chore: upgrade Node.js to 22.22.0 (CVE-2025-59466)

.circleci/config.yml

@@ -5,7 +5,7 @@ jobs:
   build-app:
     executor:
       name: common/node
-      tag: "22.16"
+      tag: "22.22"
     steps:
       - common/setup-node
       - run:
@@ -23,7 +23,7 @@ jobs:
   test:
     resource_class: large
     docker:
-      - image: cimg/node:22.16
+      - image: cimg/node:22.22
       - image: postgres:18-alpine
         environment:
           POSTGRES_DB: api_test

.infra/.nvmrc

@@ -1 +1 @@
-22.16
+22.22

.infra/package.json

@@ -14,6 +14,6 @@
   },
   "packageManager": "pnpm@9.14.4+sha256.26a726b633b629a3fabda006f696ae4260954a3632c8054112d7ae89779e5f9a",
   "volta": {
-    "node": "22.16.0"
+    "node": "22.22.0"
   }
 }

.nvmrc

@@ -1 +1 @@
-22.16
+22.22

AGENTS.md

@@ -4,7 +4,7 @@ This file provides guidance to coding agents when working with code in this repo
 
 ## Prerequisites
 
-- **Node.js**: 22.16.0 (managed via Volta)
+- **Node.js**: 22.22.0 (managed via Volta)
 - **Package Manager**: pnpm 9.14.4
 
 ## Essential Commands
@@ -25,7 +25,7 @@ This file provides guidance to coding agents when working with code in this repo
 **Migration Generation:**
 When adding or modifying entity columns, **always generate a migration** using:
 ```bash
-# IMPORTANT: Run nvm use from within daily-api directory (uses .nvmrc with node 22.16)
+# IMPORTANT: Run nvm use from within daily-api directory (uses .nvmrc with node 22.22)
 cd /path/to/daily-api
 nvm use
 pnpm run db:migrate:make src/migration/DescriptiveMigrationName
@@ -161,3 +161,17 @@ Hooks are configured in `.claude/settings.json`:
 - **File Protection** (PreToolUse): Blocks edits to `pnpm-lock.yaml`, `src/migration/`, `.infra/Pulumi.*`, `.env`, `.git/`
 - **Prevent Force Push** (PreToolUse): Blocks `git push --force` and `git push -f`
 - **Auto-Lint** (PostToolUse): Runs `eslint --fix` on TypeScript files after edits
+
+## Node.js Version Upgrade Checklist
+
+When upgrading Node.js version, update these files:
+- `.nvmrc`
+- `package.json` (volta section)
+- `Dockerfile`
+- `Dockerfile.dev`
+- `.circleci/config.yml` (2 places: executor tag and docker image)
+- `.infra/.nvmrc`
+- `.infra/package.json` (volta section)
+- This file (`AGENTS.md` - Prerequisites section)
+
+After updating, run `pnpm install` to check if lock file needs updating and commit any changes.

Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM node:22.16-bookworm-slim
+FROM node:22.22-bookworm-slim
 
 ADD https://www.apple.com/appleca/AppleIncRootCertificate.cer /usr/local/share/ca-certificates/AppleIncRootCertificate.cer
 ADD https://www.apple.com/certificateauthority/AppleRootCA-G2.cer /usr/local/share/ca-certificates/AppleRootCA-G2.cer

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM node:22.16-bookworm-slim
+FROM node:22.22-bookworm-slim
 
 ADD https://www.apple.com/appleca/AppleIncRootCertificate.cer /usr/local/share/ca-certificates/AppleIncRootCertificate.cer
 ADD https://www.apple.com/certificateauthority/AppleRootCA-G2.cer /usr/local/share/ca-certificates/AppleRootCA-G2.cer

package.json

@@ -191,7 +191,7 @@
     }
   },
   "volta": {
-    "node": "22.16.0"
+    "node": "22.22.0"
   },
   "packageManager": "pnpm@9.14.4+sha256.26a726b633b629a3fabda006f696ae4260954a3632c8054112d7ae89779e5f9a",
   "pnpm": {