[Zach Dunn (zachdunn)]

GitHub Actions was installing Node 24.18.0 from .nvmrc, which misses the October 2026 security release. The published CLI was also still resolving sharp 0.35.3.

What it does

• CI, Release, D1 migrations, the prod D1 backup, and both smoke workflows install Node 24.22.1 from one NODE_VERSION env per workflow. .nvmrc stays 24.18.0 until Workers Builds can install 24.22.1 (#1256). Zach Dunn (@zachdunn), switch those steps back to node-version-file: .nvmrc when that lands.
• @buildinternet/uploads requires sharp ^0.35.5. The lockfile no longer contains 0.35.3 or 0.35.4. A patch changeset publishes that floor.

What it is not

• Not a change to the Node version Workers Builds or local dev use. .nvmrc is untouched.
• Not a CLI behavior change.

Advisories

• Node.js October 2026 security releases (CVE-2026-111497, fixed in 24.22.1)
• GHSA-wq5f-xc86-pv6w
• GHSA-rgj7-g3m4-5g8c

Test plan

• pnpm check (oxlint and format; oxlint needed the CLI build and Astro content types, same as CI)
• pnpm changeset:lint
• pnpm --filter @buildinternet/uploads test — 89 files, 1621 tests passed
• pnpm why sharp reports only 0.35.5

  

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 2

• coderabbit:review
• review

🚫 Excluded labels (none allowed): 1

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9f5211b9-fd18-49e0-b506-048bd4393150

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[changeset-bot]

🦋 Changeset detected

Latest commit: f02b3a1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@buildinternet/uploads	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR