Update Node.js to v24

.github/renovate.json5

@@ -36,16 +36,37 @@
       ]
     },
 
-    // Pin @types/node to the deployed Node runtime major (22.x, see Dockerfile
-    // and .nvmrc). Bumping the typings ahead of the runtime lets the compiler
-    // accept Node-24-only APIs that won't exist in production. Bump
+    // CI installs Node from .nvmrc while production runs the Dockerfile base
+    // image, so any update that moves one without the other leaves CI testing
+    // a runtime production doesn't run. Group ALL Node updates (base image +
+    // .nvmrc) into a single, manually reviewed PR: enabled overrides
+    // docker:disableMajor for majors, and automerge overrides the blanket
+    // docker automerge rule above so a base-image bump can't ship on its own.
+    {
+      description: 'Group Node.js updates (Dockerfile base image + .nvmrc)',
+      groupName: 'Node.js',
+      groupSlug: 'node',
+      matchDepNames: [
+        'node',
+      ],
+      matchDatasources: [
+        'docker',
+        'node-version',
+      ],
+      enabled: true,
+      automerge: false,
+    },
+
+    // Pin @types/node to the deployed Node runtime major (see Dockerfile and
+    // .nvmrc). Bumping the typings ahead of the runtime lets the compiler
+    // accept newer-Node APIs that don't exist in the production runtime. Bump
     // allowedVersions in lockstep when the Node base image is upgraded.
     {
       description: 'Pin @types/node to the deployed Node runtime major',
       matchPackageNames: [
         '@types/node',
       ],
-      allowedVersions: '<23',
+      allowedVersions: '<25',
     },
   ],
 }

.github/workflows/build.yml

@@ -53,7 +53,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
-          node-version: lts/*
+          node-version-file: .nvmrc
           cache: pnpm
 
       - name: Check pnpm-lock.yaml

.nix/flakes/nodejs/flake.nix

@@ -21,9 +21,10 @@
         });
     };
 
-    # This gives us a central place to set the node version
+    # This gives us a central place to set the node version. Keep the major in
+    # sync with .nvmrc and the Dockerfile base image.
     node_overlay = final: prev: {
-        nodejs = prev.nodejs;
+        nodejs = prev.nodejs_24;
     };
 
     eachSystem = f:

.nvmrc

@@ -1 +1 @@
-22.23.1
+24.18.0

Dockerfile

@@ -1,6 +1,5 @@
-FROM node:22.23.1-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2
+FROM node:24.18.0-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd
 
-RUN apk add python3 g++ make
 RUN apk add --no-cache ca-certificates
 
 WORKDIR /opt/activitypub
@@ -20,8 +19,6 @@ COPY vitest.config.ts vitest.config.ts
 ENV NODE_ENV=production
 RUN pnpm build
 
-RUN apk del python3 g++ make
-
 EXPOSE 8080
 
 CMD ["node", "dist/app.js"]

package.json

@@ -6,6 +6,9 @@
   "license": "MIT",
   "main": "src/app.ts",
   "type": "module",
+  "engines": {
+    "node": "24"
+  },
   "packageManager": "pnpm@11.15.0",
   "scripts": {
     "build": "esbuild src/app.ts --sourcemap --platform=neutral --bundle --packages=external --outfile=dist/app.js",
@@ -50,7 +53,7 @@
     "@fedify/cli": "2.3.2",
     "@types/html-to-text": "9.0.4",
     "@types/jsonwebtoken": "9.0.10",
-    "@types/node": "22.20.1",
+    "@types/node": "24.13.3",
     "@types/node-jose": "1.1.13",
     "@types/sanitize-html": "2.16.1",
     "@types/sinon": "22.0.0",