Bump .nvmrc to 24.16.0 (matches in-flight Docker node bumps)#656
Open
julietshen wants to merge 1 commit into
Open
Bump .nvmrc to 24.16.0 (matches in-flight Docker node bumps)#656julietshen wants to merge 1 commit into
julietshen wants to merge 1 commit into
Conversation
`.nvmrc` was pinned at 24.14.1 but the Docker base images in `Dockerfile`, `client/Dockerfile`, `db/Dockerfile`, and `nodejs-instrumentation/Dockerfile` are about to land on 24.16.0 via the dependabot PRs (#565-569). Without this bump, local dev (nvm) would run 24.14.1 while CI Docker runs 24.16.0 — drift inside the same major that `engines: "^24.0.0"` doesn't catch. Pinning to the patch level (rather than just `24`) preserves the existing intent of local-vs-CI reproducibility. Future node patch bumps will need this file touched alongside the Dockerfile PRs; a follow-up could add a CI guard that asserts the two stay in sync. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
📝 WalkthroughWalkthroughNode.js runtime version is updated from 24.14.1 to 24.16.0 in the ChangesNode.js Runtime Version
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
.nvmrcwas pinned at 24.14.1 (floor set by #218 because v24.14.1 patches 2 high-severity + 4 medium-severity CVEs in Node). The four open dependabot PRs #565-569 bump the Docker base images to 24.16.0. Without this companion bump, local dev (nvm) would run 24.14.1 while CI Docker runs 24.16.0 — drift inside the same major thatengines: "^24.0.0"doesn't catch, and that breaks the dev/CI-parity intent of the original.nvmrclock-in (#112).Why 24.16.0 specifically
Matches the in-flight dependabot Docker bumps. Inherits the security floor from #218 (all 6 CVEs fixed in 24.14.1 are also in 24.16.0) plus the additional fixes in 24.15.0 / 24.16.0.
Patch-level pin (rather than loosening to just
24) preserves the existing intent of local-vs-CI reproducibility.Suggested order
Merge this with — or just after — #565, #566, #567, #569 land. They form a single logical change (same way #218 was a follow-up to its 4 corresponding Dependabot PRs).
Follow-up
#657 tracks the longer-term mechanism to keep
.nvmrcin sync with Dockerfile node versions automatically (CI guard vs. auto-sync action vs. Renovate). This PR is the manual fix for the current drift; the issue is for the longer-term call.🤖 Generated with Claude Code