKAGE_VERSION="${BASH_PACKAGE_VERSION:-5.2.0}"
 INSTALL_FAILED=false

helm/codeapi/values.yaml

@@ -310,7 +310,7 @@ workerSandbox:
         tag: latest
         pullPolicy: Always
       pythonVersion: "3.14.4"
-      nodeVersion: "24.15.0"
+      nodeVersion: "24.22.1"
       bunVersion: "1.4.2"
       bashPackageVersion: "5.2.0"
       backoffLimit: 2

launcher/Dockerfile

@@ -40,7 +40,7 @@ COPY api/src/spec-guard.c /tmp/spec-guard.c
 COPY api/src/tool-call-pipe-bridge.c /tmp/tool-call-pipe-bridge.c
 COPY api/src/anonymous-pipes.c /tmp/anonymous-pipes.c
 COPY api/src/supervisor-policy.c /tmp/supervisor-policy.c
-COPY --from=node:22-slim /usr/local/include/node /usr/local/include/node
+COPY --from=node:22.23.4-slim /usr/local/include/node /usr/local/include/node
 COPY docker/rootfs-setup.c /tmp/rootfs-setup.c
 RUN gcc -shared -fPIC -O2 -Wall -Wextra -Werror -I/usr/local/include/node -o /usr/local/lib/anonymous-pipes.node /tmp/anonymous-pipes.c \
     && gcc -O2 -static -Wall -Wextra -Werror -o /usr/local/bin/sandbox-supervisor-policy /tmp/supervisor-policy.c \
@@ -79,7 +79,7 @@ COPY --from=nsjail-builder /usr/local/bin/tool-call-pipe-bridge /usr/local/bin/t
 COPY --from=nsjail-builder /usr/local/bin/sandbox-supervisor-policy /usr/local/bin/sandbox-supervisor-policy
 COPY --from=nsjail-builder /usr/local/lib/anonymous-pipes.node /usr/local/lib/anonymous-pipes.node
 ENV SANDBOX_PIPE_ADDON=/usr/local/lib/anonymous-pipes.node
-COPY --from=node:22-slim /usr/local/bin/node /usr/local/bin/node
+COPY --from=node:22.23.4-slim /usr/local/bin/node /usr/local/bin/node
 RUN chmod +x /usr/sbin/nsjail
 
 WORKDIR /sandbox_api

packages/code/Dockerfile

@@ -1,11 +1,11 @@
-FROM node:24-alpine AS build
+FROM node:24.22.1-alpine AS build
 WORKDIR /app
 COPY package.json package-lock.json tsconfig.json ./
 RUN npm ci
 COPY src ./src
 RUN npm run build
 
-FROM node:24-alpine
+FROM node:24.22.1-alpine
 ENV NODE_ENV=production
 RUN apk add --no-cache bash bubblewrap ripgrep socat \
   && addgroup -S librechat-code \

packages/extraction/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.16.0-bookworm-slim AS build
+FROM node:24.22.1-bookworm-slim AS build
 WORKDIR /build
 COPY packages/extraction/package*.json ./
 RUN npm ci --ignore-scripts --no-audit --no-fund

service/Dockerfile.node

@@ -1,5 +1,5 @@
 # Base stage for shared steps
-FROM node:22-slim AS base
+FROM node:22.23.4-slim AS base
 WORKDIR /app
 COPY service/package*.json ./
 RUN npm ci
@@ -13,7 +13,7 @@ COPY service/tsconfig.json ./
 RUN npx tsc -p tsconfig.json
 
 # Production stage
-FROM node:22-slim AS production
+FROM node:22.23.4-slim AS production
 ENV NODE_ENV=production
 WORKDIR /app
 COPY service/package*.json ./

service/src/config.spec.ts

@@ -22,7 +22,7 @@ describe('node language configuration', () => {
   it('maps Node.js requests to the node sandbox runtime', () => {
     expect(languageConfig[Languages.node]).toEqual({
       language: 'node',
-      version: '24.15.0',
+      version: '24.22.1',
       fileName: 'index.js',
     });
   });
@@ -45,7 +45,7 @@ describe('node language configuration', () => {
 
     expect(payload).toMatchObject({
       language: 'node',
-      version: '24.15.0',
+      version: '24.22.1',
       session_id: 'session-node',
       args: ['--trace-warnings'],
       files: [

service/src/config.ts

@@ -11,7 +11,7 @@ import {
 export const languageConfig: Record<Languages | string, t.LanguageConfig | undefined> = {
   [Languages.bash]: { language: 'bash', version: '5.2.0', fileName: 'script.sh' },
   [Languages.js]: { language: 'bun-js', version: '1.4.2', fileName: 'index.js' },
-  [Languages.node]: { language: 'node', version: '24.15.0', fileName: 'index.js' },
+  [Languages.node]: { language: 'node', version: '24.22.1', fileName: 'index.js' },
   [Languages.py]: { language: 'python', version: '3.14.4', fileName: 'main.py' },
   [Languages.ts]: { language: 'bun-ts', version: '1.4.2', fileName: 'main.ts' },
 };