chore: bump node to v24.22.1 (44-x-y) - #55162

…ed by CVE-2026-111497 (coder#7359)

## Summary

The HTTP server now refuses compressed request bodies with 415 before
any auth check, so a client that reaches the port can no longer feed
bytes to Node's bundled Brotli decoder (CVE-2026-111497, "Node2Shell").
The CLI also warns on Node releases without the fix, `engines.node`
requires a fixed release, and the Docker build fails when its Node is
affected.

## Background

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that
Node.js bundles: crafted Brotli data can run code. Node fixed it in
22.23.4, 24.22.1 and 26.12.1. Lines 23 and 25 get no fix. A process is
exposed when it runs an affected Node and decodes Brotli data that an
attacker controls.

`createOrpcServer` registers `express.json()` and `express.urlencoded()`
ahead of auth, and body-parser inflates a `Content-Encoding: br` body
through `zlib.createBrotliDecompress()`. So any client that could reach
the port, without a token, could reach the decoder. Three products run
this server:

- `xum server` from npm, on the user's Node. `engines.node` was `>=22`,
and the CLI warned only below Node 22.
- The Docker image (`--host 0.0.0.0`). `ghcr.io/coder/mux:latest`
(v0.31.0) ships Node 22.23.3, which is affected. `:nightly` already
ships 22.23.4.
- The desktop app's API server, in the Electron main process (Electron
44.5.1 bundles Node 24.21.0).

No xum client sends a compressed request body: browsers do not compress
fetch bodies, and the CLI, ACP and VS Code clients use plain fetch and
oRPC.

## Implementation

- `src/node/orpc/server.ts`: both parsers get `inflate: false`.
body-parser then answers 415 for any `Content-Encoding` other than
identity, before it creates a decompression stream. This closes the
unauthenticated path on all three products and on every Node version,
including the desktop app's affected Electron runtime.
- `src/cli/nodeVersion.ts`: `BROTLI_FIXED_NODE_RELEASES` lists the first
fixed release of each line, and `nodeVersionWarning` returns a one-line
CVE warning for an affected release. The contract of the existing
minimum-version warning stays: stderr only, never exits, quiet under
Electron and Bun.
- `package.json`: `engines.node` is `^22.23.4 || ^24.22.1 || >=26.12.1`.
Its test derives the expected value from the table, so the two cannot
drift.
- `Dockerfile`: the runtime stage runs the builder's compiled
`nodeVersionWarning` against its own Node and fails the build on an
affected or unsupported release (for example a stale cached base). The
`node:22-slim` tag stays floating on purpose.
- `docs/install.mdx` names the fixed releases (and the generated
built-in docs skill follows).
- `src/cli/workflow.test.ts` spawned the CLI with the host `node` and
expected empty stderr. It now expects exactly the warning for the Node
it spawned, so it passes on an affected host Node too.

## Validation

- Remote dogfood UAT (Coder Agents) passed on a07ae4f against control
9921714. br, gzip and deflate bodies to every route got 415, and a
zlib hook recorded zero decoder calls (the control build: 26). The web
UI flow showed no 415s. On Node 22.23.3 and 24.22.0 each CLI command
printed exactly one extra stderr line, on 22.23.4 and 24.22.1 none, and
stdout was byte-identical. The image builds on `node:22-slim` (v22.23.4)
and fails at the new step on `node:22.23.3-slim`. Later commits change
only tests and one comment, plus a merge of main.
- Each new test fails when the behavior it covers is broken: removing
`inflate: false` from either parser, moving a table entry, or restoring
the old engines value.
- `docker build .` locally: the new step runs in the runtime stage.

## Risks

Low. A client that compresses request bodies now gets 415 (also on `GET
/health` with a compressed body); no xum client does. On an affected
Node, npm prints an `EBADENGINE` warning at install and the CLI prints
one stderr line at startup; neither blocks.

