chore: bump Node 22 -> 24 (Active LTS)

[guarzo]

Stacked on #24 — merge #24 first. This branch is based on tooling-deps, not main, because it corrects two hard-coded Node majors in the comments #24 adds to .github/dependabot.yml. Once #24 merges, GitHub will retarget this to main and the diff will be the eight files below.

What changed and why

Node 22 went to Maintenance LTS on 2025-10-21. Node 24 is the current Active LTS line (maintenance 2026-10-20, EOL 2028-04-30), verified against nodejs/Release/schedule.json. Production should run Active LTS.

scripts/check-node-version.sh forces the Dockerfile, .nvmrc and package.json engines to agree on the major, so all three move in one commit, plus @types/node ^22 -> ^24 so the types describe the runtime that actually ships. engines: >=24 still accepts a local Node 26.

Note 26 was not chosen: it is Current, not LTS, until 2026-10-28.

The --env-file-if-exists (Node 22.9) rationale is preserved in .npmrc, the Dockerfile and docs/ops.md. The floor is now far above it, but it is still why engine-strict=true is load-bearing — npm run db:migrate is fly.toml's release_command.

What CI cannot check

docker build — CI does not build the image, so this was run locally against the real node:24-alpine:

#22 exporting to image
#22 writing image sha256:d54e17bd063a029584a22c636784f395741ac87edf5269d90631a18ff76dda49 done
#22 naming to docker.io/library/authgd:node24-check 0.0s done
#22 DONE 3.9s

Both npm ci stages passed under engine-strict=true, and the runtime image parses the flag the floor exists for:

$ docker run --rm authgd:node24-check node --version
v24.18.1
$ docker run --rm authgd:node24-check sh -c 'node --env-file-if-exists=.env.nope -e "console.log(1)"'
.env.nope not found. Continuing without it.
1

Everything CI does run was also run locally:

• bash scripts/check-node-version.sh -> node version OK: Dockerfile=24 .nvmrc=24 engines='>=24'
• npm run typecheck -> clean
• npm run lint -> 4 problems (0 errors, 4 warnings) — the pre-existing @next/next/no-img-element warnings, unchanged
• npm run format:check -> All matched files use Prettier code style!
• npm run build -> succeeded, 15 routes
• npm test -> Test Files 44 passed (44) / Tests 313 passed (313)
• npm run test:e2e -> 8 passed (19.9s)

Unit and e2e were run serially against a dedicated Postgres on :5434, not the shared :5433.

Deploy notes

The next deploy after this merges builds on node:24-alpine and runs the release db:migrate on Node 24. No migration, no secret, no fly.toml change.

Flags

• CI takes its Node from node-version-file: .nvmrc, so there was no separate CI pin to update — the bump propagates automatically.
• npm install reports 8 pre-existing vulnerabilities (4 moderate, 4 high). Unrelated to this change; Dependabot security alerts are now enabled and will file them individually.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8f151bbb-9baf-4acb-870b-99c08bba93a9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}