Run CI on Node 24 by francoisferrand · Pull Request #1338 · scality/utapi

francoisferrand · 2026-09-23T22:15:09Z

Part of the OS-1155 Node.js 22→24 upgrade epic.

Why

utapi's engines.node already said >=22, but CI had never actually run anything on Node 24 — so that claim was untested. It didn't hold up: a native addon (ioctl, used for atomic file locking) silently failed to build there, and yarn printed a "safe to ignore" message for what was actually a missing runtime dependency. Once CI did run on 24, the test jobs surfaced a couple more things. This PR makes Node 24 the CI target and fixes what that surfaced.

What changed

CI now runs on Node 24 instead of 22.
Root-caused the ioctl build failure: bucketclient and arsenal were both pulled in through mechanisms (a nested copy, a git pin) that bypassed the nan version override meant to fix this, so the native build kept using a nan that doesn't support Node 24's ABI. Fixing this properly meant moving both to their real npm-published packages (@scality/bucketclient, @scality/arsenal) instead of patching around it — that also means a single arsenal copy in the tree instead of several. Added an explicit load check so a build failure like this can't hide behind yarn's messaging again.
Bumped the other scality dependencies that needed their own Node 24 fixes: vaultclient, werelogs, eslint-config-scality (now published as @scality/eslint-config-scality).
Refreshed the rest of the dependency tree within safe semver ranges, which cut down the known CVE count considerably.
Two resolutions for what oas-tools drags in: it's stuck on 2.2.2 (3.x is a rewrite) and pulls request → form-data 2.3.3 (critical + high) and jsonwebtoken 8.5.1 (high). Lifted to form-data 2.5.6 (same major request expects) and jsonwebtoken 9.x (only affects the security middleware, which utapi doesn't enable). That clears every remaining critical advisory.
Node 24 deprecates url.parse() and prints it on stderr, which our CI treats as a failure; switched the request handling to arsenal's request-target parser.
Fixed a functional test on connection failover that hung with the newer ioredis: subscribe was racing the connection ready check, and the test never finished on error responses.
Renamed the package to @scality/utapi (8.4.0), matching the npm-scoped naming now used across its own dependencies, and retargeted this PR to development/8.4.

Known follow-ups (not blocking)

@scality/arsenal is pinned as ^8.6.0-0 to allow picking up 8.6.0 prereleases/final without another bump — tighten once a stable 8.6.0 ships. This is acceptable since utapi only uses misc utils from arsenal.
oas-tools 2.x itself is unmaintained; the two resolutions above are a stopgap. Moving to @oas-tools/core 3.x (or another OpenAPI middleware) is a separate change.
Remaining yarn audit findings (2 high: semver via arsenal, serialize-javascript via mocha) only clear with major bumps upstream; left for a separate pass.

Verified

Clean installs, lint, and the full test suite pass on both Node 22 and Node 24 — including an explicit check that ioctl actually loads after install, not just that yarn install exits 0.

Issue: UTAPI-125

bert-e · 2026-09-23T22:15:13Z

Hello francoisferrand,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
`/after_pull_request`	Wait for the given pull request id to be merged before continuing with the current one.
`/bypass_author_approval`	Bypass the pull request author's approval	⭐
`/bypass_build_status`	Bypass the build and test status	⭐
`/bypass_commit_size`	Bypass the check on the size of the changeset `TBA`	⭐
`/bypass_incompatible_branch`	Bypass the check on the source branch prefix	⭐
`/bypass_jira_check`	Bypass the Jira issue check	⭐
`/bypass_peer_approval`	Bypass the pull request peers' approval	⭐
`/bypass_leader_approval`	Bypass the pull request leaders' approval	⭐
`/bypass_source_branch_lineage`	Bypass the cross-branch contamination check	⭐
`/approve`	Instruct Bert-E that the author has approved the pull request.		✍️
`/create_pull_requests`	Allow the creation of integration pull requests.
`/create_integration_branches`	Allow the creation of integration branches.
`/no_octopus`	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
`/unanimity`	Change review acceptance criteria from `one reviewer at least` to `all reviewers`
`/wait`	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
`/help`	Print Bert-E's manual in the pull request.
`/status`	Print Bert-E's current status in the pull request.
`/clear`	Remove all comments from Bert-E from the history `TBA`
`/retry`	Re-start a fresh build `TBA`
`/build`	Re-start a fresh build `TBA`
`/force_reset`	Delete integration branches & pull requests, and restart merge process from the beginning.
`/reset`	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

