[Eli Bosley (elibosley)]

Summary

Update the bundled Node.js runtime from 22.18.0 to the 22.23.4 LTS security release.

Why This Exists

Node 22.23.4 contains the October 21 upstream security fixes, including CVE-2026-111497 in the Brotli decoder and fixes for DNS, TLS, HTTP, and crypto behavior. See the upstream release notes.

Resolution

Update the root .nvmrc and both Docker build images together. The plugin builder already reads the root .nvmrc and replaces its extracted runtime when the version changes.

Reviewer Considerations

This keeps the Node 22 release line. Runtime pins change independently of the @types/node declarations and npm dependencies. API exposure assessment is separate from this upstream runtime maintenance change.

Behavior Changes

New plugin packages bundle Node 22.23.4. API and plugin build images use the same release. Existing installations receive the runtime only after a new package is built and installed.

Implementation Summary

• .nvmrc: 22.23.4.
• api/Dockerfile and plugin/Dockerfile: node:22.23.4-bookworm-slim.

Verification

• git diff --check passed.
• Linux x64 and macOS arm64 archives matched official SHA-256 checksums.
• macOS runtime reported v22.23.4, exposed the patched Brotli decoder error constant, and passed a Brotli round trip.
• Docker image manifest includes Linux amd64.
• CI is running. Audit Dependencies failed with npm advisories on the unchanged dependency graph. This runtime-only patch changes no package manifest or lockfile.

Risk

A full Linux plugin build and installed Unraid acceptance have not run locally. Keep this PR in draft while CI and package validation remain pending.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b9974a70-1e6e-41d2-a8b8-3388663925cc

📥 Commits

Reviewing files that changed from the base of the PR and between 4e27bb8 and a62a557.

📒 Files selected for processing: 3

• .nvmrc
• api/Dockerfile
• plugin/Dockerfile

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

Walkthrough

The configured Node.js version changes from 22.18.0 to 22.23.4 in .nvmrc and the API and plugin Docker images.

Changes

Node.js Version Update

Layer / File(s)	Summary
Align Node.js versions .nvmrc, api/Dockerfile, plugin/Dockerfile	The configured Node.js version and both Docker image versions change from 22.18.0 to 22.23.4.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to a62a5

No actionable merge-blocking risk is identified in the runtime update.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: updating the bundled Node.js runtime from 22.18.0 to 22.23.4.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the version line,
And finds Node's number changed in time.
The API image follows too,
The plugin builder joins the queue.
One-two-two, then two-three-four,
The rabbit hops along once more.}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T18:31:14.915119Z	a62a557	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.40%. Comparing base (4e27bb8) to head (a62a557).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2117      +/-   ##
==========================================
+ Coverage   53.38%   53.40%   +0.02%     
==========================================
  Files        1045     1045              
  Lines       73056    73056              
  Branches     8496     8505       +9     
==========================================
+ Hits        38999    39015      +16     
+ Misses      33929    33913      -16     
  Partials      128      128              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

This plugin has been deployed to Cloudflare R2 and is available for testing.
Download it at this URL:

https://preview.dl.unraid.net/unraid-api/tag/PR2117/dynamix.unraid.net.plg

[github-actions]

🔄 PR Merged - Plugin Redirected to Staging

This PR has been merged and the preview plugin has been updated to redirect to the staging version.

For users testing this PR:

• Your plugin will automatically update to the staging version on the next update check
• The staging version includes all merged changes from this PR
• No manual intervention required

Staging URL:

https://preview.dl.unraid.net/unraid-api/dynamix.unraid.net.plg

Thank you for testing! 🚀