## Follow-ups

- Desktop app: Electron 44.5.1's Node still decodes `br` responses on
outbound fetches (MCP servers, provider base URLs, OAuth endpoints). No
stable Electron ships Node 24.22.1 yet (44.9.3 and 45.0.0 ship 24.22.0;
electron/electron#55162 is merged into 44-x-y), so the Electron bump is
tracked in coder#7358.
- The Nix package wraps the consumer's nixpkgs `electron_44` and follows
nixpkgs.
- Docker `latest` and npm users get this with the next release.

…26-111497 fix (coder#7374)

## Summary

The desktop app's Electron 44.5.1 bundles Node 24.21.0. That Node is
affected by CVE-2026-111497 ("Node2Shell"), and its `fetch` decodes
`Content-Encoding: br` responses with the vulnerable Brotli decoder.
Until Electron ships a 44.x with Node 24.22.1 or newer (coder#7358), the
backend asks servers for gzip or deflate only and refuses a Brotli
response before `fetch` decodes it. The guard turns itself off on Bun
and on any Node with the fix, so it goes quiet once the Electron bump
lands.

## Background

coder#7359 closed the inbound path: the API server refuses compressed request
bodies. Outbound fetches were still open: a malicious or compromised MCP
server, OAuth endpoint or provider base URL could answer with crafted
Brotli data. Electron has merged Node 24.22.1 into its 44 branch
(electron/electron#55162) but has not released it yet.

## Implementation

- `refuseBrotliResponses` is an undici interceptor. It removes `br` (and
the `*` wildcard) from `Accept-Encoding`, and it aborts a response whose
`Content-Encoding` lists `br` at the header stage, so the body never
reaches the decoder. A block inside the decoder makes `fetch` hang
instead of failing, so the guard sits on the dispatcher.
- Its handler forwards every call itself instead of extending undici's
`DecoratorHandler`, which allows one response start: undici starts one
for each informational response (103 Early Hints) before the final one.
- `ServiceContainer` installs it on the global dispatcher, which covers
every plain `fetch` (MCP SDK transports, OAuth). Desktop, `xum server`
and ACP all build a `ServiceContainer` before any service runs. If
Node's own fetch ran first on Node 22, the global dispatcher comes from
Node's bundled undici 6, which calls the older handler methods, so a
dispatcher from the locked undici takes its place there.
- A `dispatcher` passed to `fetch` bypasses the global one, so the three
pools that `fetch` uses directly are wrapped too: provider calls
(`providerModelFactory`), the bash AI proxy and server updates.
- Model discovery, Bedrock discovery and MCP icons use `undici.request`,
which never decodes `Content-Encoding`, so they need nothing.
- `BROTLI_FIXED_NODE_RELEASES` moves from `src/cli/nodeVersion.ts` to
`src/node/utils/nodeBrotliFix.ts`, so the CLI warning and the guard
share one table. The Docker build's Node check now copies both compiled
files with their `dist/` paths, because `nodeVersion.js` requires the
table by a relative path.

Not covered: `google-auth-library` (Vertex sign-in) fetches through
`node-fetch`, which decodes Brotli itself. It talks only to Google's
token endpoints.

## Validation

- `brotliResponseGuard.test.ts` runs real undici `fetch` against a local
server. Without the interceptor the Brotli body decodes; with it the
request fails. Each test fails when the refusal or the header rewrite is
removed. The 103 Early Hints test failed with `ERR_ASSERTION` on the
`DecoratorHandler` version.
- The compiled guard on Node 22.19.0, Node 24.21.0 and Electron 44.5.1,
each with and without a `fetch` before the install: gzip and 103 + gzip
decode, Brotli is refused. Before the fix, Node 22.19.0 with an earlier
`fetch` failed every request (`invalid onError method`).
- The Docker Node check, run on the compiled files in that layout: Node
22.23.4 and 24.22.1 pass; 22.19.0, 24.21.0 and 26.8.1 fail with the CVE
warning. With `nodeVersion.js` copied alone, as before, it fails with
`Cannot find module '../node/utils/nodeBrotliFix'` (the first
merge-queue run).
- On Electron 44.5.1 (Node 24.21.0), with the compiled main-process
modules: before `new ServiceContainer(...)`, a Brotli response decoded.
After it, plain `fetch` and `fetchDistTags` (the server-update pool)
refused it, gzip responses still worked, and all three wrapped pools
were composed.

