[rahultee]

Why

Node 24.22.1 was built from a Nixpkgs package set that selected the unpatched Brotli 1.2.0 library for Node 24. Nixpkgs has an upstream fix for CVE-2026-111497: Nixpkgs Brotli fix.

What changed

• Add a pinned Nixpkgs input at the upstream Brotli fix and use its standard Node 24.22.1 package. Its shared Brotli dependency includes the upstream fix.
• Limit the new package input to the Node 24 runtime. Node 22 remains on its existing package set, Node 20 is unchanged, and module IDs/upgrade aliases are unchanged.

Test plan

• Nix evaluation confirms Node 24.22.1 uses brotli-1.2.0-dev from the fixed package, whose patch list includes the upstream fix.
• Active and deployment module metadata/alias evaluation passed. nix fmt -- --check flake.nix and git diff --check passed.
• The upstream Brotli package test target and the selected Node 24 package build are running in the background. Results are pending. No full module bundle build was run.

Rollout

Rebuild the module bundle to deliver the Node 24 package with fixed Brotli. Reverting restores the previous Node 24 package set.

• This is fully backward and forward compatible

~ written by ⠕ Replit