enhance: Set default Node.js version to v26 (#17623)

* enhance: Set default Node.js version to v26

* fix

* Update Changelog

* fix types

* drop node v22

* update changelog

* fix test

* update

* fix test

* fix test

* Revert "drop node v22"

This reverts commit bb4e011628.

* fix changelog

* attempt to fix test

* attempt to fix test

* fix: update re2 that supports node 26

* attempt to fix test

* attempt to fix test

* run pnpm dedupe

* restore 2fa e2e

* refactor

* attempt to fix test

* attempt to fix test

* run pnpm dedupe

* attempt to fix test

.node-version

@@ -1 +1 @@
-22.23.1
+26.4.0

CHANGELOG.md

@@ -3,12 +3,17 @@
 **今回のリリースではMisskeyの各種動作要件が変更されます。必ずアップグレード前にお使いの環境をご確認ください。**
 
 ### Note
+
+**今回のリリースではMisskeyの各種動作要件が変更されます。必ずアップグレード前にお使いの環境をご確認ください。**
+
 - センシティブメディアの判定 (NSFW検出) が、本体に内蔵された nsfwjs による推論から、外部サービス [sensitive-detector](https://github.com/misskey-dev/sensitive-detector) への HTTP 呼び出し方式に変更されました。
 	- これに伴い、本体から `nsfwjs` / `@tensorflow/tfjs` / `@tensorflow/tfjs-node` および同梱の NSFW 判定モデルが削除され、インストール要件 (ネイティブ ML スタック) が緩和されました。
 	- **センシティブ判定機能を利用しているサーバーは対応が必要です。** 別途 [sensitive-detector](https://github.com/misskey-dev/sensitive-detector) サービスを立ち上げ、コントロールパネルの「モデレーション > センシティブなメディアの検出」で接続先 URL を設定してください。接続先が未設定の場合、センシティブ判定は行われません (すべて非センシティブ扱い)。
 	- 画像の正規化・動画フレームの抽出・しきい値判定・集約は引き続き本体側で行われ、外部サービスには正規化済み画像の推論のみを委譲します。
+- Node.js v24, v26 をサポートしました。**Node.js v22 でも動作しますが、次のリリースで v22 のサポートを終了する予定です。**
+  - Node.js のセキュリティアップデートに伴い、最低動作バージョンを 22.22.2 / 24.17.0 / 26.4.0 に引き上げました。
+  - Docker Image は Node.js 26.4.0-trixie に更新されています。
 - バックエンドで画像処理に用いているライブラリ sharp のシステム要件の変更により、**SSE4.2 命令セットをサポートしていない x86_64 CPU では Misskey が正しく動作しなくなります**。仮想マシンに Misskey をデプロイしている場合や、古いハードウェアをお使いの場合は、アップデート前にお使いの環境をご確認ください。
-- Node.jsの最低サポートバージョンを 22.22.2 に引き上げました。これより古いバージョンの Node.js では Misskey が起動しません。
 
 ### General
 - Feat: コントロールパネルから二要素認証を解除できるように
@@ -19,7 +24,8 @@
 
 ### Server
 - Enhance: センシティブメディアの判定を外部サービス ([sensitive-detector](https://github.com/misskey-dev/sensitive-detector)) に分離し、`nsfwjs` / `@tensorflow/tfjs(-node)` の同梱と NSFW 判定モデルを廃止 (#16804)
-
+- Enhance: Node.js 22.23.0以降、24.17.0以降、26.4.0以降をサポートするように
+- Enhance: Docker Image の Node.js を 26.4.0 に、Debian を trixie (v13) に更新
 
