⚙️ setup: align Node.js runtime policy with 26 default (22/24/26 support)

[Copilot]

This aligns runtime/setup policy with the supported Node.js versions and removes drift between runtime, Docker, CI, and docs. Default runtime is now Node.js 26, while compatibility remains 22/24/26.

• Runtime compatibility policy

  • Added explicit Node/Bun engine constraints in package.json for supported runtime/toolchain ranges.
  • Added .nvmrc defaulting local development runtime to Node.js 26.

• Docker runtime alignment

  • Switched container base runtime to Node.js 26 Alpine.
  • Kept Bun-based app execution by sourcing the Bun binary from the official Bun image into the Node base image.

• CI support matrix

  • Added a dedicated CI workflow with Node.js matrix coverage for 22, 24, and 26.
  • Ensures lint/typecheck/test run under each supported Node version while preserving Bun toolchain usage.

• Documentation consistency

  • Updated README runtime prerequisites to reflect supported Node versions (22/24/26) with 26 as default.
  • Updated Docker section wording to reflect Node.js 26 Alpine runtime base.

ARG NODE_VERSION=26-alpine3.22
ARG BUN_VERSION=1.3.9

FROM oven/bun:${BUN_VERSION}-alpine AS bun
FROM node:${NODE_VERSION} AS base
COPY --from=bun /usr/local/bin/bun /usr/local/bin/bun

Original prompt

Copy the setup/runtime policy alignment from wgtechlabs/unthread-discord-bot PR #122 into this repository, using dev as the source/base branch and opening the resulting PR against dev.

Source PR to mirror conceptually: wgtechlabs/unthread-discord-bot#122

Goal: align the WhatsApp bot repository with the Node.js support policy:

1. Production runtime default must be Node.js 26.
2. Docker build/runtime base must use Node.js 26.
3. CI matrix must validate each supported Node.js version: 22, 24, and 26.
4. package.json / source/runtime compatibility should support Node.js 22, 24, and 26, with Node.js 26 as the default runtime.
5. Update docs to remove contradictory statements, such as Node 20+ only or Node 26 as future support, and align all relevant docs with the 22/24/26 policy.
6. Keep Bun/toolchain statements consistent with repository conventions if Bun is used.

Reference changes in the Discord PR:

• Dockerfile changed from Node 24 Alpine to Node 26 Alpine (ARG NODE_VERSION=26-alpine3.22) and updated comments to say Node.js 26 Alpine with security patches.
• Integration test naming/content was updated from Node 24-specific to Node 22+ policy:
  • Rename any equivalent node24-* integration test file to node22-* if applicable.
  • Change descriptions/comments from Node 24-specific to Node 22+.
  • Change skipIf thresholds from < 24 to < 22 where tests should run for all supported Node versions.
  • Change version assertions from >= 20 to >= 22.
  • Update stale OpenSSL/npm comments to OpenSSL 3.x and npm v10+ where applicable.

Likely files to inspect/update as applicable in unthread-whatsapp-bot:

• package.json (engines, scripts/runtime notes)
• Dockerfile and any Docker-related config
• .github/workflows/ci.yml or equivalent workflow files (setup-node matrix should include 22, 24, 26 and use the correct runtime per matrix entry)
• README.md, CONTRIBUTING.md, docs/installation.md, or equivalent docs
• Any integration tests or runtime policy tests that mention Node 20, Node 24-only, or future Node 26 support

Implementation expectations:

• Keep the change minimal and scoped to setup/runtime version policy alignment.
• Preserve repository conventions and formatting.
• Use Clean Commit style for commit messages, e.g. ⚙️ setup: align Node.js support policy or another valid Clean Commit message.
• PR title should use Clean Commit style and clearly mention Node 26 as default runtime.
• PR body should include a concise summary of changed areas and why, plus any testing performed.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: I want you to copy this PR: @wgtechlabs/unthread-discord-bot/pull/122 basically the setup. For production runtime use Node.js 26, for Docker build runtime use Node.js 26, for CI matrix make sure that it uses correct runtime for each supported node.js versions which is 22, 24, and 26.

