chore: migrate supported runtime to Node 24

[N1arko]

Description

Move Kaneo's supported development, CI, and container runtime from Node.js 20 to the current Node.js 24 LTS line.

Node.js 20 is now end-of-life, while Node.js 24 is an actively supported LTS release. This PR pins Node.js 24.19.0 across GitHub Actions, the combined production image, the standalone API and web images, local docs tooling, package engines, and contributor documentation.

The combined Alpine image also moves to nginx 1.30.4, which is the version available in the Node 24.19.0 Alpine base. A root .dockerignore keeps local dependencies, build outputs, Git metadata, environment files, and logs out of every Docker build context.

Node.js release status: https://nodejs.org/en/about/previous-releases

Type of Change

• Other: runtime and build-tooling maintenance

How Has This Been Tested?

• Unit tests
• Manual testing
• Other: typecheck and three production Docker builds

Validation:

• pnpm install --frozen-lockfile
• pnpm test (88 test files, 458 tests passed)
• pnpm typecheck
• combined Dockerfile.kaneo build
• standalone API Docker build
• standalone web Docker build
• runtime reports Node.js 24.19.0 and nginx 1.30.4
• combined Docker build context is 7.61 MB with .dockerignore

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• New and existing unit tests pass locally with my changes

Additional Notes

The minimum Node.js engine is now 24. Existing deployments based on the published Kaneo image receive the runtime through the image and do not need a host-level Node.js installation.

Summary by CodeRabbit

• Chores
  • Upgraded the application’s supported Node.js version to 24.
  • Updated development, deployment, and scheduled automation environments to use Node.js 24.19.0.
  • Updated application and local development containers to Node.js 24.19.0.
  • Updated the bundled Nginx version used by the site container.
  • Added Docker ignore rules to exclude unnecessary files from container builds.
  • Updated MCP documentation and package requirements for Node.js 24 or newer.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 27999830-e33d-40a3-8351-c5220b00e107

📥 Commits

Reviewing files that changed from the base of the PR and between e9a57f6 and ee03ea9.

⛔ Files ignored due to path filters (2)

• CONTRIBUTING.md is excluded by !**/*.md
• packages/mcp/README.md is excluded by !**/*.md

📒 Files selected for processing (4)

• .dockerignore
• apps/docs/core/integrations/mcp.mdx
• package.json
• packages/mcp/package.json

🚧 Files skipped from review as they are similar to previous changes (2)

• package.json
• .dockerignore

---

📝 Walkthrough

Walkthrough

The project now requires Node.js 24. Docker images, local Compose services, and GitHub Actions workflows use Node.js 24.19.0. The Kaneo runtime also updates its Nginx constraint, and .dockerignore excludes build and environment artifacts.

Changes

Node.js 24 upgrade

Layer / File(s)	Summary
Node.js version contract package.json, packages/mcp/package.json, apps/docs/core/integrations/mcp.mdx	The project and MCP package require Node.js 24 or newer. The MCP documentation reflects the new requirement.
Container runtime updates Dockerfile.kaneo, apps/*/Dockerfile, compose.local.yml, .dockerignore	Docker and Compose images now use Node.js 24.19.0 Alpine. The Kaneo runtime updates its Nginx constraint. Docker build exclusions were added.
Workflow runtime updates .github/workflows/*.yml	CI, deployment, nightly, and publishing workflows now use pinned Node.js 24.19.0.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to ee03e

This change updates the supported Node.js runtime and related build environments, with tests, typechecking, and production image builds reported as passing; no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the pull request's main change: migrating the supported runtime to Node.js 24.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-free-for-open-source-projects]

PR Summary by Qodo

chore: migrate supported runtime to Node.js 24.19.0

⚙️ Configuration changes 📝 Documentation 🕐 20-40 Minutes

AI Description

• Pin Node.js 24.19.0 across GitHub Actions workflows and repo engine constraints.
• Upgrade Docker build bases to Node 24 and align combined image nginx to 1.30.4.
• Add a root .dockerignore and update contributor guidance for Node 24 minimum.

Diagram

graph TD
  A["Source repo"] --> B["GitHub Actions"] --> C["Node 24.19.0 toolchain"] --> D["pnpm lint/test/build"]
  A --> E[".dockerignore"] --> F["Docker build"] --> G["Published images"]
  C --> F
  H["nginx 1.30.4 (combined image)"] --> G

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Single-source Node version via .nvmrc (and setup-node node-version-file)

• ➕ Reduces duplication across workflows (one authoritative Node version).
• ➕ Improves local developer experience with standard tooling support.
• ➖ Dockerfiles still need explicit base tags; does not fully eliminate version duplication.
• ➖ Adds an additional file/process to keep in sync if Docker pins differ intentionally.

2. Track Node 24 via major tag (node:24-alpine) instead of pinning a patch

• ➕ Automatically receives upstream security/patch updates without PRs.
• ➕ Less maintenance overhead for patch bumps.
• ➖ Less reproducible builds; CI/Docker results can change without repo changes.
• ➖ Harder to bisect regressions caused by upstream image updates.

