From 37eed34323e78f513bb3128fcb093383cd26cf89 Mon Sep 17 00:00:00 2001 From: Aditya Singh Date: Fri, 23 Oct 2026 17:58:41 +0530 Subject: [PATCH 1/4] fix(deps): require patched Node for CVE-2026-111497 Node.js 22.23.4, 24.22.1 and 26.12.1 fix CVE-2026-111497, a high-severity out-of-bounds write in the Brotli decoder. Raise .nvmrc (which the shared CI workflows read) and the engines floor so earlier, affected releases warn on install. Ref: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases --- .nvmrc | 2 +- docs/getting-started.md | 2 +- package-lock.json | 2 +- package.json | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.nvmrc b/.nvmrc index db49bb1..b8b23ca 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -22.22.2 +22.23.4 diff --git a/docs/getting-started.md b/docs/getting-started.md index 1646b5e..fa81e4c 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -7,7 +7,7 @@ This guide turns the skeleton into a working plugin: you'll create a personalize - **Git** - **Composer 2** - **PHP 8.2+** (for Composer and the host-side PHPCS/PHPStan checks) -- **Node and npm** matching [`.nvmrc`](../.nvmrc) (Node 22.22.2 or later) — use `nvm` or another version manager +- **Node and npm** matching [`.nvmrc`](../.nvmrc) (Node 22.23.4 or later) — use `nvm` or another version manager - **Docker**, running, for the bundled `wp-env` site and the PHP test suite An existing local WordPress installation can replace the `wp-env` site; Docker is still needed for the container-based PHP test command. diff --git a/package-lock.json b/package-lock.json index 236b64c..284128a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -41,7 +41,7 @@ "webpack-remove-empty-scripts": "1.1.1" }, "engines": { - "node": "^22.22.2 || ^24.15.0 || >=26.0.0" + "node": "^22.23.4 || ^24.22.1 || >=26.12.1" } }, "node_modules/@ariakit/components": { diff --git a/package.json b/package.json index dc232d3..bc76c64 100644 --- a/package.json +++ b/package.json @@ -19,7 +19,7 @@ "url": "https://github.com/rtCamp/plugin-elementary/issues" }, "engines": { - "node": "^22.22.2 || ^24.15.0 || >=26.0.0" + "node": "^22.23.4 || ^24.22.1 || >=26.12.1" }, "devDependencies": { "@babel/core": "7.29.7", From 940b51436f2ee867e853e8356c35d61468ae9ee4 Mon Sep 17 00:00:00 2001 From: Aditya Singh Date: Fri, 23 Oct 2026 18:31:09 +0530 Subject: [PATCH 2/4] fix(deps): refuse installs on Node below the engines floor npm treats engines as advisory, so an affected Node only got an EBADENGINE warning. engine-strict makes npm ci / npm i (including Composer's npm i hook) fail instead. Patched 22.23.4 and 24.22.1 still install cleanly. --- .npmrc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.npmrc b/.npmrc index 2dac7dd..7a4e818 100644 --- a/.npmrc +++ b/.npmrc @@ -7,3 +7,7 @@ save-exact = true ; eslint ^9, @react-spring wants react ^18) while this skeleton pins eslint 10 and ; react 19; tolerate the peer mismatch rather than force-downgrade. legacy-peer-deps = true + +; Fail the install, instead of only warning, on a Node outside package.json +; engines, so releases affected by CVE-2026-111497 are refused. +engine-strict = true From 564165f048aac0541b19cfef3d5059040178a236 Mon Sep 17 00:00:00 2001 From: Aditya Singh Date: Fri, 23 Oct 2026 19:45:50 +0530 Subject: [PATCH 3/4] revert(deps): drop engine-strict, keep engines advisory engine-strict turned the engines floor into a hard install failure. Node here only runs dev tooling (build, lint, tests, wp-env), so CVE-2026-111497 exposure is minimal, and the security ask is the .nvmrc and engines bump, not enforcement. engine-strict also failed CI, since the shared wp-ci@v1 installs the runner-cached Node 22.23.3 instead of reading .nvmrc (rtCamp/wp-shared-workflows#47). Affected releases still get an npm EBADENGINE warning. This reverts commit 940b514. Co-Authored-By: Claude Opus 5.5 --- .npmrc | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.npmrc b/.npmrc index 7a4e818..2dac7dd 100644 --- a/.npmrc +++ b/.npmrc @@ -7,7 +7,3 @@ save-exact = true ; eslint ^9, @react-spring wants react ^18) while this skeleton pins eslint 10 and ; react 19; tolerate the peer mismatch rather than force-downgrade. legacy-peer-deps = true - -; Fail the install, instead of only warning, on a Node outside package.json -; engines, so releases affected by CVE-2026-111497 are refused. -engine-strict = true From b5f2fcb0ae6d8a9e0d44eb770dfd0f6ad6956abf Mon Sep 17 00:00:00 2001 From: Aditya Singh Date: Fri, 23 Oct 2026 19:46:12 +0530 Subject: [PATCH 4/4] docs: name each patched Node line in the setup requirements "22.23.4 or later" read as if any newer Node were fine, but 24.21.0 is newer and still affected, and engines rejects it. Co-Authored-By: Claude Opus 5.5 --- docs/getting-started.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started.md b/docs/getting-started.md index fa81e4c..5c97678 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -7,7 +7,7 @@ This guide turns the skeleton into a working plugin: you'll create a personalize - **Git** - **Composer 2** - **PHP 8.2+** (for Composer and the host-side PHPCS/PHPStan checks) -- **Node and npm** matching [`.nvmrc`](../.nvmrc) (Node 22.23.4 or later) — use `nvm` or another version manager +- **Node and npm** matching [`.nvmrc`](../.nvmrc) (Node 22.23.4; 24.22.1+ and 26.12.1+ also meet `engines` in `package.json`) — use `nvm` or another version manager - **Docker**, running, for the bundled `wp-env` site and the PHP test suite An existing local WordPress installation can replace the `wp-env` site; Docker is still needed for the container-based PHP test command.