This repository was archived by the owner on Oct 24, 2026. It is now read-only.
Repository navigation
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the engine requirement from end-of-life Node 14.x to patched Node 22.23.4+ within the 22.x line. Updates Puppeteer 8.0.0 to 24.43.1, which selects Chrome 148.0.7778.97 with the fixed Brotli cfa184a revision. Host Node alone would not fix the separately installed browser decoder. Replaces removed page.waitForTimeout with node:timers/promises while preserving the one-minute polling delay.
npm regenerated the existing version-1 lockfile; Express, dotenv and discord-webhook-node retain their locked versions. No blanket application upgrade was performed.
Validation: npm ci --ignore-scripts passed. JavaScript syntax checks and module loading passed on exact Node 22.23.4, and the replacement delay API passed a local check. git diff --check and JSON parsing passed. The Chrome binary reports the expected version, but browser launch is blocked by executor IPC restrictions, so browser behavior and the live scraper are not verified. No CoinMarketCap scraping or Discord messages were sent. This remains draft pending browser/deployment compatibility validation.
Rollout requires installing the new browser artifact and deploying/restarting on an actually patched Node build. The engine field is advisory, not proof of deployed Node selection. Existing cached Chrome/Chromium executables must be replaced and restarted independently.
Sources:
This is a scoped CVE-2026-111497 fix, not a claim that the repository, other dependencies or hosted service has no other security issues.