chore(node): bump Node.js from 20 to v24.19.0 (LTS "Krypton")

[kngako]

Upgrade the Node.js toolchain across the repo from Node 20 (20.20.0) to Node 24.19.0, the current Active LTS release (Krypton, released 2026-08-03). Node 20 approaches end-of-life, and Node >= 22 is a prerequisite for upgrading the invoices BOLT11 library to >= 6.0.x, which ships security fixes for duplicate payment-hash tagged field parsing (alexbosworth/invoices@b30a012) and related input-validation hardening. Node 24.19.0 also naturally includes the async_hooks stack overflow DoS fix that previously forced the 20.20.0 pin.

flake.nix / flake.lock:

• Pin the nixpkgs-node input to nixpkgs rev 06a1bc65f61c040137db4529ba74756c2d110da3, the revision that packages nodejs 24.19.0 (flake.lock updated via nix flake update nixpkgs-node).
• Set expectedNodeVersion = "24.19.0"; the existing assertion keeps guarding against silent version drift on future nixpkgs bumps.
• Stop swapping nodejs through the pkgs overlay. The main nixpkgs' npm build plumbing (srcOnly nodejs in the buildNpmPackage and importNpmLock npm-config hooks, pulled in by pkgs.typescript and pkgs.nodePackages.pnpm) cannot consume the newer structured-attrs nodejs derivation and fails evaluation with: "The 'env' attribute set cannot contain any attributes passed to derivation. The following attributes are overlapping: NINJA, NIX_MAIN_PROGRAM" Instead, nodejs24 is a standalone let-binding used only where the repo consumes Node directly:
  • buck2NativeBuildInputs (buck2 build environment)
  • devShell nativeBuildInputs (via buck2NativeBuildInputs; the bare nodejs entry was removed so the old nodejs no longer shadows node 24 on PATH)
  • the three installPhase exec node substitutions in tscDerivation, nextDerivation and npmDerivation, so packaged binaries run under Node 24 nixpkgs' internal build tooling (typescript, pnpm wrapper) keeps its own Node 20, which is harmless build-time plumbing; pnpm is still taken from nodePackages as before.

package.json engines ("node": "20" -> "24"):

• package.json (workspace root)
• core/api/package.json
• apps/admin-panel/package.json
• third-party/node/turbo/package.json
• third-party/node/rover/package.json

CI:

• .github/workflows/vendor/nodejs-check-code.yml and nodejs-audit.yml: actions/setup-node node-version 20 -> 24. NOTE: these files are auto-synced from blinkbitcoin/concourse-shared via vendir (ci/vendir.yml); the same change must land upstream or the next vendir sync will revert them. The Concourse pipelines also use a nodejs-concourse registry image built outside this repo, which needs its own Node 24 rebuild.

Verification:

• nix develop -c node --version -> v24.19.0 (/nix/store/...-nodejs-24.19.0/bin/node)
• nix develop -c pnpm --version -> 8.15.5 (unchanged)
• nix eval .#packages.x86_64-linux.api.name / .consent.name evaluate cleanly, confirming the expectedNodeVersion assertion passes

Follow-ups (not in this commit):

• Run the full buck2 build and test suites under Node 24 in CI
• Bump @types/node (^20/^22 -> ^24) across the workspace with a pnpm lockfile regen so TypeScript sees the Node 24 API surface
• Upgrade core/api invoices dependency to >= 6.0.5 (now unblocked)

[openoms]

Concrete downstream reason to prioritize this Node upgrade: #775 updates the test stack to LND 0.21.1, but Blink's Node 20 dependency ceiling prevents using a compatible Lightning RPC client.

On #775's E2E rerun, the pinned lightning@10.26.1 fails to decode an LND 0.21 channel event (ExpectedEventTypeInChannelSubscription) and cancels the subscription. That causes Blink to miss a locally initiated channel-open event and leave its 3,850-sat fee unbooked, after which the accounting assertions fail and cascade across the suite.

The current lightning@10.26.1 / ln-service@57.26.1 versions only declare support through LND 0.19.2. The first releases declaring LND 0.21.1 support are lightning@12.1.2 and ln-service@59.1.2, and both require Node >=22. This PR's Node 24 migration therefore directly unblocks the supported fix for #775, in addition to the dependency/security motivation already described here.

Once this lands, #775 should upgrade both packages, regenerate pnpm-lock.yaml, and rerun Core/E2E. Evidence: #775 E2E rerun.