## Risks

Low. A server that ignores `Accept-Encoding` and sends Brotli anyway now
fails with "Refused a Brotli-encoded response (CVE-2026-111497)". The
guard is off under Bun and on fixed Node, so `xum server` on a current
Node and the Docker image do not change.

##### [v44.10.1](https://github.com/electron/electron/releases/tag/v44.10.1)

### Release Notes for v44.10.1

#### Fixes

- Fixed DevTools "Save" prompting for a location every time instead of reusing the previously chosen file. [#55484](electron/electron#55484)
  - Fixed DevTools "Save As" using the old file and Linux cancels treated as saved.
- Fixed `webContents.adjustSelection()` ignoring the `end` option. [#55461](electron/electron#55461) <sup>(Also in [45](electron/electron#55462), [46](https://github.com/electron/electron/pull/55463))</sup>

#### Performance Improvements

- Improved performance of `net.fetch()` requests without a body. [#55445](electron/electron#55445) <sup>(Also in [43](electron/electron#55447), [45](electron/electron#55446), [46](https://github.com/electron/electron/pull/55444))</sup>
- Improved performance of repeated `net.fetch()` calls for `file:` URLs. [#55458](electron/electron#55458) <sup>(Also in [45](electron/electron#55459), [46](https://github.com/electron/electron/pull/55457))</sup>

#### Other Changes

- Backported fixes from upstream Chromium, Dawn, Skia and V8. [#55492](electron/electron#55492)
##### [v44.10.0](https://github.com/electron/electron/releases/tag/v44.10.0)

### Release Notes for v44.10.0

#### Features

- Added filtering options to `session.registerPreloadScript` - `matches`, `excludeMatches`, `includeGlobs`, `excludeGlobs`, `matchOriginAsFallback`. [#55182](electron/electron#55182) <sup>(Also in [45](https://github.com/electron/electron/pull/55181))</sup>

#### Fixes

- Fixed a crash on Linux when a D-Bus method call was made on a disconnected bus. [#55290](electron/electron#55290) <sup>(Also in [45](electron/electron#55292), [46](https://github.com/electron/electron/pull/55289))</sup>
- Fixed a main process crash when `onSendHeaders` observed Blob uploads. [#55168](electron/electron#55168) <sup>(Also in [45](https://github.com/electron/electron/pull/55169))</sup>
- Fixed `app.getLoginItemSettings()` not finding login items on Windows when the executable path contains spaces. [#55207](electron/electron#55207) <sup>(Also in [45](https://github.com/electron/electron/pull/54419))</sup>
- Fixed Europe/London and Europe/Dublin time zone names showing as "GMT+00:00" in winter by updating ICU to tzdata 2026e. [#55335](electron/electron#55335)
- Fixed File System Access blocklist gaps for `.git/hooks` writes and hypervisor UNC shares. [#55330](electron/electron#55330)
- Fixed handling of malformed asar archives whose size fields do not match the file length. [#55176](electron/electron#55176) <sup>(Also in [43](electron/electron#55179), [45](https://github.com/electron/electron/pull/55175))</sup>
- Fixed inconsistent handling of asar archive paths between the main process and child processes. [#55183](electron/electron#55183) <sup>(Also in [43](electron/electron#55185), [45](https://github.com/electron/electron/pull/55184))</sup>
- Fixed `Menu.popup()` on macOS sometimes not showing a menu after another closed. [#55325](electron/electron#55325) <sup>(Also in [45](electron/electron#55326), [46](https://github.com/electron/electron/pull/55324))</sup>
- Fixed MV3 extension events not arriving to background service workers. [#55152](electron/electron#55152) <sup>(Also in [43](electron/electron#55153), [45](https://github.com/electron/electron/pull/55154))</sup>
- Fixed paste hanging indefinitely on Linux X11 until the app was restarted. [#55327](electron/electron#55327)
- Fixed `protocol.registerSource` schemes not applying the same fetch rules as `protocol.handle` schemes. [#55177](electron/electron#55177) <sup>(Also in [45](https://github.com/electron/electron/pull/55178))</sup>
- Fixed `utilityProcess` not emitting an `exit` event when the app quit while the process was still launching. [#55273](electron/electron#55273) <sup>(Also in [43](electron/electron#55272), [45](electron/electron#55274), [46](https://github.com/electron/electron/pull/55264))</sup>