CI still built and tested against Node 22 only, so the 22->24 upgrade was never actually exercised. Bump the setup-node pin to the current Node 24 LTS (24.21.0) across all CI jobs (lint, v1 tests, v2 tests). actions/checkout and actions/setup-node are already on v4, so no action-pin bump is needed there. Issue: UTAPI-125

bert-e · 2026-09-24T07:24:40Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

bucketclient 8.2.5 nests its own non-peer arsenal 8.2.4 dependency (pre-BKTCLT-51) and arsenal 8.5.6 is git-pinned, so both trigger their own isolated build sandboxes on install. Neither sandbox honors the root resolutions.nan override, so diskusage's native addon inside them still builds against nan 2.22.0, which cannot compile against Node 24's V8/ABI -- a hard yarn install failure, not just a silently dropped optionalDependency. Bump bucketclient to 8.3.0 (depends on arsenal via peerDependency instead of nesting a copy) and switch arsenal from a git pin to the npm-published @scality/arsenal (prebuilt, no local build step). With both isolated-build sources gone, nan naturally resolves to a Node-24-compatible version across the whole tree (ioctl and diskusage both accept nan >=2.23, and nothing else caps it lower), so the explicit nan resolution pin is no longer needed and is dropped too. Update require('arsenal') to require('@scality/arsenal') everywhere in the codebase to match the new package name. Verified with a clean install on Node 24: no unmet-peer-dependency warning, single @scality/arsenal copy in node_modules, and require('ioctl') / require('diskusage') / require('@scality/arsenal') all load correctly (not just a green install exit code). Issue: UTAPI-125

These pinned transitive deps of an old yarn-berry-era toolchain (@yarnpkg/fslib, libzip, json-proxy, parsers, string-width, cliui) that nothing in the current dependency tree still needs -- a fresh install resolves fine without them. Issue: UTAPI-125

Picks up the Node 24 build fix from VLTCLT-69, now tagged and released (was previously only an open PR). Issue: UTAPI-125

werelogs 8.2.2 -> 8.2.5: routine patch bump, no known Node 24 issue but picked up while touching the dependency list. eslint-config-scality moves from the git-pinned scality/Guidelines package to the npm-published @scality/eslint-config-scality (8.3.3), consistent with the arsenal/bucketclient npm migration. Update eslint.config.mjs compat.extends() call to match the new name. Issue: UTAPI-125

bert-e · 2026-09-24T13:07:27Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

Node 24 emits DEP0169 for url.parse() on stderr, and the functional CI jobs fail on any stderr output from the server or the tests. Parse the request target with arsenal's parseRequestTarget() instead, like the other 8.6 consumers do; the pathname/path/query it returns match what url.parse() gave for request targets. Issue: UTAPI-125

ioredis now defers its ready check behind CLIENT SETINFO, so subscribing right after construction lands before the INFO and the client errors out with "Connection in subscriber mode". Connect explicitly and wait for ready before subscribing. The test also silently dropped the callback of requests answered with InternalError, which is expected for requests hitting the master switch, and only waited for the load to finish after the +slave event, so it timed out whenever the requests completed first. Keep sending requests until the sentinel reports the switch and count failed ones as done, since the test is about connection accounting. Issue: UTAPI-125

oas-tools 2.2.2 is the last 2.x release and drags in request (form-data 2.3.3, with a critical and a high advisory) and jsonwebtoken 8.5.1 (high advisory). Moving to oas-tools 3.x is a rewrite, not a bump. Use resolutions to lift them to the fixed releases instead: form-data 2.5.6 is the same major that request expects, and jsonwebtoken 9.x only changes key handling in code paths utapi never hits since openapi.yaml declares no security scheme. Issue: UTAPI-125

SylvainSenechal · 2026-09-24T18:40:36Z

    - uses: actions/setup-node@v4
      with:
-        node-version: '22.11.0'
+        node-version: '24.21.0'


how come sometimes we have 24.21.0, and other codebase, like the scuba one is just 24 :

- name: Setup Node 24 uses: actions/setup-node@v6 with: node-version: '24' cache: yarn

i don't know, and choose to ignore that question... especially this repo is not active anymore, so probably does not matter much: we need the bumps mainly because it is pulled in cloudserver...

checkout, setup-node, setup-python, the docker actions, gh-release and ssh-to-runner were several majors behind. The new majors mainly move the action runtime to Node 24; nothing we rely on changed (we set the cache option explicitly, and use none of the removed inputs). Issue: UTAPI-125

The interval test creates its ioredis connections at file load and then blocks the event loop in waitUntilNextInterval() as soon as the first beforeEach runs. If the handshake has not completed by then, the pushes issued right after the wait hit a connection that is still in `connect` state and, with enableOfflineQueue disabled, are rejected with "Stream isn't writeable and enableOfflineQueue options is false". This was always a race, but ioredis 5.11 needs a few more round trips (CLIENT SETINFO, async package.json read) before it reaches `ready`, which made it fail intermittently in CI. Wait for the test's redis client and both UtapiClient datastores to be ready in the before() hook. Issue: UTAPI-125

Aligns the package name with the npm scope used by its sibling packages (arsenal, bucketclient, eslint-config-scality) after this round of dependency work, and bumps the version for release. Issue: UTAPI-125

delthas · 2026-09-25T08:13:27Z

+  "resolutions": {
+    "oas-tools/jsonwebtoken": "^9.0.2",
+    "**/request/form-data": "^2.5.6"
+  },


