mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Node.js 20 → 24 LTS migration (EOL preparation) #367

New Issue
Closed
opened 2026-02-13 01:29:28 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-02-13 01:29:28 +00:00
Owner
Copy Link

Context

Node.js 20 (Jod) enters Maintenance LTS on 2026-10-20 and reaches EOL on 2027-04-30. Node.js 24 (Krypton) entered Active LTS on 2026-02-09 and is now the recommended production version.

We should migrate proactively while Node 24 is fresh in Active LTS, rather than rushing during the maintenance/EOL window.

Scope

All Node.js usage across the monorepo:

  • Dockerfiles (4): orchestrator, web, api, coordinator
  • CI pipelines (5): — all use
  • Package engines: engine constraints (if any)
  • Runtime compatibility: NestJS, Next.js 16, Prisma, Vitest
  • Local development: /

Migration checklist

  • Verify NestJS compatibility with Node 24
  • Verify Next.js 16 compatibility with Node 24
  • Verify Prisma ORM compatibility with Node 24
  • Update all Dockerfiles ()
  • Update all CI pipeline image references
  • Update / if present
  • Update engines field if present
  • Run full test suite on Node 24 (api, web, orchestrator)
  • Run E2E tests on Node 24
  • Verify Docker builds succeed for all images
  • Run Trivy scans on all rebuilt images

Added benefits

  • npm 11.8.0 ships with , fixing 2 of 3 suppressed tar CVEs:
    • CVE-2026-23745 (fixed in 7.5.3)
    • CVE-2026-23950 (fixed in 7.5.4)
    • CVE-2026-24842 still needs tar >= 7.5.7 (suppressed in )
  • Reduced surface after migration
  • Access to Node 24 features (require(esm) stable, V8 13.x, etc.)

References

## Context Node.js 20 (Jod) enters Maintenance LTS on 2026-10-20 and reaches EOL on 2027-04-30. Node.js 24 (Krypton) entered Active LTS on 2026-02-09 and is now the recommended production version. We should migrate proactively while Node 24 is fresh in Active LTS, rather than rushing during the maintenance/EOL window. ## Scope All Node.js usage across the monorepo: - **Dockerfiles** (4): orchestrator, web, api, coordinator - **CI pipelines** (5): — all use - **Package engines**: engine constraints (if any) - **Runtime compatibility**: NestJS, Next.js 16, Prisma, Vitest - **Local development**: / ## Migration checklist - [ ] Verify NestJS compatibility with Node 24 - [ ] Verify Next.js 16 compatibility with Node 24 - [ ] Verify Prisma ORM compatibility with Node 24 - [ ] Update all Dockerfiles () - [ ] Update all CI pipeline image references - [ ] Update / if present - [ ] Update engines field if present - [ ] Run full test suite on Node 24 (api, web, orchestrator) - [ ] Run E2E tests on Node 24 - [ ] Verify Docker builds succeed for all images - [ ] Run Trivy scans on all rebuilt images ## Added benefits - npm 11.8.0 ships with , fixing 2 of 3 suppressed tar CVEs: - CVE-2026-23745 (fixed in 7.5.3) - CVE-2026-23950 (fixed in 7.5.4) - CVE-2026-24842 still needs tar >= 7.5.7 (suppressed in ) - Reduced surface after migration - Access to Node 24 features (require(esm) stable, V8 13.x, etc.) ## References - [Node.js release schedule](https://nodejs.org/en/about/previous-releases) - Current suppression rationale: in repo root
jason.woltje added the devops label 2026-02-13 01:29:28 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ai
AI/LLM integration
 api
Backend/API work
 api
auth
Authentication
 database
database
Database/schema work
 devops
Docker/deployment
 docs
Documentation
 frontend
graph
knowledge-module
migration
Data migration
 orchestrator
Orchestrator service (apps/orchestrator/)
 p0
Critical priority
 p1
High priority
 p2
Medium priority
 p3
Low priority
 performance
Performance work
 phase-1
phase-2
phase-3
phase-4
phase-5
plugin
MoltBot plugin work
 search
security
Security-related
 setup
Initial setup
 testing
Testing/QA
 web
Frontend work
No Label devops
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaic/stack#367
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?