Cascade stage → main (prod audit 3 critical / 82 high → 0 / 1, Node 26, Playwright 1.63.0; #1080 #1082) by evereq · Pull Request #1084 · ever-works/directory-web-template

evereq · 2026-10-05T12:57:24Z

Promotes #1080 and #1082 (stage b0cac5f).

Stage E2E (Node 26, Playwright 1.63.0): all 4 shards plus the summary are green. The earlier run on 1.58.2 had hung at playwright install.
demostage.ever.works: Node v26.10.0. 64/64 sampled routes are identical to demodev, which in turn was identical to the old demostage on 44/44.
docs-demo-dev (Docusaurus 3.10.2): 50/50 sampled pages are identical to docs.demo.ever.works.
pnpm audit --prod: 0 critical / 1 high (braces, which has no patched release and is reached only by the docs build).

After merge: demo-prod + docs-demo-prod roll through Image Updater, then the 15 ever-works/*-website mains are fast-forwarded (non-force) and rolled in batches.

🤖 Generated with Claude Code

pnpm audit --prod on develop: 3 critical / 82 high. After: 0 critical / 1 high (braces <=3.0.3, no patched release exists; docs build tooling only). Direct bumps (latest): - @auth/drizzle-adapter, @auth/supabase-adapter 1.11.3: drops the second @auth/core 0.41.1 copy (GHSA-7rqj-j65f-68wh, GHSA-xmf8-cvqr-rfgj); next-auth 5.0.0-beta.32 already used 0.41.3 and stays (latest v5). - axios 1.20.0, nodemailer 10.0.14 (+ @types/nodemailer 8.0.2). - @trigger.dev/sdk 4.7.2 (core prototype pollution GHSA-p28v-f755-9qrg; also drops socket.io/engine.io server, old systeminformation, nanoid). - Docusaurus 3.10.2, cheerio 1.2.0. The ejected SiteMetadata is re-diffed: 3.10 removed keyboardFocusedClassName from theme-common/internal and renders a bare <body />; DocBreadcrumbs/Items/Home is unchanged upstream. EJECTED_THEME_CLASSIC is now '3.10'. Transitive packages refreshed inside their parents' existing ranges (tmp, brace-expansion, picomatch, linkify-it, nanoid, immutable, undici, ws, lodash, fast-uri, svgo, image-size, path-to-regexp, browserslist, joi, shell-quote, websocket-driver, http-cache-semantics, flatted, protobufjs, socket.io-parser, @babel/plugin-transform-modules-systemjs), plus three scoped pnpm.overrides where the parent pins a vulnerable version: lodash-es@<4.18.0 (chevrotain pin), serialize-javascript@<7.0.3 (copy-webpack-plugin 11, docs build only), ws@>=8.0.0 <8.21.0 (engine.io-client ~8.17.1). Node 26 everywhere: both Dockerfiles (node:26-alpine; Node 25+ no longer bundles corepack, so a pinned corepack 0.36.0 is installed first), every workflow node-version, engines >=26.0.0, @types/node ^26.6.4, and the documented floor. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…undles it) The documented Node floor is now 26, where a bare 'corepack enable' fails with 'command not found'. The Dockerfiles already install corepack 0.36.0 first; the contributor docs now say the same. README also names pnpm 10.x, which is what packageManager pins. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…t most Latest-versions rule blocker, recorded so the next bump retries it: Vercel's supported Node versions top out at 24.x (default) as of 2026-10-05, and this template documents Vercel as the easiest deploy (README, docs/deployment). An engines floor of >=26.0.0 would make every Vercel deployment of the template fail its install. Everything we run stays on 26: both Dockerfiles (node:26-alpine), every workflow node-version and @types/node ^26. >=24.0.0 still admits 26. Raise the floor to 26 once Vercel lists 26.x. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…select 26 Review follow-ups on #1080 (cubic, greptile, CodeRabbit): the localized docs under apps/docs/i18n still named the old 20.19.0 floor (128 places), and the English and French nvm examples still installed/selected Node 20. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(deps): clear critical/high prod advisories (3C/82H -> 0C/1H) and move to Node 26

