Upgrade Node to 24.22.1 for the October 2026 security release

.mise.toml

@@ -5,7 +5,7 @@
 min_version = "2026.9.16"
 
 [tools]
-node = "24.17.0"
+node = "24.22.1"
 pnpm = "12.7.0"
 
 [env]

.nvmrc

@@ -1 +1 @@
-24.17.0
+24.22.1

package.json

@@ -59,10 +59,10 @@
   "devEngines": {
     "runtime": {
       "name": "node",
-      "version": "24.17.0"
+      "version": "24.22.1"
     }
   },
   "volta": {
-    "node": "24.17.0"
+    "node": "24.22.1"
   }
 }

packages/ai-bot/Dockerfile

@@ -1,4 +1,4 @@
-ARG NODE_VERSION=24.17.0
+ARG NODE_VERSION=24.22.1
 ARG PNPM_VERSION=12.7.0
 FROM node:${NODE_VERSION}-slim
 ARG CI=1

packages/bot-runner/Dockerfile

@@ -1,4 +1,4 @@
-ARG NODE_VERSION=24.17.0
+ARG NODE_VERSION=24.22.1
 ARG PNPM_VERSION=12.7.0
 FROM node:${NODE_VERSION}-slim
 ARG CI=1

packages/boxel-icons/package.json

@@ -81,7 +81,7 @@
     "typescript": "catalog:"
   },
   "engines": {
-    "node": "24.17.0"
+    "node": "24.22.1"
   },
   "ember": {
     "edition": "octane"

packages/boxel-ui/package.json

@@ -128,7 +128,7 @@
     "typescript": "catalog:"
   },
   "engines": {
-    "node": "24.17.0"
+    "node": "24.22.1"
   },
   "ember": {
     "edition": "octane"

packages/observability/collectors/Dockerfile

@@ -1,4 +1,4 @@
-ARG NODE_VERSION=24.17.0
+ARG NODE_VERSION=24.22.1
 FROM node:${NODE_VERSION}-slim
 
 # The collector is a single file that uses nothing beyond the Node runtime and

packages/postgres/Dockerfile

@@ -1,4 +1,4 @@
-ARG NODE_VERSION=24.17.0
+ARG NODE_VERSION=24.22.1
 ARG PNPM_VERSION=12.7.0
 FROM node:${NODE_VERSION}-slim
 ARG CI=1
@@ -29,4 +29,4 @@
 # alive so the long-lived ECS service stays up after a successful migrate. The
 # deploy runs the same script as a one-shot task and gates on its exit code;
 # `&& sleep infinity` runs only when the migrate exited 0.
 CMD ./scripts/run-migrations.sh && sleep infinity

packages/realm-server/prerender-manager.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM node:24.17.0-slim
+FROM node:24.22.1-slim
 ARG prerender_manager_script
 ENV prerender_manager_script=$prerender_manager_script
 
@@ -27,4 +27,4 @@
 HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
   CMD curl --fail --silent --show-error --max-time 5 --output /dev/null http://localhost:4222/ || exit 1
 
 CMD exec /realm-server/packages/realm-server/$prerender_manager_script

packages/realm-server/prerender.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM node:24.17.0-slim
+FROM node:24.22.1-slim
 ARG prerender_script
 ENV prerender_script=$prerender_script
 
@@ -81,4 +81,4 @@
 HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
     CMD curl --fail --silent --show-error --max-time 5 --output /dev/null http://localhost:4221/ || exit 1
 
 CMD exec /realm-server/packages/realm-server/$prerender_script

packages/realm-server/realm-server.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM node:24.17.0-slim
+FROM node:24.22.1-slim
 ARG realm_server_script
 ENV realm_server_script=$realm_server_script
 
@@ -29,4 +29,4 @@
 
 EXPOSE 3000
 
 CMD exec /realm-server/packages/realm-server/$realm_server_script

packages/realm-server/worker.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM node:24.17.0-slim
+FROM node:24.22.1-slim
 ARG worker_script
 ENV worker_script=$worker_script
 
@@ -24,4 +24,4 @@
 
 EXPOSE 3000
 
 CMD exec /realm-server/packages/realm-server/$worker_script

packages/software-factory/README.md

@@ -37,7 +37,7 @@ The run works phases front to back and stops after the target phase (inclusive).
 
 ## Prerequisites
 
-- Node >= 24 (the repo pins `24.17.0` via `.nvmrc` / Volta — run `nvm use` or let Volta pick it up)
+- Node >= 24 (the repo pins `24.22.1` via `.nvmrc` / Volta — run `nvm use` or let Volta pick it up)
 - **One-time build/setup** — on a fresh `pnpm install`-only checkout, run:
 
   ```bash

packages/software-factory/src/preflight.ts

@@ -33,7 +33,7 @@ export { boxelSkillsPresent };
 
 export const MIN_NODE_MAJOR = 24;
 // Matches `.nvmrc` and root package.json `devEngines.runtime`.
-export const PINNED_NODE = '24.17.0';
+export const PINNED_NODE = '24.22.1';
 
 // Whether argv is asking for usage. Lives here, apart from the usage text it
 // guards, because the CLI has to answer this question *before* importing the