3. Automate version bumps with Renovate/Dependabot (Node + base images)

• ➕ Keeps patch pins while reducing manual maintenance.
• ➕ Creates audit trail and scheduled updates for runtime/tooling.
• ➖ Additional tooling/configuration and PR noise.
• ➖ Still requires human validation for runtime compatibility.

Recommendation: The PR’s explicit patch pinning (24.19.0) is a good choice for reproducible CI and container builds, especially when changing LTS lines. If duplication becomes painful, consider adding a .nvmrc and wiring setup-node to node-version-file to centralize the version for developers/CI while keeping Dockerfiles pinned explicitly.

Files changed (11) +31 / -20

Documentation (1) +1 / -1

CONTRIBUTING.mdDocument Node.js 24 minimum for contributors +1/-1

Document Node.js 24 minimum for contributors

• Updates contributor prerequisites to require Node.js 24 or newer, aligning docs with repo and CI/runtime support.

CONTRIBUTING.md

Other (10) +30 / -19

.dockerignoreAdd root Docker ignore rules for smaller build contexts +11/-0

Add root Docker ignore rules for smaller build contexts

• Introduces a repository-wide .dockerignore to exclude VCS metadata, build outputs, node_modules, env files, and logs from all Docker build contexts.

.dockerignore

ci.ymlPin CI jobs to Node.js 24.19.0 +5/-5

Pin CI jobs to Node.js 24.19.0

• Updates all CI jobs (lint, typecheck, unit, build, integration, docker-build) to use Node.js 24.19.0 via actions/setup-node.

.github/workflows/ci.yml

deploy-site.ymlPin GitHub Pages site build to Node.js 24.19.0 +1/-1

Pin GitHub Pages site build to Node.js 24.19.0

• Updates the Pages build workflow to use Node.js 24.19.0 for consistent site builds.

.github/workflows/deploy-site.yml

nightly.ymlPin nightly verification workflow to Node.js 24.19.0 +1/-1

Pin nightly verification workflow to Node.js 24.19.0

• Updates the nightly verification job to run with Node.js 24.19.0 to match the supported runtime.

.github/workflows/nightly.yml

publish-mcp.ymlPin MCP publish workflow to Node.js 24.19.0 +1/-1

Pin MCP publish workflow to Node.js 24.19.0

• Replaces the floating Node 24 major reference with an explicit Node.js 24.19.0 pin for deterministic releases.

.github/workflows/publish-mcp.yml

Dockerfile.kaneoMove combined image build/runtime to Node 24.19.0 and nginx 1.30.4 +5/-5

Move combined image build/runtime to Node 24.19.0 and nginx 1.30.4

• Upgrades all build/runtime stages from node:20.20.2-alpine to node:24.19.0-alpine and bumps the installed nginx package to ~1.30.4 (as provided by the Alpine base).

Dockerfile.kaneo

DockerfileUpgrade API image stages to Node 24.19.0 Alpine +3/-3

Upgrade API image stages to Node 24.19.0 Alpine

• Updates builder, prod-deps, and runtime stages to node:24.19.0-alpine to match the new supported runtime.

apps/api/Dockerfile

DockerfileUpgrade web build stage to Node 24.19.0 Alpine +1/-1

Upgrade web build stage to Node 24.19.0 Alpine

• Updates the web build stage to node:24.19.0-alpine; the runtime stage remains an nginx Alpine image.

apps/web/Dockerfile

compose.local.ymlBump local docs container to Node 24.19.0 Alpine +1/-1

Bump local docs container to Node 24.19.0 Alpine

• Updates the local docs service container image from Node 20 Alpine to node:24.19.0-alpine.

compose.local.yml

package.jsonRaise supported Node engine to >=24.0.0 +1/-1

Raise supported Node engine to >=24.0.0

• Updates the root package engines constraint to require Node.js 24+, aligning tooling expectations with CI and Docker images.

package.json

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can group findings by type and pick your Finding display, from Minimal to Full

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 31: Add an explicit engines.node requirement to the MCP package manifest
in packages/mcp/package.json, using the same Node.js version constraint defined
by the root package.json. Keep the published MCP runtime prerequisite aligned
with that shared value.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ad5cebde-7dc0-4462-8ff3-942fbd914d44

📥 Commits

Reviewing files that changed from the base of the PR and between 7d9d9d2 and e9a57f6.

⛔ Files ignored due to path filters (1)

• CONTRIBUTING.md is excluded by !**/*.md

📒 Files selected for processing (10)

• .dockerignore
• .github/workflows/ci.yml
• .github/workflows/deploy-site.yml
• .github/workflows/nightly.yml
• .github/workflows/publish-mcp.yml
• Dockerfile.kaneo
• apps/api/Dockerfile
• apps/web/Dockerfile
• compose.local.yml
• package.json

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e9a57f626c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[randoneering]

@N1arko thank you for your work on this. I took a look with some of the security tools we have (socket, trivy, etc) and it looks like this should be good to ship. As long as CI continues to pass, we are good to move the dep up @andrejsshell and @tinsever