[tbonelee]

What is this PR for?

Follow up on #5587 by updating the remaining Node.js toolchains to patched releases. The October 2026 Node.js security release addresses the Brotli decoder vulnerability CVE-2026-111497.

• Upgrade Classic UI builds from Node.js 16.20.2 to 22.23.4, aligning Maven, nvm, and package engine metadata.
• Upgrade Helium bundle generation from Node.js 16.16.0 to 22.23.4.
• Restrict the Angular/React frontend engine range to patched release lines: ^22.23.4 || ^24.22.1 || >=26.12.1.

The existing Classic npm 8.19.4 and Helium npm 8.11.0/Yarn 1.22.0 versions are retained. Application code and dependency resolutions are unchanged apart from the Node.js version selection and engine metadata.

Classic uses Node.js during development and builds; Helium also invokes Node.js on the server to install packages and generate bundles. This updates those toolchains without claiming a confirmed remotely exploitable Zeppelin attack path.

What type of PR is it?

Bug Fix

Todos

• Validate Classic UI builds and tests on Node.js 22.23.4
• Validate Helium installation, bundle generation, rendering, and cache reuse
• Validate integration with the [MINOR] Refresh frontend Node.js and audit dependencies #5587 frontend toolchain
• Confirm GitHub Actions results

What is the Jira issue?

N/A

How should this be tested?

Frontend:

• Clean installation with Node.js 22.23.4 and npm 11.21.1.
• React tests: 262 passed.
• React typecheck and React/Angular production builds passed.
• Existing braces security patch applied successfully.

Classic UI:

• Production build and 194 browser unit tests passed.
• Browser checks covered notebook editing, execution, table/chart rendering, search/replace, and interpreter permission settings.
• The development server connected to the backend successfully.

Helium:

• Five Helium tests passed, and the server reactor build passed with JDK 11.
• Installed and enabled the horizontalbar example, generated its bundle with Node.js 22.23.4, and verified the SVG chart and values in a notebook.
• On Linux x86-64, verified automatic replacement of an existing Node.js 16.16.0 installation, bundle loading, forced rebuild, and reuse after server restart.
• The Markdown Spell example installed, bundled, and rendered, but result persistence encountered an existing Java ClassCastException. Equivalent bundles built with Node.js 16.20.2 and 22.23.4 were byte-identical.

The browser checks also identified an existing Monaco icon font loading error, reproduced with a Node.js 22.21.1 comparison build. These existing issues are outside this change.

The retained Node.js changes are identical to the previously validated versions. After integration with #5587, installation, React tests, typecheck, and frontend builds were repeated. The source tree was unchanged by rebasing onto the merged #5587 commit. The full E2E suite, Storybook build, and final WAR/container packaging were not rerun.

Screenshots (if appropriate)

N/A

Questions:

• Does the license files need to update? No.
• Is there breaking changes for older versions? Builds require a patched Node.js release. Maven downloads Node.js 22.23.4 for Classic UI builds, and Helium installs that version for bundle generation.
• Does this needs documentation? Yes; the Classic UI Local Development instructions now point to the Node.js version pinned in .nvmrc.

[voidmatcha]

The Classic UI’s .nvmrc and Maven configuration have been updated to Node.js 22.23.4, but the Local Development section in zeppelin-web/README.md still recommends Node.js v16. Could you update the documentation to match the new version or direct developers to use .nvmrc?

I found no other merge-blocking issues. I also verified that the Classic build and tests, along with the Helium tests on JDK 11 and 17, passed.

[tbonelee]

Thanks! I've updated it.

[voidmatcha]

Merged into master (65c12bf).