[kwent]

Summary

Why: the October 21, 2026 Node.js security release (CVE-2026-111497 Brotli RCE, plus CVE-2026-105482/-105483/-106069). Node 20 is EOL and gets no fixes. Moving to 24 is an approved major upgrade.

What:

Path	Before	After
mise.toml [tools] node	"20"	"24" (still floating, so it resolves to 24.22.1 today)

I re-checked the whole repo on master (rg for node:, .nvmrc, .node-version, .tool-versions, mise.toml, setup-node, sem-version, nodejs, engines). mise.toml is the only Node reference. Nothing uses Node: CI (ci.yml, publish.yml) is Python/uv only, there is no package.json, and make regenerate (openapi-python-client + ruff) is pure Python. This pin only affects local dev shells that use mise.

Evidence

• mise ls node → 24.22.1 ~/repos/rootly-python/mise.toml 24; mise exec -- node -v → v24.22.1 (V8 13.6.233.17-node.58, OpenSSL 3.5.9). 24.22.1 is listed on nodejs.org/dist/index.json.
• Baseline (master) and after (this branch) gave the same results: unittest discover OK (1 test), import rootly_sdk OK, ruff check all passed, ruff format --check 4511 files already formatted.
• NODE_OPTIONS=--pending-deprecation mise exec -- make regenerate under Node 24.22.1 succeeded in a scratch worktree (1638 files patched, ruff fix + format clean). I threw that output away because it's just spec drift.
• Not a regression: on both master and this branch, a bare mise exec -- make test fails with No module named 'httpx'. That's because mise's python = "latest" (3.15.1) has no deps installed. It passes under uv run.
• Tests are thin: 1 unit test plus an import smoke test. That's acceptable here since no code path runs on Node.

Impact

Dev tooling only. The published rootly wheel, CI and SDK users are unaffected. Developers using mise get Node 24.22.1 instead of the EOL Node 20.

Risk

risk:low: one line, dev-tooling only, and nothing in the repo invokes Node.

Rollout / rollback

Merging deploys nothing and needs no release. Developers run mise install to pick it up. To roll back, revert this commit (Node 20 is EOL and vulnerable, so roll back only briefly).

Link to Devin session: https://rootly.devinenterprise.com/sessions/c203f91a88cf43afa7c9de7b5f5f84d2
Open in Devin Desktop: https://rootly.devinenterprise.com/desktop/session/c203f91a88cf43afa7c9de7b5f5f84d2?variant=devin
Requested by: @kwent

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.