Maybe let's have a followup ticket for bumping to oas-tools 3.x? To drop these overrides properly.

francoisferrand · 2026-09-25T08:57:22Z

/approve

bert-e · 2026-09-25T08:57:33Z

I have successfully merged the changeset of this pull request
into targetted development branches:

✔️ development/8.4

The following branches have NOT changed:

development/6.4
development/7.10
development/7.4
development/7.70
development/8.1
development/8.2
development/8.3

This pull request did not target the following hotfix branch(es) so they
were left untouched:

hotfix/7.10.2
hotfix/7.10.0
hotfix/7.6.0
hotfix/7.10.14
hotfix/7.4.0
hotfix/7.4.2
hotfix/7.4.1
hotfix/7.10.7
hotfix/7.4.4
hotfix/7.4.8
hotfix/7.2.0
hotfix/7.4.6
hotfix/7.4.7
hotfix/7.8.0
hotfix/7.7.0
hotfix/6.4.7
hotfix/7.9.0
hotfix/7.4.3
hotfix/7.10.4
hotfix/7.4.5
hotfix/7.4.9
hotfix/7.10.1
hotfix/7.4.10
hotfix/7.10.3

Please check the status of the associated issue UTAPI-125.

Goodbye francoisferrand.

The following options are set: approve

francoisferrand marked this pull request as draft September 24, 2026 07:02

francoisferrand force-pushed the improvement/UTAPI-125-node24 branch from 5ec8f0d to 1ee399a Compare September 24, 2026 07:24

francoisferrand changed the base branch from development/8.3 to development/8.4 September 24, 2026 10:48

scality deleted a comment from bert-e Sep 24, 2026

francoisferrand added 4 commits September 24, 2026 15:04

Bump vaultclient to 8.5.9

a8bfdd7

Picks up the Node 24 build fix from VLTCLT-69, now tagged and released (was previously only an open PR). Issue: UTAPI-125

scality deleted a comment from bert-e Sep 24, 2026

francoisferrand force-pushed the improvement/UTAPI-125-node24 branch from 620a1d6 to 4420eee Compare September 24, 2026 17:45

francoisferrand added 3 commits September 24, 2026 20:07

francoisferrand force-pushed the improvement/UTAPI-125-node24 branch from 35adeb6 to 5c26d06 Compare September 24, 2026 18:07

francoisferrand requested review from a team, SylvainSenechal and delthas September 24, 2026 18:08

francoisferrand marked this pull request as ready for review September 24, 2026 18:08

SylvainSenechal reviewed Sep 24, 2026

View reviewed changes

Comment thread .github/workflows/tests.yaml Outdated

SylvainSenechal reviewed Sep 24, 2026

View reviewed changes

Comment thread package.json

SylvainSenechal approved these changes Sep 24, 2026

View reviewed changes

francoisferrand force-pushed the improvement/UTAPI-125-node24 branch from 5c26d06 to 749a7ab Compare September 24, 2026 19:46

Rename package to @scality/utapi, bump to 8.4.0

9fe53ab

Aligns the package name with the npm scope used by its sibling packages (arsenal, bucketclient, eslint-config-scality) after this round of dependency work, and bumps the version for release. Issue: UTAPI-125

francoisferrand force-pushed the improvement/UTAPI-125-node24 branch from 749a7ab to 9fe53ab Compare September 24, 2026 21:34

delthas approved these changes Sep 25, 2026

View reviewed changes

bert-e merged commit 9fe53ab into development/8.4 Sep 25, 2026
15 checks passed

bert-e deleted the improvement/UTAPI-125-node24 branch September 25, 2026 08:57

Navigation Menu

Run CI on Node 24 - #1338

Run CI on Node 24#1338
bert-e merged 11 commits into
development/8.4from
improvement/UTAPI-125-node24

francoisferrand commented Sep 23, 2026 •

edited

Loading

Uh oh!

bert-e commented Sep 23, 2026

Uh oh!

bert-e commented Sep 24, 2026

Uh oh!

bert-e commented Sep 24, 2026

Uh oh!

Uh oh!

SylvainSenechal Sep 24, 2026

Uh oh!

francoisferrand Sep 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

delthas Sep 25, 2026

Uh oh!

francoisferrand commented Sep 25, 2026

Uh oh!

bert-e commented Sep 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

francoisferrand commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Known follow-ups (not blocking)

Verified

Uh oh!

bert-e commented Sep 23, 2026

Hello francoisferrand,

Uh oh!

bert-e commented Sep 24, 2026

Waiting for approval

Uh oh!

bert-e commented Sep 24, 2026

Waiting for approval

Uh oh!

Uh oh!

SylvainSenechal Sep 24, 2026

Choose a reason for hiding this comment

Uh oh!

francoisferrand Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

delthas Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

francoisferrand commented Sep 25, 2026

Uh oh!

bert-e commented Sep 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

francoisferrand commented Sep 23, 2026 •

edited

Loading

francoisferrand Sep 24, 2026 •

edited

Loading