Skip to content

Bump plugin runtime Node.js from 20 to 24 #855

Description

@zeljkoX

Context

Production image currently ships Node 20 (EOL 2026-04-30) while plugins/ already requires >=22:

  • @openzeppelin/relayer-sdk@1.10.0 declares engines: { node: '>=22.14.0' }
  • Image ships 20.19.6 → live engine violation (warning only without engine-strict)

Node 20 receives no further upstream security fixes. Scan flagged CVE-2025-55130 in 20.19.6.

Current pin nodejs=~${NODE_VERSION} with NODE_VERSION=20.19 is a prefix match, frozen to 20.19.x since #266. No automation alerts on it.

Proposal

Migrate to Node 24 (Active LTS, EOL 2028-04-30).

  • 22 is maintenance (EOL 2027-04-30) — would need another bump next year
  • 26 is not LTS until 2026-10-28

Pin by major so patches flow in on rebuild:

Acceptance criteria

  • Dockerfile.production and Dockerfile.development use nodejs-24
  • CI uses Node 24
  • node --version reports 24.x in built image (amd64/arm64)
  • pnpm install no longer warns about unsupported engine for relayer-sdk
  • pnpm test in plugins/ + cargo test services::plugins green
  • One example plugin runs with PLUGIN_USE_POOL=true and false

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    D-mediumIntermediate-level tasksT-featureSuggests a new feature or enhancement

    Type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions