[ketanhwr]

Tools that read process.version as a real Node.js version flag v22.19.0 as vulnerable to CVE-2026-111497 (fixed in 22.23.4). For example, the Stripe SDK sends it to Stripe, which then emails Workers customers a security warning.

• Bumps the reported version to 22.23.4, the latest 22.x release. This applies to all Workers with no compat flag, the same way 22.18 → 22.19 was done.
• Adds nodejs_process_version_24, which reports 24.22.2. It's on by default from compatibility date 2026-11-24, and no_nodejs_process_version_24 turns it off. Libraries feature-sniff on the reported major version, so moving to 24 needs a flag.
• update_node_version.py now updates one constant per major. Pass --major N to update just one. It no longer jumps to a new major by itself

[clanky-the-clanker]

Superseded by the review of c1a35dd1.

This review, of 0f18d5dc

✅ Approved — Trivial one-line version constant update with no issues found.

_{The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.}

---

✅ All checks passed

📋 Code reviewer: ✅ LGTM

The change only updates the nodeVersion constant. Its single consumer is process.c++, and no tests or other code depend on the old value.

---

_{Reviewed commit: 0f18d5dc}

[clanky-the-clanker]

Superseded by the review of 1e1a86a4.

This review, of c1a35dd1

💬 Approved with comments — One-line version constant update that matches the title and commit message. The only note is that the description still refers to the 24.x line.

Findings: 1 info (1 is an inline comment on the diff)

_{The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.}

---

📋 Code reviewer: 💬 1 info

Constant change is fine; the description is stale relative to the code.

Recommendation: 💬 Optional Nits

• [INFO] The description says process.version moves to the 24 line (24.22.2), but the code and title set 22.23.4. Update the description to match. (src/workerd/api/node/node-version.h:17)

View full review

The constant is 22.23.4, matching the title and commit message. The description still describes a move to 24.x (24.22.2), so it should be updated.

---

_{Reviewed commit: c1a35dd1}

[clanky-the-clanker]

Superseded by the review of 4ffb267d.

This review, of 1e1a86a4

💬 Approved with comments — The version bump and the compat-flag selection are correct and tested. The only note is a stale code comment, and the pull request description now understates the change because it doesn't mention the Node 24 flag.

Findings: 1 suggestion (1 is an inline comment on the diff)

_{The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.}

---

📋 Code Quality: 💬 1 suggestion

The change is correct. The comment above the version selection still describes a single 'most current' version.

Recommendation: 💬 Optional Nits

• [SUGGESTION] Stale comment above the flag-based Node.js version selection (src/workerd/api/node/process.c++:125)

View full review

src/workerd/api/node/process.c++:122-126: the comment still says the reported value is "the most current Node.js version supported by the platform". The value is now picked between nodeVersion22 and nodeVersion24 by the nodejs_process_version_24 flag. The new line also sits under the sentence about the empty-string entries, which is about the other version fields.

The flag definition, the constants, the update script and the tests are fine.

---

✅ All other checks passed

🚀 Release: ✅ LGTM

Low risk. Existing Workers keep reporting a 22.x version until they opt in or move past the 2026-11-24 compatibility date.

---

🔒 Security: ✅ LGTM

No security concerns. The flag only picks between two hardcoded version strings, and the update script checks the GitHub tags it reads against a strict version regex.

---

📖 AGENTS.md: ✅ LGTM

No issues found.

---

⚡ Performance: ✅ LGTM

No issues found.

---

📝 Documentation: ✅ LGTM

No issues found.

---

_{Reviewed commit: 1e1a86a4}

[clanky-the-clanker]

Superseded by the review of 22400fed.

This review, of 4ffb267d

✅ Approved — The only earlier note, a stale comment, is fixed, and nothing new came up. The version bump and the flag-based selection are correct and tested.

_{The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.}

---

✅ All checks passed

🚀 Release: ✅ LGTM

Risk: Low. Existing Workers keep reporting a 22.x version until they opt in or move past the 2026-11-24 compatibility date.

---

🔒 Security: ✅ LGTM

No security concerns. The flag only picks between two hardcoded version strings.

---

📖 AGENTS.md: ✅ LGTM

No issues found.

---

📋 Code Quality: ✅ LGTM

No issues found. The comment above the version selection in process.c++ now describes the flag-based choice.

---

⚡ Performance: ✅ LGTM

No issues found.

---

📝 Documentation: ✅ LGTM

No issues found.

---

_{Reviewed commit: 4ffb267d}

[clanky-the-clanker]

✅ Approved — The only earlier note, a stale comment, is fixed, and nothing new came up. The version bump and the flag-based selection are correct and tested.

_{The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.}

---

✅ All checks passed

🚀 Release: ✅ LGTM

Risk: Low. Existing Workers keep reporting a 22.x version until they opt in or move past the 2026-11-24 compatibility date.

---

🔒 Security: ✅ LGTM

No security concerns. The flag only picks between two hardcoded version strings.

---

📖 AGENTS.md: ✅ LGTM

No issues found.

---

📋 Code Quality: ✅ LGTM

No issues found. The comment above the version selection in process.c++ now describes the flag-based choice.

---

⚡ Performance: ✅ LGTM

No issues found.

---

📝 Documentation: ✅ LGTM

No issues found.

---

_{Reviewed commit: 22400fed — same changes as 4ffb267d, so this is that commit's review (no new review was run; line numbers are as of 4ffb267d)}