JSv4 · Oct 16, 2026 · Oct 9, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026
diff --git a/.github/workflows/frontend-e2e-extract.yml b/.github/workflows/frontend-e2e-extract.yml
@@ -61,7 +61,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "24"
 
       - name: Install Yarn
         run: npm install -g yarn

diff --git a/.github/workflows/frontend-e2e-websocket.yml b/.github/workflows/frontend-e2e-websocket.yml
@@ -72,7 +72,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "24"
 
       - name: Install Yarn
         run: npm install -g yarn

diff --git a/.github/workflows/frontend-e2e.yml b/.github/workflows/frontend-e2e.yml
@@ -54,7 +54,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "24"
 
       - name: Install Yarn
         run: npm install -g yarn

diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml
@@ -27,7 +27,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "24"
 
       - name: Install Yarn
         run: npm install -g yarn
@@ -61,7 +61,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "24"
 
       - name: Install Yarn
         run: npm install -g yarn # Still need global yarn
@@ -115,7 +115,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "24"
       - name: Install Yarn
         run: npm install -g yarn
       - name: Clear Yarn Cache
@@ -137,7 +137,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "24"
       - name: Install Yarn
         run: npm install -g yarn
       - name: Clear Yarn Cache

diff --git a/.github/workflows/screenshots.yml b/.github/workflows/screenshots.yml
@@ -51,7 +51,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "24"
 
       - name: Install Yarn
         run: npm install -g yarn

diff --git a/changelog.d/2420-node-24-toolchain.changed.md b/changelog.d/2420-node-24-toolchain.changed.md
@@ -0,0 +1,2 @@
+- Bumped the frontend toolchain from Node 20 to Node 24 everywhere it is pinned: CI (`.github/workflows/frontend.yml`, `frontend-e2e.yml`, `frontend-e2e-extract.yml`, `frontend-e2e-websocket.yml`, `screenshots.yml`), the production image (`frontend/Dockerfile`, now `node:24-alpine`) and `frontend/.nvmrc` (was a stale `v16.19.1`). Node 20 reached end-of-life in April 2026. The `@graphql-tools/executor-legacy-ws` 1.1.21 → 1.1.37 security bump (GHSA-6fw5-9hq8-w87g, GHSA-434m-5hcj-pxf3, GHSA-mp66-8ww2-pcwm) pulls in `@whatwg-node/promise-helpers@2`, which declares `engines.node >=22.15.0`, so `yarn install --frozen-lockfile` aborted on Node 20 (`error @whatwg-node/promise-helpers@2.0.0: The engine "node" is incompatible with this module`). Every `executor-legacy-ws` release that carries the fixes (>=1.1.35) depends on `@graphql-tools/utils@12`, so no lockfile-only resolution exists; the package is a dev-only transitive of `@graphql-codegen/cli` and never ships in the bundle.
+- `frontend/package.json` now declares `engines.node >=22.15.0`, so a contributor on an older Node gets a clear top-level `yarn install` error instead of one attributed to a transitive package. Removed `frontend/.github/workflows/playwright.yml`, Playwright boilerplate from the original Vite switch that GitHub never ran (workflows only execute from the repository-root `.github/`) and nothing referenced.
diff --git a/frontend/.github/workflows/playwright.yml b/frontend/.github/workflows/playwright.yml
diff --git a/frontend/.nvmrc b/frontend/.nvmrc
@@ -1 +1 @@
-v16.19.1
+24
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
@@ -1,5 +1,5 @@
 # => Build Container
-FROM node:20-alpine as builder
+FROM node:24-alpine as builder
 
 WORKDIR /app
 COPY package.json .

diff --git a/frontend/package.json b/frontend/package.json
@@ -3,6 +3,9 @@
   "version": "0.1.0",
   "private": true,
   "license": "MIT",
+  "engines": {
+    "node": ">=22.15.0"
+  },
   "dependencies": {
     "@apollo/client": "^3.13.8",
     "@auth0/auth0-react": "^2.3.0",

diff --git a/frontend/yarn.lock b/frontend/yarn.lock
@@ -991,15 +991,15 @@
     tslib "^2.8.1"
 
 "@graphql-tools/executor-legacy-ws@^1.1.19":
-  version "1.1.21"
-  resolved "https://registry.yarnpkg.com/@graphql-tools/executor-legacy-ws/-/executor-legacy-ws-1.1.21.tgz#29564c284226b887fe49e4126c94fe5506da00fc"
-  integrity sha512-tyr/KFkWwN6GgX2KFkLi1CJw6CkMS6rpI2TEL3TM5TdBIk5+dbC457GpOLFdAqzCDrOqH5COlFwaBSgdKJEPdg==
+  version "1.1.37"
+  resolved "https://registry.yarnpkg.com/@graphql-tools/executor-legacy-ws/-/executor-legacy-ws-1.1.37.tgz#3b66f4e678610172c1609032e04e4752ddd62d04"
+  integrity sha512-2rcZv0aLgNPEhsfXYOiRyCpES76jLuUFpSZJRXivMxjgZWlHTLwz0bBP4QmjQDR+b0DDSe8KgSVAbcSHcB0Z0A==
   dependencies:
-    "@graphql-tools/utils" "^10.10.1"
+    "@graphql-tools/utils" "^12.0.3"
     "@types/ws" "^8.0.0"
     isomorphic-ws "^5.0.0"
     tslib "^2.4.0"
-    ws "^8.17.1"
+    ws "^8.21.3"
 
