ci: Run PR pipeline on Node 26 (#34032)

Co-authored-by: Danny Martini <danny@n8n.io>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

.github/actions/setup-nodejs/action.yml

@@ -7,9 +7,9 @@ description: 'Configures Node.js with pnpm, installs Aikido SafeChain for supply
 
 inputs:
   node-version:
-    description: 'Node.js version to use. Pinned to 24.18.1 by default for reproducible builds.'
+    description: 'Node.js version to use. Pinned to 26.5.1 by default for reproducible builds.'
     required: false
-    default: '24.18.1'
+    default: '26.5.1'
   enable-docker-cache:
     description: 'Whether to set up Blacksmith Buildx for Docker layer caching (Blacksmith runners only).'
     required: false
@@ -145,6 +145,16 @@ runs:
       shell: bash
       run: node .github/scripts/verify-safechain.mjs
 
+    - name: Skip Kafka native build (no Node 26 prebuilds)
+      shell: bash
+      run: |
+        node -e "
+          const fs = require('fs');
+          const p = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+          p.pnpm.onlyBuiltDependencies = p.pnpm.onlyBuiltDependencies.filter(d => d !== '@confluentinc/kafka-javascript');
+          fs.writeFileSync('package.json', JSON.stringify(p, null, 2) + '\n');
+        "
+
     # `--loglevel` CLI flag does NOT override `.npmrc` for that path, but
     # `--config.loglevel` does — so the failing script's real output reaches us.
     # (Confirmed on CI across Blacksmith + GitHub-hosted, through the SafeChain
@@ -183,7 +193,7 @@ runs:
         mkdir -p "$PNPM_DIAG_DIR/pnpm-logs"
 
         set +o pipefail
-        timeout --kill-after=30s 300s $INSTALL_COMMAND \
+        timeout --kill-after=30s 600s $INSTALL_COMMAND \
           --config.logs-dir="$PNPM_DIAG_DIR/pnpm-logs" \
           --reporter=append-only --config.loglevel=info 2>&1 | tee "$INSTALL_LOG"
         rc=${PIPESTATUS[0]}
@@ -217,7 +227,7 @@ runs:
           find "$PNPM_DIAG_DIR/pnpm-logs" -type f -exec sh -c 'echo "----- $1 -----"; cat "$1"' _ {} \; 2>/dev/null || echo "(none)"
           echo "::endgroup::"
           case "$rc" in
-            124) echo "::error::pnpm install timed out after 300s (exit 124)" ;;
+            124) echo "::error::pnpm install timed out after 600s (exit 124)" ;;
             137) echo "::error::pnpm install received SIGKILL (exit 137 — likely OOM or kill-after timeout)" ;;
           esac
         fi

.github/workflows/build-base-image.yml

@@ -26,11 +26,17 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Node 26 requires alpine 3.23 on DHI (3.22 pairing isn't published).
-        # While we're on alpine 3.22 awaiting NODE-4184 (graphicsmagick → sharp
-        # migration that unblocks 3.23), Node 26 base builds can't succeed.
-        # Restore '26' to this matrix once 3.23 is back.
-        node_version: ['22', '24.18.1']
+        # One entry per published Node version: `node_version` is the
+        # `n8nio/base:<node_version>` tag, `dhi_ref` the DHI base it builds on,
+        # pinned to a multi-arch index digest. Bump tag and digest together
+        # when updating.
+        include:
+          - node_version: '22'
+            dhi_ref: dhi.io/node:22.23.2-alpine3.24-dev@sha256:a6ac21cfbc4bb746c1cfc6cf1501ec13c961ae71558ff2ac7e021caaaf91a224
+          - node_version: '24.18.1'
+            dhi_ref: dhi.io/node:24.18.1-alpine3.24-dev@sha256:074b5aa92e1ce74cd575214211bbcb8d1550710aec59558da734a67d84d31679
+          - node_version: '26.5.1'
+            dhi_ref: dhi.io/node:26.5.1-alpine3.24-dev@sha256:c4062f85acd1ca91ffb7d15048dcc5f15a922d630e65eb3c3c0dcdcef6ea36d8
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -63,7 +69,7 @@ jobs:
           context: .
           file: ./docker/images/n8n-base/Dockerfile
           build-args: |
-            NODE_VERSION=${{ matrix.node_version }}
+            DHI_REF=${{ matrix.dhi_ref }}
           platforms: linux/amd64,linux/arm64
           provenance: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push == true) }}
           sbom: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push == true) }}

