s1d3sw1ped/helix-proxy

Fork 0

build: Move Node toolchain to 26 LTS #28

Merged

linus merged 1 commit from ash/node-26-27 into develop

2026-11-03 20:05:38 +00:00

ash commented

2026-11-03 19:54:23 +00:00

Collaborator

Closes #27

Why

Node 26 has been Active LTS since 2026-10-28 and Node 24 went to Maintenance LTS on 2026-10-20. Justin approved the move on 2026-11-03. Standard: forge-standards/forge-toolchain.md (Node row).

What changed

.forgejo/workflows/ci.yaml (both jobs) and release.yaml: node-version: "26". setup-node stays on @v4.
.nvmrc: 26, so scripts/check-toolchain.sh now requires Node 26.
Dockerfile: UI builder is node:26-alpine.
README.md: the preflight paragraph says 26 and nvm install 26 && nvm use 26.

ui/package.json has no engines field, so there is nothing to change there. npm install on Node 26.13.0 (npm 11.20.0) left ui/package-lock.json unchanged, so no lockfile is committed. No other dependency moved.

Proof (jumpbox, Node v26.13.0 / npm 11.20.0, go1.27.2, GNU Make 4.4.1)

make check-toolchain: rc=0.
make ui-build and make build: rc=0, UI written to ui/dist, binary built.
make test-both: rc=0, 233 passing tests (go test -count=1 ./...), plain and race.
With no Node on PATH the preflight stops: found: none, required: 26, fix: nvm install 26 && nvm use 26.
git status stayed clean apart from the five edited files.

CI run on this head is linked in a comment once it's green.

Not proven here

The jumpbox has no docker, so the node:26-alpine image build and the compose smoke (AC 6) need a run on Dockge by Jerry against this head.

Risks / rollback

Toolchain-only change. Revert the commit to go back to Node 24.

Closes #27 ## Why Node 26 has been Active LTS since 2026-10-28 and Node 24 went to Maintenance LTS on 2026-10-20. Justin approved the move on 2026-11-03. Standard: forge-standards/forge-toolchain.md (Node row). ## What changed - `.forgejo/workflows/ci.yaml` (both jobs) and `release.yaml`: `node-version: "26"`. setup-node stays on @v4. - `.nvmrc`: 26, so `scripts/check-toolchain.sh` now requires Node 26. - `Dockerfile`: UI builder is `node:26-alpine`. - `README.md`: the preflight paragraph says 26 and `nvm install 26 && nvm use 26`. `ui/package.json` has no `engines` field, so there is nothing to change there. `npm install` on Node 26.13.0 (npm 11.20.0) left `ui/package-lock.json` unchanged, so no lockfile is committed. No other dependency moved. ## Proof (jumpbox, Node v26.13.0 / npm 11.20.0, go1.27.2, GNU Make 4.4.1) - `make check-toolchain`: rc=0. - `make ui-build` and `make build`: rc=0, UI written to `ui/dist`, binary built. - `make test-both`: rc=0, 233 passing tests (`go test -count=1 ./...`), plain and race. - With no Node on PATH the preflight stops: `found: none, required: 26, fix: nvm install 26 && nvm use 26`. - `git status` stayed clean apart from the five edited files. CI run on this head is linked in a comment once it's green. ## Not proven here The jumpbox has no docker, so the `node:26-alpine` image build and the compose smoke (AC 6) need a run on Dockge by Jerry against this head. ## Risks / rollback Toolchain-only change. Revert the commit to go back to Node 24.

ash added 1 commit

2026-11-03 19:54:23 +00:00

build: Move Node toolchain to 26 LTS

Format / gofmt (pull_request) Successful in 45s

Details

CI / Build (pull_request) Successful in 1m49s

Details

CI / Build (push) Successful in 1m37s

Details

CI / Go Tests (pull_request) Successful in 2m33s

Details

Format / gofmt (push) Successful in 51s

Details

CI / Go Tests (push) Successful in 3m5s

Details

24265445b6

Node 26 is Active LTS and Node 24 is in Maintenance. Pin CI, release, .nvmrc and the Docker UI builder to 26. The lockfile is unchanged on Node 26.

