chore(node): bump Node.js from 20 to v24.19.0 (LTS "Krypton")

.github/workflows/vendor/nodejs-audit.yml

@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
         with:
-          node-version: 20
+          node-version: 24
           cache: "yarn"
       - run: yarn install --frozen-lockfile
       - name: Run audit

.github/workflows/vendor/nodejs-check-code.yml

@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
         with:
-          node-version: 20
+          node-version: 24
           cache: "yarn"
       - run: yarn install --frozen-lockfile
       - name: Run check code

apps/admin-panel/package.json

@@ -3,7 +3,7 @@
   "version": "0.1.0",
   "private": true,
   "engines": {
-    "node": "20"
+    "node": "24"
   },
   "scripts": {
     "dev": "next dev -p 3004",

core/api/package.json

@@ -36,7 +36,7 @@
     "codegen:api-keys": "cd ./src/services/api-keys/proto && buf generate"
   },
   "engines": {
-    "node": "20"
+    "node": "24"
   },
   "dependencies": {
     "@apollo/server": "^4.12.2",

flake.nix

@@ -3,7 +3,8 @@
 
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
-    nixpkgs-node.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    # Pinned to a nixpkgs revision that packages nodejs 24.19.0 (Node 24 LTS "Krypton")
+    nixpkgs-node.url = "github:nixos/nixpkgs/06a1bc65f61c040137db4529ba74756c2d110da3";
     nixpkgs-docker.url = "github:nixos/nixpkgs/nixpkgs-unstable";
     nixpkgs-tilt.url = "github:nixos/nixpkgs/nixpkgs-unstable";
     # reindeer >= 2024.03.29 downloads crates from static.crates.io (CDN) instead of the
@@ -38,11 +39,15 @@
       dockerPkgs = import nixpkgs-docker {inherit system;};
       tiltPkgs = import nixpkgs-tilt {inherit system;};
       reindeerPkgs = import nixpkgs-reindeer {inherit system;};
-      # CVE: DoS via stack overflow in async_hooks - require nodejs 20.20.0+
-      expectedNodeVersion = "20.20.0";
+      # Node 24 LTS "Krypton" (24.19.0); includes the async_hooks stack overflow fix.
+      # Kept out of the pkgs overlay on purpose: the main nixpkgs' npm build
+      # plumbing (srcOnly in buildNpmPackage/importNpmLock hooks) cannot consume
+      # the newer structured-attrs nodejs derivation, so only the repo-facing
+      # toolchain (dev shell, buck2 builds, packaged bins) uses nodejs24.
+      expectedNodeVersion = "24.19.0";
+      nodejs24 = assert nodePkgs.nodejs_24.version == expectedNodeVersion; nodePkgs.nodejs_24;
       overlays = [
         (self: super: {
-          nodejs = assert nodePkgs.nodejs_20.version == expectedNodeVersion; nodePkgs.nodejs_20;
           pnpm = super.nodePackages.pnpm;
         })
         (import rust-overlay)
@@ -56,7 +61,7 @@
       buck2NativeBuildInputs = with pkgs; [
         buck2
         protobuf
-        nodejs
+        nodejs24
         pnpm
         python3
         ripgrep
@@ -69,7 +74,6 @@
       nativeBuildInputs = with pkgs;
         [
           envsubst
-          nodejs
           tiltPkgs.tilt
           typescript
           bats
@@ -158,7 +162,7 @@
             substituteInPlace "$out/bin/run" \
               --replace "#!${pkgs.coreutils}/bin/env sh" "#!${pkgs.bash}/bin/sh" \
               --replace "$(cat build/$name-$system/buck2-deps-path)" "$out/lib" \
-              --replace "exec node" "exec ${pkgs.nodejs}/bin/node"
+              --replace "exec node" "exec ${nodejs24}/bin/node"
           '';
         };
 
@@ -200,7 +204,7 @@
             substituteInPlace "$out/bin/run" \
               --replace "#!${pkgs.coreutils}/bin/env sh" "#!${pkgs.bash}/bin/sh" \
               --replace "\''${0%/*}/../lib/" "$out/lib/" \
-              --replace "exec node" "exec ${pkgs.nodejs}/bin/node"
+              --replace "exec node" "exec ${nodejs24}/bin/node"
           '';
         };
 
@@ -261,7 +265,7 @@
             npm_bin_source_file=$(cat "$out/bin/$npm_bin_name" | grep "exec" | awk '{print $2}')
             substituteInPlace "$npm_bin_source_file" \
               --replace "$(cat build/$name-$system/buck2-node-modules-path)" "$out/lib" \
-              --replace "exec node" "exec ${pkgs.nodejs}/bin/node" \
+              --replace "exec node" "exec ${nodejs24}/bin/node" \
               --replace " sed " " ${pkgs.gnused}/bin/sed " \
               --replace "dirname" "${pkgs.coreutils}/bin/dirname" \
               --replace "uname" "${pkgs.coreutils}/bin/uname"

package.json

@@ -8,7 +8,7 @@
     "whichnode": "which node"
   },
   "engines": {
-    "node": "20",
+    "node": "24",
     "pnpm": "8"
   },
   "resolutions": {

third-party/node/rover/package.json

@@ -5,7 +5,7 @@
     "@apollo/rover": "^0.21.0"
   },
   "engines": {
-    "node": "20",
+    "node": "24",
     "pnpm": ">=8 <9"
   },
   "packageManager": "pnpm@8.7.6"

third-party/node/turbo/package.json

@@ -5,7 +5,7 @@
     "turbo": "^1.10.3"
   },
   "engines": {
-    "node": "20",
+    "node": "24",
     "pnpm": ">=8 <9"
   },
   "packageManager": "pnpm@8.7.6"