[KMKoushik]

Node.js shipped a security release on 11 Nov 2026 (advisory). Railway builds this app with Nixpacks, which takes nodejs_22 from a pinned nixpkgs snapshot. That snapshot is a year behind on Node security fixes. Same fix as usesend/useSend#501.

What changed

• docker/nixpacks/install-node.sh downloads the official Node 22.23.5 from nodejs.org, checks it against a pinned SHA-256 (x64 and arm64, checked against the release's SHASUMS256.txt), and links node/npm/npx into /usr/bin.
• nixpacks.toml no longer takes Node or pnpm from Nix (nixPkgs = ["openssl"]). Nix's pnpm-8_x pulls in its own Node, so pnpm 8.9.2 now comes only from corepack (packageManager) on the new Node. A new node phase runs the script before install. It only copies the script, so code changes don't redownload Node.
• The install command is the same as before (corepack@0.24.1) except that corepack and its shims are linked into /usr/bin. Build (pnpm run build), start (pnpm run start), cache dirs, nixLibs and the nixpkgs archive are unchanged in nixpacks plan.

Exposure
The app serves plain HTTP/1.1 behind Railway's proxy, so most of this batch (HTTP/2, HTTPS and TLS-server bugs) doesn't reach it. It still picks up a year of missed Node fixes.

Verification (a local nixpacks build --platform linux/amd64, matching production)

• The checksum matches. node -v gives v22.23.5 at build time and in the running image (bash -l, the same entrypoint Railway uses). No Nix Node or pnpm is left in the image.
• pnpm -v gives 8.9.2 from corepack. pnpm i --frozen-lockfile and pnpm build pass. The Prisma client loads.
• I ran the real start command against a throwaway Postgres 16 with dummy env. All 18 migrations applied, Next started, /api/healthz returned 200 and the landing page rendered.

Self-host Docker images (docker/Dockerfile) aren't built with Nixpacks and are out of scope here.

Summary by CodeRabbit

• Improvements
  • Builds and runs now use Node.js 22.23.5 on supported Linux x64 and ARM64 systems.
  • Node.js downloads are verified before installation, and failed downloads are retried.
  • Dependency installation now uses the frozen lockfile, keeping installed packages aligned with the project’s lockfile.
  • Builds on unsupported architectures stop with an error.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The build adds an installer for Node.js 22.23.5 and configures Nixpacks to use it. The install phase enables Corepack and runs pnpm with a frozen lockfile.

Changes: Node.js Build Setup

Layer / File(s)	Summary
Install pinned Node.js docker/nixpacks/install-node.sh	The script selects a Node.js archive and SHA-256 hash for supported architectures. It retries downloads, verifies the archive, installs Node.js under /app/.node, and links node, npm, and npx into /usr/bin.
Configure Nixpacks phases nixpacks.toml	Nixpacks setup provides OpenSSL. The Node phase runs the installer. The install phase installs and enables Corepack, then runs pnpm i --frozen-lockfile. Comments describe the configured sources and Node.js update instructions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: Minimal · up to 94e92

The change pins Node 22.23.5 for Railway Nixpacks builds with checksum verification. No merge-blocking risk was found in the supplied evidence.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: running the Railway build on Node 22.23.5.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 29dd4a59-3239-4da8-9180-e27be942b208

Commits

Reviewing files that changed from the base of the PR and between 95c791d and 94e9289.

Files selected for processing: 2

• docker/nixpacks/install-node.sh
• nixpacks.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.