Closes #27

ash requested reviews from eva, blake

2026-11-03 19:54:23 +00:00

eva approved these changes

2026-11-03 19:56:32 +00:00

eva left a comment

GO from me on 2426544. The diff is exactly the Node pins from #27: both setup-node steps in ci.yaml, release.yaml, .nvmrc, the node:26-alpine UI builder and the README preflight line. setup-node stays on @v4, nothing else moved, and the head sits right on the develop tip. Your jumpbox proof covers the preflight, build and tests on Node 26.13.0.

Before Linus merges, three things still need to land:

CI on this head goes green (runs are still pending as I write this).
Blake's review, since this touches the CI and release workflows.
Jerry builds the image with node:26-alpine and runs the compose smoke on Dockge against this head (AC 6). The jumpbox has no docker, so that one can't be waived. I'll note the pass here when he reports it.

GO from me on 2426544. The diff is exactly the Node pins from #27: both setup-node steps in ci.yaml, release.yaml, `.nvmrc`, the `node:26-alpine` UI builder and the README preflight line. setup-node stays on @v4, nothing else moved, and the head sits right on the develop tip. Your jumpbox proof covers the preflight, build and tests on Node 26.13.0. Before Linus merges, three things still need to land: - CI on this head goes green (runs are still pending as I write this). - Blake's review, since this touches the CI and release workflows. - Jerry builds the image with `node:26-alpine` and runs the compose smoke on Dockge against this head (AC 6). The jumpbox has no docker, so that one can't be waived. I'll note the pass here when he reports it.

blake approved these changes

2026-11-03 19:57:35 +00:00

blake left a comment

GO (Blake, security) on head 24265445b6 (base develop f14eda7a62).

Diff is only the Node 24 -> 26 pin in 5 files:

ci.yaml (2 setup-node steps) and release.yaml (1): only node-version changed. Actions stay on actions/setup-node@v4 (no @main), no permissions/secrets/token-scope changes, no new run: lines and no untrusted input (branch names, PR titles) interpolated.
Dockerfile: only the ui-builder stage moves to node:26-alpine; the runtime stage and its user are untouched, no curl|sh.
.nvmrc and README updated to match. No lockfile or dependency changes.

CI at review time: still pending (CI / Go Tests, push). Linus still needs green CI on this head and Jerry's compose smoke before merging.

GO (Blake, security) on head 24265445b6 (base develop f14eda7a62). Diff is only the Node 24 -> 26 pin in 5 files: - ci.yaml (2 setup-node steps) and release.yaml (1): only `node-version` changed. Actions stay on `actions/setup-node@v4` (no @main), no permissions/secrets/token-scope changes, no new `run:` lines and no untrusted input (branch names, PR titles) interpolated. - Dockerfile: only the `ui-builder` stage moves to `node:26-alpine`; the runtime stage and its user are untouched, no curl|sh. - `.nvmrc` and README updated to match. No lockfile or dependency changes. CI at review time: still pending (CI / Go Tests, push). Linus still needs green CI on this head and Jerry's compose smoke before merging.

ash commented

2026-11-03 19:57:55 +00:00

Author

Collaborator

CI is green on 2426544 with Node 26: CI run 133 (Go Tests and Build) and Format run 134. The node:26-alpine image build and compose smoke still need Jerry on Dockge against this head.

CI is green on 2426544 with Node 26: [CI run 133](https://git.s1d3sw1ped.com/s1d3sw1ped/helix-proxy/actions/runs/133) (Go Tests and Build) and [Format run 134](https://git.s1d3sw1ped.com/s1d3sw1ped/helix-proxy/actions/runs/134). The node:26-alpine image build and compose smoke still need Jerry on Dockge against this head.