Node.js 22

Apply the JavaScript ES2026 baseline first. These rules target the Node.js 22 "Jod" maintenance LTS, which mainly receives security and critical fixes.

Release line

• Run the newest Node.js 22 release and redeploy on each 22.x security release, using a line-following tag such as node:22-slim rebuilt with docker build --pull, or a bot-updated digest. Where a Dockerfile or CI matrix needs an exact version you can't check on nodejs.org, leave a build-failing placeholder.
• Check the runtime with is-my-node-vulnerable as a locked dev dependency, not bare npx; npm audit doesn't cover Node.js.
• Plan hardening around the APIs this maintenance line actually ships, and rehearse moving to a newer LTS well before its 2027-04-30 end of life.
• Keep build, CI, and production on one 22 release by shipping the tested image or pinning every image and runner to one bot-updated digest, since a line tag resolves at each pull, and enforce the deployed version; engines is advisory.
• Depend on the permission model only on 22.13.0 and later, where --permission became stable.

Permission model

• Start production with --permission, granting only the exact --allow-fs-read, --allow-fs-write, --allow-child-process, --allow-worker, --allow-addons, and --allow-wasi capabilities needed. Pass one path per filesystem flag; comma lists aren't accepted, and * removes the restriction.
• Restrict network access outside the process; this line has no network permission for sockets, DNS, or HTTP.
• Treat permissions as defense in depth: they don't contain hostile code,