Skip to content

fix(vscode): bump Node.js fallback to 24.22.2 - #9685

Merged
Brian Lam (lambrianmsft) merged 2 commits into
Azure:mainfrom
bureado:copilot/bump-node-fallback-24-22-2
Nov 5, 2026
Merged

Brian Lam (lambrianmsft) merged 2 commits into
Azure:mainfrom
bureado:copilot/bump-node-fallback-24-22-2

Conversation

@bureado

@bureado José Miguel Parrella (bureado) commented Nov 4, 2026 •

Copy link
Copy Markdown
Member

Please consider updating the Node.js acquisition logic in the VS Code extension or any related bundles/manifests so that the default 24.x installation is >24.22.1, per October's Node.js security releases. In a default x64 VS Code Windows install on 04NOV, without any specific project settings/configurations, I'm getting the older 24.15.0 release.

Commit Type

  • feature - New functionality
  • fix - Bug fix
  • refactor - Code restructuring without behavior change
  • perf - Performance improvement
  • docs - Documentation update
  • test - Test-related changes
  • chore - Maintenance/tooling

Risk Level

  • Low - Minor changes, limited scope
  • Medium - Moderate changes, some user impact
  • High - Major changes, significant user/system impact

What & Why

Update DependencyVersion.nodeJs in apps/vs-code-designer/src/constants.ts from 24.15.0 to 24.22.2.

Verified on November 4, 2026 against the official Node.js release index: 24.22.2 is the latest published Node.js 24.x release. It exceeds the 24.22.1 security floor and includes the applicable fixes from the October 2026 security release, including CVE-2026-111497.

Impact of Change

  • Users: Updates fallback installations only. Existing user-installed Node.js is not upgraded or replaced.
  • Developers: Normal version discovery is unchanged.
  • System: Only the fallback constant changes; other dependency versions remain unchanged.

Test Plan

  • Unit tests added/updated
  • E2E tests added/updated
  • Manual testing completed
  • Tested in: Linux; focused static validation of the one-line constant change.

Biome check passed; TypeScript syntax check and git diff --check passed. Verified against upstream main that only the requested fallback value changed. Unit and E2E suites were not run because no logic changed.

Contributors

José Miguel Parrella (@bureado), Copilot

Screenshots/Videos

Not applicable; no visual changes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings November 4, 2026 21:44
@github-actions

github-actions Bot commented Nov 4, 2026 •

Copy link
Copy Markdown
Contributor

🤖 AI PR Validation Report

PR Review Results

Thank you for your submission! Here's detailed feedback on your PR title and body compliance:

✅ PR Title

  • Current: fix(vscode): bump Node.js fallback to 24.22.2
  • Issue: None — uses a valid fix: prefix with a scope and is descriptive.
  • Recommendation: No change needed.

✅ Commit Type

  • fix - Bug fix is selected (exactly one).
  • This matches the title prefix and the nature of the change (bumping a fallback dependency version).

✅ Risk Level

  • Exactly one box selected (Medium), and the risk:medium label matches the body selection. This also matches the advised estimate: changing the fallback nodeJs version in apps/vs-code-designer affects extension distribution and the runtime Node.js installed for users, which fits Medium. Correctly declared.

✅ What & Why

  • Current: Explains the constant change from 24.15.0 to 24.22.2, with verification against the Node.js release index and the October 2026 security release/CVE rationale.
  • Issue: None.
  • Recommendation: No change needed — clear and well-justified.

✅ Impact of Change

  • All three audiences (Users, Developers, System) are addressed.
  • Recommendation:
    • Users: Correctly notes only fallback installs are affected; existing user Node.js is untouched.
    • Developers: Correctly notes version discovery is unchanged.
    • System: Correctly notes only the fallback constant changes.

✅ Test Plan

  • Only Manual testing is checked, but there is a clear and adequate explanation: this is a one-line constant change with no logic change, validated via Biome, TypeScript syntax check, and git diff --check. Automated unit/E2E tests are reasonably not applicable here, satisfying CHECK TESTS.

✅ Contributors


✅ Screenshots/Videos

  • Not a visual change (edit to constants.ts), so screenshots are not required. Correctly marked not applicable.

Summary Table

Section Status Recommendation
Title ✅ No change needed
Commit Type ✅ No change needed
Risk Level ✅ Medium correctly declared and matches label
What & Why ✅ No change needed
Impact of Change ✅ No change needed
Test Plan ✅ Explanation for no automated tests is adequate
Contributors ✅ No change needed
Screenshots/Videos ✅ Not applicable

✅ All checks pass — this PR title and body are compliant and ready to merge.


Powered by: Copilot CLI (claude-opus-4.8) | Last updated: Thu, 05 Nov 2026 19:40:10 GMT

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues are recorded for the fallback Node.js version update.

No open issues 🎉

What changed in this PR

Updates the VS Code extension’s fallback Node.js version from 24.15.0 to 24.22.2 to address the requested security-version baseline.

Changes:

  • Changes only DependencyVersion.nodeJs; other dependency versions and version-discovery logic remain unchanged.
File Description
apps/​vs-code-designer/​src/​constants.ts Bumps the fallback Node.js version to 24.22.2.

Review effort: Balanced

@lambrianmsft
Brian Lam (lambrianmsft) enabled auto-merge (squash) November 5, 2026 19:00
@lambrianmsft Brian Lam (lambrianmsft) added risk:medium Medium risk change with potential impact and removed needs-pr-update labels Nov 5, 2026
@lambrianmsft
Brian Lam (lambrianmsft) merged commit 82639b8 into Azure:main Nov 5, 2026
61 of 65 checks passed
Brian Lam (lambrianmsft) added a commit that referenced this pull request Nov 5, 2026
Backport the fallback-only update from #9685 to hotfix/v5.1013.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pr-validated risk:medium Medium risk change with potential impact

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants