Upgrade NodeJS dependencies & upgrade for LTS

[data-douser]

This pull request:

• updates the Node.js version requirements across the project;
• removes support for Node.js 25 in order to align with LTS-supported versions of NodeJS (e.g. 24 & 26) and as a reaction to transitive package dependencies (like ini) having already dropped such support for Node.js 25;
• adds matrix testing for Node.js 24 and 26 in all GitHub Actions workflows, and upgrades several dependencies for improved compatibility and security. The most important changes are summarized below.

Node.js Version Updates:

• Downgraded the default Node.js version in .node-version from v25.6.0 to v24.18.0 to ensure compatibility with the updated engines and CI matrix.
• Updated the engines.node field in package.json, server/package.json, and extensions/vscode/package.json to support Node.js ^24.15.0 or >=26.0.0, replacing the previous requirement for Node.js 25+. [1] [2] [3]

CI/CD Workflow Improvements:

• Updated all main GitHub Actions workflows (build-server.yml, build-and-test-client.yml, build-and-test-extension.yml) to use a matrix strategy for Node.js versions (.node-version and 26), ensuring tests run on both Node 24 and 26. Workflow job names and summaries now include the Node.js version. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]

Dependency Upgrades:

• Upgraded various dependencies and devDependencies in client/go.mod, server/package.json, extensions/vscode/package.json, and the root package.json for improved compatibility, security, and bug fixes. Notable upgrades include adm-zip, js-yaml, @types/node, eslint, prettier, and several others. [1] [2] [3] [4]

Tooling and Configuration:

• Added a root-level overrides section in package.json to pin @types/node to ^24.13.3 for consistent type checking.
• Introduced an allowScripts field in the root package.json to allow specific postinstall scripts, improving security and reproducibility.

These changes collectively improve compatibility with current and future Node.js versions and enhance the reliability of the CI pipeline.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 9 package(s) with unknown licenses.

View full job summary

[Copilot]

Pull request overview

This pull request updates the repository’s Node.js compatibility to align with LTS-focused versions (Node 24 and 26), upgrades a set of Node/Go dependencies, and expands CI coverage to run workflows across both Node versions.

Changes:

• Update Node.js engine constraints across packages and set .node-version to Node 24.x.
• Upgrade Node and Go dependencies (including adding root overrides and allowScripts hardening).
• Add Node 24/26 matrix testing to key GitHub Actions workflows and surface the matrix value in job names/summaries.

Show a summary per file

File	Description
server/package.json	Updates Node engine range and upgrades server dependencies/devDependencies.
package.json	Updates root Node engine range; adds overrides for @types/node and allowScripts.
package-lock.json	Refreshes lockfile to reflect upgraded dependencies and new constraints.
extensions/vscode/package.json	Updates Node engine range and upgrades extension devDependencies.
client/go.mod	Bumps Go module dependencies to newer versions.
client/go.sum	Updates checksums for the upgraded Go module set.
.node-version	Sets the repo default Node version to v24.18.0.
.github/workflows/build-server.yml	Adds Node matrix (24 via .node-version + 26) and includes Node in job naming.
.github/workflows/build-and-test-extension.yml	Adds Node matrix (24 via .node-version + 26) and includes Node in job naming.
.github/workflows/build-and-test-client.yml	Adds Node matrix (24 via .node-version + 26) for test jobs and updates summaries to include Node.

Review details

Comments suppressed due to low confidence (1)

.github/workflows/build-and-test-client.yml:223

• Same issue as the other setup-node step: providing node-version (even as an empty string) can override node-version-file, so .node-version may be ignored and the wrong Node version used. Use two guarded setup-node steps instead of passing an empty node-version.

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          cache: 'npm'
          node-version: ${{ matrix.node != '.node-version' && matrix.node || '' }}
          node-version-file: '.node-version'

• Files reviewed: 8/12 changed files
• Comments generated: 3
• Review effort level: Low

[Copilot]

Review details

• Files reviewed: 8/12 changed files
• Comments generated: 1
• Review effort level: Low

[Copilot]

Review details

Comments suppressed due to low confidence (2)

package.json:37

• The PR description says it “Introduced an allowScripts field in the root package.json to allow specific postinstall scripts”, but the current root package.json has no allowScripts entry. If you intended to adopt npm’s script allowlist, please add allowScripts (ideally pinned to the versions in package-lock.json) so installs/rebuilds don’t unexpectedly skip required native/binary setup scripts under newer npm behavior.

  "overrides": {
    "@types/node": "^24.13.3"
  },
  "scripts": {

CHANGELOG.md:23

• Several user-facing docs still state a minimum Node.js version of v25.6.0 (e.g. README.md, server/README.md, client/README.md, docs/getting-started.md, docs/public.md, extensions/vscode/README.md). With this PR changing supported Node to ^24.15.0 || >=26.0.0 and .node-version to v24.18.0, those docs should be updated too; otherwise users will keep being told to install a now-unsupported Node 25.

- **Realigned the supported Node.js versions with the Node.js LTS release line.** The `engines.node` constraint in the root, `server`, and `extensions/vscode` `package.json` files moved from `>=25.6.0` to `^24.15.0 || >=26.0.0`, and `.node-version` moved from `v25.6.0` to `v24.18.0`. Node.js 25 is no longer supported: it is a non-LTS ("Current") line, and transitive dependencies such as `ini` have already dropped support for it. ([#328](https://github.com/advanced-security/codeql-development-mcp-server/pull/328))
- **Added Node.js matrix testing to the build workflows.** `build-server.yml`, `build-and-test-client.yml`, and `build-and-test-extension.yml` now run against both Node 24 (via `.node-version`) and Node 26, with the Node version surfaced in job names and `$GITHUB_STEP_SUMMARY` output. Each matrix entry uses two `if:`-guarded `actions/setup-node` steps so `node-version` is never passed as an empty string (which would otherwise take precedence over `node-version-file` and silently select the runner's default Node). ([#328](https://github.com/advanced-security/codeql-development-mcp-server/pull/328))
- **Pinned `@types/node` repo-wide via a root `overrides` entry** (`^24.13.3`) so every workspace type-checks against a single Node typings version that matches the supported Node 24 LTS baseline. ([#328](https://github.com/advanced-security/codeql-development-mcp-server/pull/328))

• Files reviewed: 9/13 changed files
• Comments generated: 0 new
• Review effort level: Low

[Copilot]

Review details

Comments suppressed due to low confidence (3)

.github/workflows/build-and-test-client.yml:350

• This row reports matrix.node, which is .node-version for one matrix entry, so the summary table doesn't actually show the Node version used. Use node -v to capture the real runtime version.

          echo "| Node | ${{ matrix.node }} |" >> $GITHUB_STEP_SUMMARY

.github/workflows/build-and-test-client.yml:208

• The summary prints Node ${{ matrix.node }}, but for the .node-version matrix entry this renders as Node .node-version rather than the actual runtime version used. Prefer reporting the real Node version (e.g. node -v) so CI summaries are accurate.

This issue also appears on line 350 of the same file.

          echo "## Integration Tests (${{ matrix.os }}, ${{ matrix.mcp-mode }}, Node ${{ matrix.node }})" >> $GITHUB_STEP_SUMMARY
          echo "✅ MCP server integration tests passed on ${{ matrix.os }} with ${{ matrix.mcp-mode }} transport (Node ${{ matrix.node }})" >> $GITHUB_STEP_SUMMARY

package.json:36

• PR description mentions introducing a root-level allowScripts field in package.json, but the file currently only adds overrides and does not define allowScripts anywhere. Either add the intended allowScripts allowlist here or update the PR description to avoid documenting a change that isn't present.

  "overrides": {
    "@types/node": "^24.13.3"
  },

• Files reviewed: 9/13 changed files
• Comments generated: 0 new
• Review effort level: Low