 "@graphql-tools/executor@^1.4.9":
   version "1.4.11"
@@ -1175,6 +1175,16 @@
     cross-inspect "1.0.1"
     tslib "^2.4.0"
 
+"@graphql-tools/utils@^12.0.3":
+  version "12.0.3"
+  resolved "https://registry.yarnpkg.com/@graphql-tools/utils/-/utils-12.0.3.tgz#8cae349fe99ff6dd142e497485e4a031b6d32248"
+  integrity sha512-M+04bHvI1SKoug7W2EkwfKjig2mdtgIIlFY8p2jLHmxPNVs5bC/3R+58JrD+7ZXWgPILWTwuqJ9AqTjPlahroA==
+  dependencies:
+    "@graphql-typed-document-node/core" "^3.1.1"
+    "@whatwg-node/promise-helpers" "^2.0.0"
+    cross-inspect "1.0.1"
+    tslib "^2.4.0"
+
 "@graphql-tools/wrap@^10.0.16":
   version "10.1.4"
   resolved "https://registry.yarnpkg.com/@graphql-tools/wrap/-/wrap-10.1.4.tgz#46f94b00113693d4d4eccddcf262494164234ba6"
@@ -2975,6 +2985,13 @@
   dependencies:
     tslib "^2.6.3"
 
+"@whatwg-node/promise-helpers@^2.0.0":
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/@whatwg-node/promise-helpers/-/promise-helpers-2.0.0.tgz#93a89655355bbd5d7e2b0d64fc93a88224d7030e"
+  integrity sha512-/i9CS0Z96o+cPwaYoAyVxAThDiUX1wV3tDmNWPJbn+vtdR+JftuCDg1NGCXBrzIYVDGkJ8uT6ctwmrBOUzOpKQ==
+  dependencies:
+    tslib "^2.6.3"
+
 "@wry/caches@^1.0.0":
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/@wry/caches/-/caches-1.0.1.tgz#8641fd3b6e09230b86ce8b93558d44cf1ece7e52"
@@ -8558,6 +8575,11 @@ ws@^8.17.1, ws@^8.18.0, ws@^8.18.3:
   resolved "https://registry.yarnpkg.com/ws/-/ws-8.21.0.tgz#012e413fc07429945121b0c153158c4343086951"
   integrity sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==
 
+ws@^8.21.3:
+  version "8.22.0"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-8.22.0.tgz#40f16e1d7588ac0575041be5c49b8eb261c28e73"
+  integrity sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==
+
 xml-name-validator@^5.0.0:
   version "5.0.0"
   resolved "https://registry.yarnpkg.com/xml-name-validator/-/xml-name-validator-5.0.0.tgz#82be9b957f7afdacf961e5980f1bf227c0bf7673"
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		- Bumped the frontend toolchain from Node 20 to Node 24 everywhere it is pinned: CI (`.github/workflows/frontend.yml`, `frontend-e2e.yml`, `frontend-e2e-extract.yml`, `frontend-e2e-websocket.yml`, `screenshots.yml`), the production image (`frontend/Dockerfile`, now `node:24-alpine`) and `frontend/.nvmrc` (was a stale `v16.19.1`). Node 20 reached end-of-life in April 2026. The `@graphql-tools/executor-legacy-ws` 1.1.21 → 1.1.37 security bump (GHSA-6fw5-9hq8-w87g, GHSA-434m-5hcj-pxf3, GHSA-mp66-8ww2-pcwm) pulls in `@whatwg-node/promise-helpers@2`, which declares `engines.node >=22.15.0`, so `yarn install --frozen-lockfile` aborted on Node 20 (`error @whatwg-node/promise-helpers@2.0.0: The engine "node" is incompatible with this module`). Every `executor-legacy-ws` release that carries the fixes (>=1.1.35) depends on `@graphql-tools/utils@12`, so no lockfile-only resolution exists; the package is a dev-only transitive of `@graphql-codegen/cli` and never ships in the bundle.
		- `frontend/package.json` now declares `engines.node >=22.15.0`, so a contributor on an older Node gets a clear top-level `yarn install` error instead of one attributed to a transitive package. Removed `frontend/.github/workflows/playwright.yml`, Playwright boilerplate from the original Vite switch that GitHub never ran (workflows only execute from the repository-root `.github/`) and nothing referenced.