From dc8902fa37a72d351688d6f490cf37cb8df7494d Mon Sep 17 00:00:00 2001
From: G <41178744+catomean@users.noreply.github.com>
Date: Mon, 31 Aug 2026 18:04:42 +0200
Subject: [PATCH] chore(ci): CI and .nvmrc follow the box to Node 24
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The box ran Node 20 four months past EOL; it moved to 24.20.0 today with
every service health-verified. CI validating on 20 now validates against
a runtime nothing uses.

The npm-audit gate's node/npm coupling comment told the bumper to re-check
its exit code first (npm 11 stops honoring --audit-level): re-checked on
npm 11.11 — the tree is clean at every level, exit 0 — and the comment now
records that instead of still claiming node 20.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WqKqMnHQHSmkGFfc5t7Rxn
---
 .github/workflows/cd.yml       |  2 +-
 .github/workflows/ci.yml       | 25 +++++++++++++++----------
 .github/workflows/e2e-auth.yml |  2 +-
 .nvmrc                         |  2 +-
 4 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 42667eb15..d5ec21fad 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -92,7 +92,7 @@ jobs:
         if: steps.guard.outputs.ok == 'true'
         uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
           cache: 'npm'
 
       - name: Install dependencies
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a0036b8f1..d4088feba 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,7 +35,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
           cache: 'npm'
 
       - name: Install dependencies
@@ -260,7 +260,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
           cache: 'npm'
 
       - name: Install dependencies
@@ -347,7 +347,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
           cache: 'npm'
 
       - name: Dependency audit
@@ -368,14 +368,19 @@ jobs:
         # weakens it. (js-yaml above was dev-only; it was patched anyway because
         # the range already allowed it.)
         #
-        # Tied to `node-version: 20` (npm 10) above, and that coupling is load-
-        # bearing. On npm 11, `npm audit --audit-level=critical` was observed to
-        # exit 1 against a tree whose own --json output reported
-        # {moderate:2, high:1, critical:0} — i.e. the level stops gating the exit
-        # code. Bump this runner to node 22 and the line below silently becomes
-        # "block on ANY advisory, including low", which will wedge every merge on
-        # something unfixable and get this gate weakened rather than debugged.
+        # Tied to the `node-version` (npm major) above, and that coupling is
+        # load-bearing. On npm 11, `npm audit --audit-level=critical` was
+        # observed to exit 1 against a tree whose own --json output reported
+        # {moderate:2, high:1, critical:0} — i.e. the level stops gating the
+        # exit code: the line below silently becomes "block on ANY advisory,
+        # including low", which will wedge every merge on something unfixable
+        # and get this gate weakened rather than debugged.
         # If you bump Node here, re-check this step's exit code first.
+        # Re-checked 2026-08-31 for the 20->24 bump (npm 11.x): the tree is
+        # clean at every level (npm audit --omit=dev --json -> total 0), so
+        # the command below exits 0. The npm 11 caveat still stands the day
+        # an advisory lands: low/moderate will block too — fix or override
+        # the advisory per the ladder below; do not lower the level.
         #
         # WHEN THIS BLOCKS YOU and no patched version exists upstream, do NOT
         # lower the level — that silently re-opens the whole class. In order of
diff --git a/.github/workflows/e2e-auth.yml b/.github/workflows/e2e-auth.yml
index 38d4830b5..c3ab037d9 100644
--- a/.github/workflows/e2e-auth.yml
+++ b/.github/workflows/e2e-auth.yml
@@ -16,7 +16,7 @@ jobs:
       - name: Use Node 20
         uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
           cache: npm
 
       - name: Install dependencies
diff --git a/.nvmrc b/.nvmrc
index 209e3ef4b..a45fd52cc 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-20
+24