BLOCKED — nightly 2026-08-25: .nvmrc 20 -> 24 and @anthropic-ai/sdk bump (needs the workflow patch in the same PR) - #25
Open
jaydubya818 wants to merge 2 commits into
Open
Conversation
The pin was not deliberate. `git log -L` on that line in web/package.json shows exactly one commit — 603fb2b, the original "Agentic Engineering Knowledge Base v1.0" scaffold — so `^0.32.1` is the value the project was created with and has never been revisited. Latest is 0.120.0, roughly 88 minors ahead. The call sites are the most stable surface the SDK has: four `new Anthropic({ apiKey })` constructions and six `messages.create` / `messages.stream` calls passing only `model`, `max_tokens` and `messages`, consuming `content_block_delta` / `text_delta` (wire-protocol shapes defined by the API, not the SDK) plus one `finalMessage()`. No `client.beta`, no `betas`, no tools, and no memory tool — so GHSA-5474-4w2j-mq4c never applied either. query/route.ts:207 already carries a comment working around the pin's age. This also shrinks the supply-chain surface, which matters given the .npmrc `ignore-scripts` guard: the lockfile loses 21 transitive packages — the whole node-fetch / form-data / whatwg-url / abort-controller polyfill stack the modern SDK dropped for native fetch, including the deprecated node-domexception — and gains 4 (standardwebhooks, fast-sha256, json-schema-to-ts, ts-algebra). Net 84 insertions against 233 deletions. Verified: `npx tsc --noEmit` clean, `npm run build` clean, `npm audit` reports 0 vulnerabilities. Tier B, so this is on a branch rather than main. Residual risk stated plainly: there is no runtime verification of the streaming path, because web/ has no test suite. Hand-drive /api/query once against a real key before merging.
Node 20 went end-of-life on 2026-04-30 and will never receive another security patch. This has been Open in docs/NIGHTLY-BACKLOG.md since 2026-08-20, blocked each night on the same thing: the version is pinned in two places and the other one is .github/workflows/test.yml, which the nightly runner's token has no `workflow` scope to touch. This is the half that can be committed. It is deliberately NOT on main — on its own it desyncs CI from local, which is exactly the failure the backlog entry warns about. The matching one-line workflow change (`node-version: 20` -> `24` at .github/workflows/test.yml:18) is supplied as a diff in the 2026-08-25 nightly report and verified with `git apply --check`. Apply it and merge this branch in the same PR. Target is 24, correcting the backlog's earlier note that "Node 22 is the active LTS; the suite passes on Node 22 today (it is what the nightly runs on)". Both halves of that were stale. As of 2026-08, 22 is Maintenance LTS (to 2027-04) and 24 is Active LTS (to 2028-04). And the nightly host has node v24.18.1 on PATH, so `.nvmrc: 20` has been describing a runtime nobody actually uses. 24 is also the only option that could be verified here: the root suite (536/536), `npx tsc --noEmit` and `next build` were all run on v24.18.1 this run. Node 22 could not be checked — the local node@22 install is broken (`Library not loaded: libsimdjson.30.dylib`) — so a 22 target would have been an unverified guess. If 22 is preferred for conservatism that is defensible, but it needs a working 22 to verify against first.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Recommended merge order: 8 of 9 — and do not merge the
.nvmrchalf aloneAge: 7 nights (2026-08-25). Commits: 2. Files:
.nvmrc,web/package.json,web/package-lock.json.Why this is blocked rather than merely last
5219aa4dmoves.nvmrcfrom EOL Node 20 to 24..github/workflows/test.ymlstill setsnode-version: 20. Merging this alone desyncs CI from local, which is precisely the failure the backlog entry warns about. The workflow half is a one-line change that the nightly runner cannot make — its token has noworkflowscope.Action for Jay: apply the one-line workflow change (
node-version: 20→24in.github/workflows/test.yml) in this same PR, then merge. Merging without it is worse than not merging.The second commit,
b90a2a0e(@anthropic-ai/sdk0.32.1 → 0.120.0 inweb/), is independent of that blocker but shares the branch. If you want the SDK bump sooner, cherry-pick it.Sequencing
This touches
web/package-lock.json, as doesnightly/2026-08-26-improvements. Merge 08-26 first (critical RCE). Tested this run: after merging 08-26,nextresolves to 16.3.3 and this branch still merges cleanly on top — the lockfile conflict the backlog has warned about for six nights does not reproduce today.Verification
Rebased onto current
main: 602 pass / 0 fail — unchanged frommain, because the root suite exercises neither.nvmrcnorweb/dependencies. Neither commit on this branch is covered by any test in this repo. The@anthropic-ai/sdk0.32.1 → 0.120.0 jump is 88 minor versions andweb/has no test suite; it wants awebbuild plus a manual exercise of the routes that call the SDK.Risk if this is wrong
Two independent risks. (a)
.nvmrcwithout the workflow change: CI and local run different majors and stop agreeing — the desync is the risk, not either version. (b) The SDK jump is large enough to carry breaking API changes; if it broke something,web/routes calling Anthropic fail at runtime, unverified by any gate here.Standing facts, measured on this run (2026-09-01)
All eight pre-existing nightly branches were re-measured against
mainat commitf42213ee:git merge-tree --write-tree main <branch>reports zero conflicts for all eight. (The brief described all eight asdiverged; that is a GitHub compare status meaning "both refs have unique commits", not a conflict prediction.)git log --cherry-pick --right-only main...<branch>returns a non-empty commit list for every one of the eight, so no branch is closable without merging on supersession grounds.mainand the full root suite run. All green (counts per-PR below). Root suite only —web/has no test suite, so branches touchingweb/are unverified on their actual subject matter.Opened by the nightly maintenance run. Not auto-merged and not self-approved.