Pin Node to 24.20.0 everywhere

.github/actions/setup/action.yml

@@ -9,7 +9,7 @@ runs:
 
     - uses: actions/setup-node@v4
       with:
-        node-version: 24
+        node-version: 24.20.0
         cache: pnpm
 
     - run: pnpm install --frozen-lockfile

.github/workflows/native-build.yml

@@ -78,7 +78,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: 24.20.0
           cache: pnpm
 
       - run: pnpm install --frozen-lockfile
@@ -131,7 +131,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: 24.20.0
           cache: pnpm
 
       - run: pnpm install --frozen-lockfile
@@ -211,7 +211,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: 24.20.0
           cache: pnpm
 
       - run: pnpm install --frozen-lockfile
@@ -265,7 +265,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: 24.20.0
           cache: pnpm
 
       # Unlike test.yml/ci.yml, this job actually needs Electron's runtime binary — leave

.nvmrc

@@ -1 +1 @@
-24
+24.20.0

README.md

@@ -11,7 +11,7 @@
 <p align="center">
   <a href="https://github.com/brianramseyau/EveryList/pkgs/container/everylist"><img alt="GHCR" src="https://img.shields.io/badge/ghcr.io-brianramseyau%2Feverylist-blue?logo=docker"></a>
   <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-green"></a>
-  <img alt="Node" src="https://img.shields.io/badge/node-%3E%3D24-brightgreen?logo=node.js">
+  <img alt="Node" src="https://img.shields.io/badge/node-24.20.0-brightgreen?logo=node.js">
 </p>
 
 ---
@@ -101,7 +101,7 @@ The Home Assistant HACS integration lives in its own repo, [`everylist-hass`](ht
 
 ### Requirements
 
-- Node.js **24+** (see `.nvmrc`)
+- Node.js **24.20.0** (see `.nvmrc`)
 - [pnpm](https://pnpm.io) 10.x (`corepack enable` will pick up the pinned version)
 
 ### Local development

docker/Dockerfile

@@ -12,7 +12,7 @@
 # deps: full monorepo install (dev deps included) — shared by every build
 # stage below so pnpm's content-addressable store is only populated once.
 # ---------------------------------------------------------------------------
-FROM node:24-bookworm-slim AS deps
+FROM node:24.20.0-bookworm-slim AS deps
 
 # build-essential + python3: required to compile better-sqlite3's native
 # addon (node-gyp) for the workspace install below.
@@ -66,7 +66,7 @@ RUN pnpm --filter @everylist/api build
 # ancestor so pnpm treats it as the standalone project it actually is
 # (AdonisJS's own documented deploy step — see `node ace build`'s summary).
 # ---------------------------------------------------------------------------
-FROM node:24-bookworm-slim AS prod-deps
+FROM node:24.20.0-bookworm-slim AS prod-deps
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
@@ -96,7 +96,7 @@ COPY --from=build-api /app/packages/shared/dist node_modules/@everylist/shared/d
 # release: minimal runtime image — no build toolchain, no pnpm workspace,
 # just Node, s6-overlay, and the self-contained apps/api/build output.
 # ---------------------------------------------------------------------------
-FROM node:24-bookworm-slim AS release
+FROM node:24.20.0-bookworm-slim AS release
 
 ARG S6_OVERLAY_VERSION=3.2.0.2
 ARG APP_VERSION=nightly
@@ -127,7 +127,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Baked-in default account, remapped to PUID/PGID at container start by
 # docker/root/etc/cont-init.d/10-remap-user (see that script), so the
 # exact ID baked in here doesn't matter — no -u/-g pin, since
-# node:24-bookworm-slim already ships a "node" user/group at GID/UID 1000.
+# node:24.20.0-bookworm-slim already ships a "node" user/group at GID/UID 1000.
 RUN groupadd appuser && useradd -g appuser -M -s /usr/sbin/nologin appuser
 
 WORKDIR /app

docker/dev.Dockerfile

@@ -1,6 +1,6 @@
 # Local-dev-only image used by docker-compose.yml. Not published; the
 # production image is docker/Dockerfile.
-FROM node:24-bookworm-slim
+FROM node:24.20.0-bookworm-slim
 
 # build-essential + python3: required to compile better-sqlite3's native
 # addon (node-gyp) inside the container.

package.json

@@ -6,7 +6,7 @@
   "license": "MIT",
   "type": "module",
   "engines": {
-    "node": ">=24"
+    "node": ">=24.20.0 <25"
   },
   "packageManager": "pnpm@10.33.0",
   "scripts": {