.github/workflows/ci-master.yml

@@ -33,7 +33,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [22.23.2, 24.18.1]
+        node-version: [24.18.1, 26.5.1]
     with:
       ref: ${{ github.sha }}
       nodeVersion: ${{ matrix.node-version }}

.github/workflows/test-linting-reusable.yml

@@ -12,7 +12,7 @@ on:
         description: Version of node to use.
         required: false
         type: string
-        default: 24.18.1
+        default: 26.5.1
 
 env:
   NODE_OPTIONS: --max-old-space-size=7168

.github/workflows/test-unit-reusable.yml

@@ -12,7 +12,7 @@ on:
         description: Version of node to use.
         required: false
         type: string
-        default: 24.18.1
+        default: 26.5.1
       collectCoverage:
         required: false
         default: false

.github/workflows/test-workflow-scripts-reusable.yml

@@ -12,7 +12,7 @@ on:
         description: Version of node to use.
         required: false
         type: string
-        default: 24.18.1
+        default: 26.5.1
 
 env:
   NODE_OPTIONS: --max-old-space-size=7168

docker/images/n8n-base/Dockerfile

@@ -1,7 +1,7 @@
-# Pinned to a multi-arch index digest (linux/amd64 + linux/arm64) for reproducible builds.
-# The tag is the human-readable version; Docker resolves by the digest. Bump the tag and
-# digest together when updating the base image.
-FROM dhi.io/node:24.18.1-alpine3.24-dev@sha256:074b5aa92e1ce74cd575214211bbcb8d1550710aec59558da734a67d84d31679
+# CI passes one DHI reference per published Node version (see the matrix in
+# build-base-image.yml). The default keeps plain `docker build` working.
+ARG DHI_REF=dhi.io/node:24.18.1-alpine3.24-dev@sha256:074b5aa92e1ce74cd575214211bbcb8d1550710aec59558da734a67d84d31679
+FROM ${DHI_REF}
 
 # Install all dependencies in a single layer to minimize image size
 RUN apk add --no-cache busybox-binsh && \
@@ -22,7 +22,8 @@ RUN apk add --no-cache busybox-binsh && \
         tini \
         tzdata \
         ca-certificates \
-        libc6-compat && \
+        libc6-compat \
+        librdkafka && \
     # Cleanup
     rm -rf /tmp/* /root/.npm /root/.cache/node /opt/yarn* && \
     apk del apk-tools

package.json

@@ -3,7 +3,7 @@
   "version": "2.35.0",
   "private": true,
   "engines": {
-    "node": ">=22.22",
+    "node": ">=24.0.0",
     "pnpm": ">=10.22.0"
   },
   "packageManager": "pnpm@10.32.1",

packages/@n8n/agents/package.json

@@ -3,7 +3,7 @@
   "version": "0.20.0",
   "description": "AI agent SDK for n8n's code-first execution engine",
   "engines": {
-    "node": ">=22.22"
+    "node": ">=24.0.0"
   },
   "main": "dist/index.js",
   "module": "dist/index.js",

packages/@n8n/agents/src/workspace/filesystem/n8n-sandbox-filesystem.ts

@@ -1,7 +1,9 @@
 import { SandboxServiceError } from '@n8n/sandbox-client';
 import { dirname } from 'node:path/posix';
 
+import { BaseFilesystem } from './base-filesystem';
 import { raceWithAbort } from '../../sdk/abort';
+import type { N8nSandboxServiceSandbox } from '../sandbox/n8n-sandbox-sandbox';
 import type {
 	AbortableOptions,
 	AppendOptions,
@@ -16,8 +18,6 @@ import type {
 	RemoveOptions,
 	WriteOptions,
 } from '../types';
-import { BaseFilesystem } from './base-filesystem';
-import type { N8nSandboxServiceSandbox } from '../sandbox/n8n-sandbox-sandbox';
 
 function getParentDirectory(path: string): string | null {
 	const parent = dirname(path);