Cascade develop → stage (prod audit 3 critical / 82 high → 0 / 1, Node 26, #1080)

The stage E2E for #1080 (run 37296680471) timed out on all 4 shards at `playwright install --with-deps chromium`: Chrome for Testing downloads to 100% and the step then hangs until the 1 h job limit. Reproduced locally on Node 26.10.0: - playwright 1.58.2: download completes, install never returns (killed at 300 s, 1 file on disk); - playwright 1.59.1: same hang (killed at 240 s); - playwright 1.63.0 (latest): install completes in 103 s (610 files). The previous stage E2E (48d96ab, Node 24) passed with 1.58.2, so this is the Node 26 move in #1080. `playwright test --list` loads the config on 1.63.0 (44,400 tests); audit unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(e2e): Playwright 1.63.0 — 1.58.2's browser install hangs on Node 26

Cascade develop → stage (Playwright 1.63.0 for Node 26, #1082)

coderabbitai · 2026-10-05T12:57:34Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: f3056215-7c3b-4b29-a367-11102ca73af6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

greptile-apps · 2026-10-05T13:01:48Z

Confidence Score: 4/5

[High risk] Updates Node.js runtime version across build and deployment.

The PR appears safe to merge, with a non-blocking correction needed in the Node.js support guidance.

Findings

Node.js minimum is misstated ▶

Summary

The PR refreshes key dependencies and moves project builds, CI, and Docker images to Node 26, while setting Node 24 as the minimum supported version. It also updates the docs site for Docusaurus 3.10.2 and revises the Node.js guidance across the project.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Node.js 24 minimum] --> B[Workspace install]
  C[Node.js 26] --> D[CI and image builds]
  B --> E[Web and docs dependencies]
  D --> E

_{Reviews (1) · Last reviewed commit: "Merge pull request #1083 from ever-works..."}

greptile-apps · 2026-10-05T13:01:51Z


- **Node.js Version**: Ensure you are using Node.js 20+
- **Package Manager**: Use pnpm (strictly enforced). Run `corepack enable` to activate it.
+- **Node.js Version**: Ensure you are using Node.js 26+


Node.js minimum is misstated

The support guide says Node.js 26 or newer is required, but package.json allows Node.js 24. The deployment guide says Vercel offers only Node.js 24. This could send contributors looking for a version their host does not offer. State 24 as the minimum and recommend 26 where available.

evereq and others added 10 commits October 5, 2026 10:04

docs(log): name PR #1080 in the 2026-10-05 dependency-security entry

9ccc8b4

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request #1080 from ever-works/fix/audit-prod-advisories

6281a7d

fix(deps): clear critical/high prod advisories (3C/82H -> 0C/1H) and move to Node 26

Merge pull request #1081 from ever-works/develop

3482517

Cascade develop → stage (prod audit 3 critical / 82 high → 0 / 1, Node 26, #1080)

Merge pull request #1082 from ever-works/fix/playwright-node26

07ee2e6

fix(e2e): Playwright 1.63.0 — 1.58.2's browser install hangs on Node 26

Merge pull request #1083 from ever-works/develop

b0cac5f

Cascade develop → stage (Playwright 1.63.0 for Node 26, #1082)

evereq merged commit 61cd18d into main Oct 5, 2026
12 checks passed

greptile-apps Bot reviewed Oct 5, 2026

View reviewed changes

Navigation Menu

Repository navigation

Cascade stage → main (prod audit 3 critical / 82 high → 0 / 1, Node 26, Playwright 1.63.0; #1080 #1082) - #1084

Cascade stage → main (prod audit 3 critical / 82 high → 0 / 1, Node 26, Playwright 1.63.0; #1080 #1082)#1084
evereq merged 10 commits into
mainfrom
stage

evereq commented Oct 5, 2026

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 5, 2026

Review skipped

Uh oh!

greptile-apps Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot Oct 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

evereq commented Oct 5, 2026

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 5, 2026

Review skipped

Uh oh!

greptile-apps Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 4/5

Findings

Summary

Uh oh!

greptile-apps Bot Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

greptile-apps Bot commented Oct 5, 2026 •

edited

Loading