Delegate this task into cloud coding agent and submit this PR to the dev branch of unthread-whatsapp-bot. The base source code should be coming from the dev branch as well.

Assistant: I’ve delegated the task to the cloud coding agent to create a PR against dev in wgtechlabs/unthread-whatsapp-bot, using dev as the base source branch, and instructed it to mirror the Node.js 22/24/26 support policy with Node.js 26 as the default production and Docker runtime.

This pull request was created from Copilot chat.

[Copilot]

Pull request overview

Aligns this repository’s setup/runtime policy so local dev, Docker runtime, CI validation, and docs consistently reflect support for Node.js 22/24/26 with Node.js 26 as the default (while continuing to use Bun as the toolchain/runtime).

Changes:

• Document Node.js 22/24/26 support (default 26) in the README and add .nvmrc defaulting to 26.
• Add engines constraints in package.json and update Docker to use a Node.js 26 Alpine base while sourcing Bun from the official Bun image.
• Add a CI workflow that runs lint/typecheck/tests with a Node.js version matrix (22/24/26) and a pinned Bun version.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
README.md	Updates prerequisites and Docker notes to match the Node 22/24/26 policy with 26 as default.
package.json	Adds Node/Bun engine constraints to formalize supported runtime/toolchain ranges.
Dockerfile	Switches base image to Node 26 Alpine and copies in Bun for the app toolchain; updates healthcheck implementation.
.nvmrc	Sets Node 26 as the default local development runtime.
.github/workflows/ci.yml	Adds a CI workflow intended to validate under Node 22/24/26 while using Bun.

[github-actions]

🔧 Container Build Complete - PR Build

Build Status: ✅ Success
Flow Type: pr
Description: Feature development and testing

---

📦 Pull Image

Docker Hub: docker pull wgtechlabs/unthread-whatsapp-bot:pr-0ca8e1a

GHCR: docker pull ghcr.io/wgtechlabs/unthread-whatsapp-bot:pr-0ca8e1a

---

📋 Build Details

Property	Value
Flow Type	pr
Commit	a4bcdc5
Registry	Docker Hub + GHCR

🏷️ Image Tags

• wgtechlabs/unthread-whatsapp-bot:pr-0ca8e1a
• wgtechlabs/unthread-whatsapp-bot:pr
• ghcr.io/wgtechlabs/unthread-whatsapp-bot:pr-0ca8e1a
• ghcr.io/wgtechlabs/unthread-whatsapp-bot:pr

---

🔍 Testing Your Changes

1. Pull the image using one of the commands above
2. Run the container with your test configuration
3. Verify the changes work as expected
4. Report any issues in this PR

---

🚀 Quick Start

# Pull and run the container
Docker Hub: docker pull wgtechlabs/unthread-whatsapp-bot:pr-0ca8e1a
docker run <your-options> <image>

---

---

🔒 Security Scan Results

📋 Pre-Build Security Checks

✅ Source Code Scan: 4 vulnerabilities found
✅ Dockerfile Scan: 0 misconfigurations found

🐳 Container Image Vulnerabilities

Severity	Count
🟠 High	4
Total	4

📋 View Vulnerability Details

Node.js

• 🟠 CVE-2026-42033 (HIGH) - axios
  • axios: Axios: HTTP Transport Hijacking via Prototype Pollution
  • Fixed in: 1.15.1, 0.31.1
• 🟠 CVE-2026-42035 (HIGH) - axios
  • axios: Axios: Arbitrary HTTP header injection via prototype pollution
  • Fixed in: 1.15.1, 0.31.1
• 🟠 CVE-2026-42043 (HIGH) - axios
  • axios: Axios: NO_PROXY bypass via crafted URL
  • Fixed in: 1.15.1, 0.31.1
• 🟠 CVE-2026-42264 (HIGH) - axios
  • Axios is a promise based HTTP client for the browser and Node.js. From ...
  • Fixed in: 1.15.2

📊 Detailed Security Reports

View detailed vulnerability reports in the GitHub Security tab.

---

_{🤖 Powered by Container Build Flow Action vv1.8.0
💻 with ❤️ by Waren Gonzaga under WG Technology Labs, and Him 🙏}