Repository navigation
Pin Node.js to eMudhra-patched versions in docs and JS toolchains (GDS-477) - #489
Merged
FlorentinD merged 3 commits intoOct 29, 2026
Conversation
CVE-2026-111943 (eMudhra intermediate CA compromise): Node.js bundles its own CA trust store, so the OS-level ca-certificates patch already in CI does not protect npm/yarn/Antora TLS. Only Node 22.23.4 / 24.22.1 / 26.12.1+ distrust the compromised intermediates. - Add engines.node range admitting only patched release lines (^22.23.4 || ^24.22.1 || >=26.12.1) to docs/antora and js-applet - Enforce it for npm via engine-strict=true in docs/antora/.npmrc (yarn already fails on incompatible engines) - Add .nvmrc (24.22.1) for local dev - Add a setup-node step to the antora-docs job, which previously ran npm ci on the runner's ambient Node with no version control Refs GDS-473, INC-1013. Co-Authored-By: Claude Code <noreply@anthropic.com>
CI jobs (build-js action, js-code-style, antora-docs) now read the Node version from .nvmrc via node-version-file instead of the lts/* alias, which resolved inconsistently across runners (24.22.1 on one, unpatched 24.21.0 on another) and made yarn fail the engines check. Bumping Node is now a one-line change to .nvmrc. Also move the engines block to the end of js-applet/package.json as required by oxfmt's package.json key ordering. Refs GDS-473, INC-1013. Co-Authored-By: Claude Code <noreply@anthropic.com>
tyndria
commented
Oct 28, 2026
Antora 3.1.x supports Node LTS releases only (docs: "LTS (>= 16)"). Empirically, on Node 26.12.1 the Antora pipeline never settles: the process exits 0 within half a second without logging, downloading the UI bundle, or writing any output — a completely silent no-op. Node 24.22.1 builds the same playbook fine. - Narrow docs/antora engines.node to "^22.23.4 || ^24.22.1" so an install on Node 26 fails loudly (EBADENGINE) instead of producing a silent empty build. js-applet keeps the wider range since its Vite 8 toolchain works on Node 26. - Add a build/site/index.html existence check to the antora-docs CI job so a future silent no-op cannot pass as green. Long term, Node 26 support means upgrading the docs toolchain to Antora 3.2 (supports Node >= 20). Refs GDS-477, INC-1013. Co-Authored-By: Claude Code <noreply@anthropic.com>
tyndria
commented
Oct 28, 2026
| run: | | ||
| npm ci | ||
| npm run verify | ||
| # Antora 3.1.x silently exits 0 without generating anything on |
Contributor
Author
There was a problem hiding this comment.
I've also realised antora 3.1.14 doesn't work with node 26
FlorentinD
approved these changes
Oct 29, 2026
FlorentinD
left a comment
FlorentinD
left a comment
Collaborator
There was a problem hiding this comment.
thank you for picking this up!
FlorentinD
reviewed
Oct 29, 2026
| - name: Setup Node | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | ||
| with: | ||
| node-version: "lts/*" |
Collaborator
There was a problem hiding this comment.
isnt it better to us the latest lts version (i.e. automatically use the last patch?)
Contributor
Author
There was a problem hiding this comment.
good question, I initially left lts but then I had failed checks here, because unpatched Node version 24.21.0 was cached on machine (even if lts/* is specified).
I believe it's possible to enable checking of the latest version with check-latest: false, but I've also learnt that Antora doesn't work with some versions, so I've decided to pin it instead
Contributor
Author
There was a problem hiding this comment.
(specifically Antora 3.1.14)
Contributor
Author
There was a problem hiding this comment.
I've realised Antora is not installed in this pipeline, I'll recheck this PR
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes GDS-477 (sub-issue of GDS-473) — the
python-graph-visualizationportion of the eMudhra intermediate CA compromise remediation (CVE-2026-111943, INC-1013).Why
Node.js bundles its own CA trust store, independent of the OS store — so the
ca-certificatespatch step already present in CI does not protectnpm/yarn/Antora during TLS. Only patched Node releases (22.23.4 / 24.22.1 / 26.12.1) distrust the compromised intermediates. Until now, both toolchains in this repo ran on an unpinned Node version.Notably, the
antora-docsCI job had nosetup-nodestep at all and rannpm cion the runner's ambient Node.🤖 Generated with Claude Code