#### Other Changes

- Updated Chromium to 152.0.7977.169. [#55033](electron/electron#55033)
- Updated Node.js to v24.22.1. [#55162](electron/electron#55162)
##### [v44.9.3](https://github.com/electron/electron/releases/tag/v44.9.3)

### Release Notes for v44.9.3

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, PDFium, Skia and V8. [#55149](electron/electron#55149)
##### [v44.9.2](https://github.com/electron/electron/releases/tag/v44.9.2)

### Release Notes for v44.9.2
##### [v44.9.1](https://github.com/electron/electron/releases/tag/v44.9.1)

### Release Notes for v44.9.1

> \[!NOTE]
> This release contains the fix for <GHSA-jr5w-w6x2-84p9>, the mitigation for compromised eMudhra intermediate certificates
##### [v44.9.0](https://github.com/electron/electron/releases/tag/v44.9.0)

### Release Notes for v44.9.0

#### Features

- Added app shims on macOS to show windows under another app's Dock icon. [#55073](electron/electron#55073) <sup>(Also in [45](https://github.com/electron/electron/pull/55072))</sup>

#### Fixes

- Fixed link-opened windows not using the opener's session and `webPreferences`. [#55048](electron/electron#55048) <sup>(Also in [42](electron/electron#55050), [43](electron/electron#55049), [45](https://github.com/electron/electron/pull/55051))</sup>
- Fixed `setCertificateVerifyProc` occasionally not being applied to a request issued concurrently with the first request to a host. [#55046](electron/electron#55046) <sup>(Also in [42](electron/electron#55054), [43](electron/electron#55047), [45](https://github.com/electron/electron/pull/55045))</sup>
##### [v44.8.0](https://github.com/electron/electron/releases/tag/v44.8.0)

### Release Notes for v44.8.0

#### Features

- Added support for `Notification` action buttons on Linux. [#54890](electron/electron#54890) <sup>(Also in [45](https://github.com/electron/electron/pull/54889))</sup>

#### Fixes

- Fixed mouse cursor missing over native dialogs in certain scenarios on Windows. [#54987](electron/electron#54987)
- Fixed `net.fetch` and `session.fetch` failing permanently with `net::ERR_FAILED` after the Network Service process restarts. [#54909](electron/electron#54909) <sup>(Also in [42](electron/electron#54925), [43](electron/electron#54908), [45](https://github.com/electron/electron/pull/54910))</sup>
- Fixed `utilityProcess` dropping messages posted with `process.parentPort.postMessage()` right before the process exits. [#54960](electron/electron#54960) <sup>(Also in [42](electron/electron#55000), [43](electron/electron#54962), [45](https://github.com/electron/electron/pull/54956))</sup>
- Fixed `win.isFullScreen()` being stale in fullscreen events on Windows. [#55009](electron/electron#55009) <sup>(Also in [45](https://github.com/electron/electron/pull/55008))</sup>

