Skip to content

chore(deps): update dependency node to v26 - #464

Closed
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/node-26.x
Closed

renovate[bot] wants to merge 2 commits into
mainfrom
renovate/node-26.x

Conversation

@renovate

@renovate renovate Bot commented Oct 31, 2026 •

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending Age Confidence
node uses-with major 24 → 26 26.13.0 (+2) age confidence
node uses-with major 22 → 26 26.13.0 (+2) age confidence
node (source) major 22.23.2-bookworm-slim → 26.11.1-bookworm-slim 26.13.0 (+2) age confidence
@types/node (source) major ^24.10.1 → ^26.0.0 age confidence

Release Notes

actions/node-versions (node)

v26.11.1: 26.11.1

Compare Source

Node.js 26.11.1

v26.11.0: 26.11.0

Compare Source

Node.js 26.11.0

v26.10.0: 26.10.0

Compare Source

Node.js 26.10.0

v26.9.0: 26.9.0

Compare Source

Node.js 26.9.0

v26.8.2: 26.8.2

Compare Source

Node.js 26.8.2

v26.8.1: 26.8.1

Compare Source

Node.js 26.8.1

v26.8.0: 26.8.0

Compare Source

Node.js 26.8.0

v26.7.0: 26.7.0

Compare Source

Node.js 26.7.0

v26.6.0: 26.6.0

Compare Source

Node.js 26.6.0

v26.5.1: 26.5.1

Compare Source

Node.js 26.5.1

v26.5.0: 26.5.0

Compare Source

Node.js 26.5.0

v26.4.0: 26.4.0

Compare Source

Node.js 26.4.0

v26.3.1: 26.3.1

Compare Source

Node.js 26.3.1

v26.3.0: 26.3.0

Compare Source

Node.js 26.3.0

v26.2.0: 26.2.0

Compare Source

Node.js 26.2.0

v26.1.0: 26.1.0

Compare Source

Node.js 26.1.0

v26.0.0: 26.0.0

Compare Source

Node.js 26.0.0

nodejs/node (node)

v26.11.1: 2026-10-07, Version 26.11.1 (Current), @​aduh95

Compare Source

Commits
  • [2dc4638e85] - Revert "build: toggle doc-kit verbosity based on V" (Antoine du Hamel)
  • [3febbc54ec] - Revert "build, doc: move to redesign" (Antoine du Hamel)
  • [173250e2e7] - Revert "tools: bump the doc group in /tools/doc with 4 updates" (Antoine du Hamel)

v26.10.0: 2026-09-22, Version 26.10.0 (Current), @​aduh95

Compare Source

Notable Changes
Commits

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (in timezone Asia/Jerusalem)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the renovate label Oct 31, 2026
@renovate
renovate Bot requested a review from omercnet as a code owner October 31, 2026 19:10
@renovate renovate Bot added the renovate label Oct 31, 2026
@coderabbitai

coderabbitai Bot commented Oct 31, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1
  • bun.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: c7e116b7-278c-4312-b84e-9e7a74becd9e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review

No actionable comments were generated in the recent review.

Recent review info
Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 37c862fc-12d7-4c31-b05f-0b5f346ef717
Commits

Reviewing files that changed from the base of the PR and between 38c8887 and a8d1bd0.

Files ignored due to path filters: 1
  • bun.lock is excluded by !**/*.lock
Files selected for processing: 7
  • .github/workflows/ci.yml
  • .github/workflows/omp-latest.yml
  • .github/workflows/paseo-latest.yml
  • .github/workflows/release-please.yml
  • .github/workflows/renovate-lockfiles.yml
  • package.json
  • paseo-omp/canary/compose.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

Walkthrough

The pull request updates Node.js versions to 26 across CI, compatibility, release, and lockfile workflows. It also updates the @types/node catalog version and the canary mock-LLM container image.

Changes: Node.js 26 Runtime Update

Layer / File(s) Summary
Node.js type and container versions
package.json, paseo-omp/canary/compose.yml
The @types/node catalog version changes to ^26.0.0. The canary mock-llm image changes to Node.js 26.
CI workflow runtimes
.github/workflows/ci.yml
Eight CI jobs switch to Node.js 26. The separate Node.js installation inside WSL remains unchanged.
Compatibility and release workflow runtimes
.github/workflows/omp-latest.yml, .github/workflows/paseo-latest.yml, .github/workflows/release-please.yml, .github/workflows/renovate-lockfiles.yml
The OMP latest, Paseo latest, release-please, and lockfile refresh workflows switch to Node.js 26.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Possibly related issues

  • omercnet/paseo-plugins issue 1: It tracks repository dependency updates, including Node.js runtime references and @types/node.

Possibly related PRs

Suggested reviewers: omercnet

Merge Risk: Minimal · previous review a8d1b

No concrete merge-blocking issue was identified in the Node.js 26 update.

Security architecture risk: Low · up to a8d1b

The configured permissions, secret placement, network bindings, and startup controls remain unchanged. No introduced security concern was established. Residual uncertainty concerns the replacement image’s runtime identity and behavior, and cleanup after forced interruption.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The relevant security scope is automation executing under existing workflow authority and the local canary environment. The changed mock image can communicate with its Compose peers, but receives no newly configured secret or writable host mount. No broader tenant or production-service exposure was established.

Trust Boundaries and Controls

  • observed — The image update preserves the host-to-container boundary controls visible in Compose: mock-LLM has a read-only source mount and loopback publication, while the password is configured only on Paseo. These controls do not establish the replacement image’s internal identity or prove its runtime behavior.

Resilience and Maintainability Implications

  • inferred — Unique project names and passwords limit interference between repeated runs, but do not reclaim stale resources after forced interruption. Port allocation also releases the listener before Compose binds it. These existing lifecycle limitations can cause failed startup or leave a workspace-mounted service running; the comparison does not show that Node 26 introduces or worsens them.
Pre-merge checks: Passed 5
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely describes the main change: updating Node.js references and the related Node.js type dependency to version 26.
Docstring Coverage Passed No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (7 skipped: 7 unsupported.)

Finishing Touches
Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

@renovate
renovate Bot force-pushed the renovate/node-26.x branch from a8d1bd0 to 7e98487 Compare October 31, 2026 19:40
@renovate
renovate Bot force-pushed the renovate/node-26.x branch from d987582 to 4ceafdf Compare October 31, 2026 19:48
@omercnet

Copy link
Copy Markdown
Owner

Closing. Node 26 entered Active LTS on 2026-10-28, so the version itself is fine, but this PR is not a safe bump for this repo:

  • CI deliberately runs Node 22 lanes for paseo-omp (engines >=22.18.0) and Node 24 lanes for every other plugin (engines >=24). Moving all of them, the canary image and @types/node to 26 removes coverage of the declared minimums while the engines fields still promise Node 22/24 support.
  • @types/node 26 breaks paseo-shared-browser typecheck on all three OSes (server/virtual-display.ts(82,43): 'string | NonSharedBuffer' not assignable to 'Uint8Array'), and would let code typecheck against APIs missing on Node 24.
  • CI sentinel failed on e27fe5f (shared-browser, plus a top windows CPU threshold assertion).

Node majors should move together with the engines fields as a deliberate change. #465 holds node and @types/node majors in Renovate.

@omercnet omercnet closed this Oct 31, 2026
@renovate

renovate Bot commented Oct 31, 2026

Copy link
Copy Markdown
Contributor Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 26.x releases. But if you manually upgrade to 26.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate
renovate Bot deleted the renovate/node-26.x branch October 31, 2026 20:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant