security: update bundled Node v24.16.0 to v24.22.1 (October security release) #2780

Summary

Please update the bundled Node runtime to v24.22.1 or a newer patched Node 24 release and publish rebuilt platform bundles. Updating the host's Node installation does not update the runtime that CodeGraph actually uses.

As of October 22, 2026, the latest CodeGraph release is v1.6.2 (published October 3). Its official macOS ARM64 bundle still runs Node v24.16.0. The current build script also still defaults to that version.

Verified observations

• Installed npm package: @colbymchenry/codegraph@1.6.0, macOS ARM64.
• Host Node was updated to v24.22.1; the installed CodeGraph platform package's node --version still returns v24.16.0.
• Independently downloaded the latest v1.6.2 codegraph-darwin-arm64.tar.gz, verified it against both the GitHub asset digest and release SHA256SUMS, then extracted only its Node executable. That executable also returns v24.16.0 and is byte-identical to the one in the installed 1.6.0 package.

Verified v1.6.2 archive SHA-256:

d74d1bfb4060db63ec3c2b72c4e17f76c31978af3bad6ace4370d1501ac0662e

Bundled macOS ARM64 Node executable SHA-256:

1ee75375e33b94fc34b3b19aede049e11dae90efb63b374dc96d6bdace70c4b8

Reproduction with an installed npm package

node --version
# v24.22.1

CODEGRAPH_PACKAGE="$(npm root -g)/@colbymchenry/codegraph"
"$CODEGRAPH_PACKAGE/node_modules/@colbymchenry/codegraph-darwin-arm64/node" --version
# v24.16.0

The npm shim delegates to the platform bundle. The platform launcher ultimately executes its own "$DIR/node", so changing nvm's default, the host PATH, or the Node that launches the npm shim does not replace this runtime.

Relevant current source at commit 929c65c83a681b4db3f705c3ad9cda03e755527c:

• Default NODE_VERSION in build-bundle.sh: NODE_VERSION="${2:-v24.16.0}".
• Release workflow invokes the script without a Node-version override.

Why v24.22.1

Node v24.22.1, released October 21, 2026, is a security release containing fixes in TLS, DNS, Brotli, HTTP, crypto, and the permission model. This report concerns shipping the patched runtime; it does not establish that every listed CVE is reachable through CodeGraph's MCP or CLI interfaces.

Related existing work:

• Windows: bundled Node v24.16.0 can abort at exit (nodejs/node#56645); please bundle Node >= 24.20.0 #2617 tracks the Windows shutdown crash in the bundled v24.16.0 runtime.
• fix(bundle): ship Node v24.21.0 so Windows no longer aborts at exit (#2617) #2619 is open and proposes v24.21.0. That target predates the October 21 security release, so please consider updating the target to at least v24.22.1 before merging and publishing.
• Update default NODE_VERSION to v24.19.0 #1584 is an older open proposal to update the default to v24.19.0.

Requested change

1. Bump the default bundled runtime to at least v24.22.1 and rebuild/release the supported platform bundles.
2. Verify the bundled executable's version in release validation, rather than only the Node version running CI or the npm shim.
3. Document the bundled Node version in release notes so users can check security patch coverage independently of their host Node installation.

No CodeGraph package files or vendor binaries were modified during this verification.