#### Other Changes

- Backported fixes from upstream Chromium and V8. [#55034](electron/electron#55034)
- Updated Chromium to 152.0.7977.167. [#54928](electron/electron#54928)
- Updated Node.js to v24.22.0. [#55004](electron/electron#55004)
##### [v44.7.2](https://github.com/electron/electron/releases/tag/v44.7.2)

### Release Notes for v44.7.2

#### Fixes

- Fixed an issue where clicks posted to a background app were dropped on macOS. [#54819](electron/electron#54819) <sup>(Also in [45](https://github.com/electron/electron/pull/54818))</sup>
- Fixed interrupted macOS updates leaving a broken app behind. [#54844](electron/electron#54844) <sup>(Also in [45](https://github.com/electron/electron/pull/54843))</sup>

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, PDFium and V8. [#54898](electron/electron#54898)

#### Documentation

- Documentation changes: [#54880](electron/electron#54880)
##### [v44.7.1](https://github.com/electron/electron/releases/tag/v44.7.1)

### Release Notes for v44.7.1

#### Fixes

- Fixed a crash when starting without an available display server on Linux. [#54794](electron/electron#54794) <sup>(Also in [45](https://github.com/electron/electron/pull/54781))</sup>
- Fixed a Linux crash creating a window with a menu bar when GTK failed to load. [#54859](electron/electron#54859) <sup>(Also in [45](https://github.com/electron/electron/pull/54846))</sup>
- Fixed a `WebContentsView` that was removed with `removeChildView()` and re-added with `addChildView()` staying hidden behind its sibling views on Linux. [#54798](electron/electron#54798)
- Fixed asar archives in non-ASCII folders failing to load on Linux. [#54849](electron/electron#54849) <sup>(Also in [45](https://github.com/electron/electron/pull/54848))</sup>
- Fixed renderer crashes during garbage collection inside ShadowRealms. [#54865](electron/electron#54865) <sup>(Also in [45](https://github.com/electron/electron/pull/54864))</sup>

#### Other Changes

- Refactored mouse forwarding on Windows to fix `setIgnoreMouseEvents(true, { forward: true })` related issues. [#54802](electron/electron#54802) <sup>(Also in [45](https://github.com/electron/electron/pull/54803))</sup>
- Updated Chromium to 152.0.7977.149. [#54085](electron/electron#54085)
##### [v44.7.0](https://github.com/electron/electron/releases/tag/v44.7.0)

### Release Notes for v44.7.0

#### Features

- The macOS `autoUpdater` now streams update downloads to disk, resumes an interrupted download on the next check instead of starting over, and applies a binary delta when the update feed offers one for the running version. [#54204](electron/electron#54204)

#### Fixes

- Fixed an uncatchable TypeError in `net.fetch` when receiving response headers with non-ASCII characters, and preserved multiple Set-Cookie headers. [#54672](electron/electron#54672)

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. [#54666](electron/electron#54666)
- Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. [#54657](electron/electron#54657)
##### [v44.6.0](https://github.com/electron/electron/releases/tag/v44.6.0)

### Release Notes for v44.6.0

#### Features

- Added the experimental `protocol.registerSource()` to serve a custom scheme from directories on disk without a JavaScript handler. [#54522](electron/electron#54522) <sup>(Also in [45](https://github.com/electron/electron/pull/54521))</sup>

#### Fixes

- Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. [#54596](electron/electron#54596)
- Fixed a crash on `navigator.usb.requestDevice()` in in-memory sessions. [#54616](electron/electron#54616) <sup>(Also in [45](https://github.com/electron/electron/pull/54615))</sup>
- Fixed `webview.findInPage()` hanging when the host page also has an iframe. [#54586](electron/electron#54586) <sup>(Also in [43](electron/electron#54584), [45](https://github.com/electron/electron/pull/54585))</sup>
- Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. [#54623](electron/electron#54623)

#### Documentation

- Documentation changes: [#54589](electron/electron#54589)