Repository navigation
fix: use patched Node 22 for SDK builds - #1776
Merged
Merged
Conversation
MantisClone
requested review from
LeoSlrRf,
aimen74,
alexandre-abrioux-rf,
bassgeta and
rodrigopavezi
October 27, 2026 21:07
Contributor
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
Contributor
 [Medium impact] The two version changes appear safe to merge once the existing hosted checks pass. SummaryUpdates local development and CircleCI from Node 22.14 to Node 22.23.4.
Reviews (4) · Last reviewed commit: "fix: use patched Node 22 for SDK builds" · Reviewed by Greptile |
rodrigopavezi
approved these changes
Oct 27, 2026
LeoSlrRf
approved these changes
Oct 29, 2026
MantisClone
changed the title
MantisClone
force-pushed
the
fix/REQ-716-sdk-node-security
branch
from
October 30, 2026 00:41
be68513 to
9b8297c
Compare
MantisClone
changed the base branch from
graphite-base/1776
to
fix/REQ-716-sdk-ci-confirmation
October 30, 2026 00:41
MantisClone
changed the title
alexandre-abrioux-rf
approved these changes
Oct 30, 2026
Contributor
Author
Merge activity
|
MantisClone
changed the base branch from
fix/REQ-716-sdk-ci-confirmation
to
graphite-base/1776
October 30, 2026 21:14
MantisClone
added a commit
that referenced
this pull request
Oct 30, 2026
# Problem SDK checks exposed two separate problems: signature recovery can silently fall back to slow JavaScript, and request confirmation can be missed or overwritten by an older refresh. Some tests also compare requests before confirmation or rely on exact wall-clock timing. This is the non-security prerequisite for [#1776](#1776), found while validating [REQ-716](https://linear.app/requestnetwork/issue/REQ-716). # Proposed Solution - Resolve `node-gyp-build` to 4.8.4 throughout the workspace and check native `secp256k1` loading immediately after CI installation. - Retain creation confirmation/error results for late or repeated callers. Process refreshes in order, allowing retries after a failed read. - Cover those confirmation races, wait before comparing encrypted requests, and compare public request data. Check retry delays with fake timers. # Design Rationale The lockfile previously selected loader 4.8.4 for installation and 4.6.0 for runtime loading. In an isolated reproduction using the CI image, installation succeeded but runtime loading missed the packaged native binary and selected the JavaScript fallback. Aligning the loaders restores native loading; the CI check makes a recurrence visible. Retaining confirmation results handles late callers. Serializing refreshes prevents an older pending read from overwriting confirmed state. Longer timeouts would not fix either race. # Considerations The Node version update stays in #1776, stacked above this PR. Test timeouts, worker counts, retry behavior and Lit Protocol code are unchanged. The loader resolution applies to this workspace's installation; it does not force downstream consumers' dependency resolutions. # Validation - An isolated frozen-lockfile install resolves loader 4.8.4 without changing the lockfile. Lifecycle scripts were disabled for this dependency check; the native installer was tested separately in the CI image. - In `cimg/node:22.23.4`, installation and native loading pass with no compiled addon present. Before the fix, the equivalent loader mismatch selected the JavaScript fallback. - With packaged prebuilds forced on, the three affected Request Client suites pass 103 tests on Node 22.23.4. Two localhost-dependent cases are excluded; one case is already skipped. All five cases from the latest CI failure are included and pass. Retry passes 9 tests. - On the prerequisite's existing Node 22.14.0 version, 31 selected declarative/confirmation tests pass. - TypeScript, formatting and YAML parsing pass. Production-file ESLint has no errors and 27 existing warnings. Fresh hosted checks remain pending. # UAT After publishing the candidate SDK, create a permitted staging request. Wait for confirmation, call `waitForConfirmation()` again after it resolves, and confirm both calls return the confirmed request. Read the same request through a fresh client and confirm its ID, state and content match. Confirm the native-loading check and existing CircleCI suites pass.
fix: preserve request confirmation and stabilize retry tests
MantisClone
force-pushed
the
fix/REQ-716-sdk-node-security
branch
from
October 30, 2026 21:15
9b8297c to
c22cfdf
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The SDK still selects Node 22.14.0 locally and 22.14 in CircleCI, before the October security fixes. Tracked in REQ-716.
Proposed Solution
Use Node 22.23.4 in
.nvmrcand CircleCI. This PR changes only those two version selections.Design Rationale
The update stays within Node 22, which the SDK already supports through PR 1595. Native-loader, confirmation and test corrections are separated into prerequisite #1777.
Considerations
Merge #1777 first. The docker-images companion PR updates the gateway runtime separately; this PR alone does not patch a running gateway.
The planned normal release targets client SDK 0.66.0 and gateway 0.52.0. Installing the SDK does not upgrade a consuming application's Node runtime. Final package/image checks and staging request submission/readback remain required before production.
Validation
With the prerequisite fixes, the three affected Request Client suites pass 103 tests on Node 22.23.4 using packaged native binaries. Two localhost-dependent cases are excluded; one is already skipped. Retry passes 9 tests. Native installation/loading also passes in
cimg/node:22.23.4without a compiled addon. YAML parsing passes. Fresh hosted checks remain pending.UAT
Confirm the existing CircleCI build and test jobs pass on Node 22.23.4.