 ## 2026.6.0
 

Dockerfile

@@ -1,6 +1,6 @@
 # syntax = docker/dockerfile:1.23
 
-ARG NODE_VERSION=22.22.2-bookworm
+ARG NODE_VERSION=26.4.0-trixie
 
 # build assets & compile TypeScript
 

package.json

@@ -66,7 +66,7 @@
 		"@eslint/js": "9.39.4",
 		"@misskey-dev/eslint-plugin": "2.1.0",
 		"@types/js-yaml": "4.0.9",
-		"@types/node": "24.13.2",
+		"@types/node": "26.0.0",
 		"@typescript-eslint/eslint-plugin": "8.61.1",
 		"@typescript-eslint/parser": "8.61.1",
 		"@typescript/native-preview": "7.0.0-dev.20260426.1",

packages/backend/package.json

@@ -4,7 +4,7 @@
 	"private": true,
 	"type": "module",
 	"engines": {
-		"node": "^22.22.2 || ^24.10.0 || ^26.4.0"
+		"node": "^22.22.2 || ^24.17.0 || ^26.4.0"
 	},
 	"scripts": {
 		"start": "pnpm compile-config && node ./built/entry.js",
@@ -160,7 +160,7 @@
 		"@types/jsonld": "1.5.15",
 		"@types/mime-types": "3.0.1",
 		"@types/ms": "2.1.0",
-		"@types/node": "24.13.2",
+		"@types/node": "26.0.0",
 		"@types/nodemailer": "8.0.1",
 		"@types/pg": "8.20.0",
 		"@types/qrcode": "1.5.6",
@@ -181,7 +181,7 @@
 		"@typescript-eslint/parser": "8.61.1",
 		"@vitest/coverage-v8": "4.1.9",
 		"aws-sdk-client-mock": "4.1.0",
-		"cbor": "10.0.12",
+		"cbor2": "2.3.0",
 		"cross-env": "10.1.0",
 		"eslint-plugin-import": "2.32.0",
 		"execa": "9.6.1",

packages/backend/src/core/AiService.ts

@@ -137,7 +137,8 @@ export class AiService {
 		try {
 			const form = new FormData();
 			for (let i = 0; i < chunk.length; i++) {
-				form.append(`image${i}`, new Blob([chunk[i]], { type: 'image/png' }), `${i}.png`);
+				const image = Uint8Array.from(chunk[i]);
+				form.append(`image${i}`, new Blob([image], { type: 'image/png' }), `${i}.png`);
 			}
 
 			// Content-Type は FormData から boundary 付きで自動設定させるため、手動設定はしない。

packages/backend/test/e2e/2fa.ts

@@ -7,7 +7,7 @@ process.env.NODE_ENV = 'test';
 
 import * as assert from 'assert';
 import * as crypto from 'node:crypto';
-import cbor from 'cbor';
+import { encode as encodeToCbor } from 'cbor2';
 import * as OTPAuth from 'otpauth';
 import { loadConfig } from '@/config.js';
 import { api, signup, sendEnvUpdateRequest } from '../utils.js';
@@ -61,7 +61,7 @@ describe('2要素認証', () => {
 	const keyDoneParam = (param: {
 		token: string,
 		keyName: string,
-		credentialId: Buffer,
+		credentialId: Uint8Array,
 		creationOptions: PublicKeyCredentialCreationOptionsJSON,
 	}): {
 		token: string,
@@ -70,10 +70,10 @@ describe('2要素認証', () => {
 		credential: RegistrationResponseJSON,
 	} => {
 		// A COSE encoded public key
-		const credentialPublicKey = cbor.encode(new Map<number, unknown>([
+		const credentialPublicKey = encodeToCbor(new Map<number, unknown>([
 			[-1, coseEc2CrvP256],
-			[-2, Buffer.from(coseEc2X, 'hex')],
+			[-2, Uint8Array.from(Buffer.from(coseEc2X, 'hex'))],
-			[-3, Buffer.from(coseEc2Y, 'hex')],
+			[-3, Uint8Array.from(Buffer.from(coseEc2Y, 'hex'))],
 			[1, coseKtyEc2],
 			[2, coseKid],
 			[3, coseAlgEs256],
@@ -85,21 +85,23 @@ describe('2要素認証', () => {
 		credentialIdLength.writeUInt16BE(param.credentialId.length, 0);
 		const authData = Buffer.concat([
 			rpIdHash(), // rpIdHash(32)
-			Buffer.from([0x45]), // flags(1)
+			new Uint8Array([0x45]), // flags(1)
-			Buffer.from([0x00, 0x00, 0x00, 0x00]), // signCount(4)
+			new Uint8Array(4), // signCount(4)
-			Buffer.from([0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]), // AAGUID(16)
+			new Uint8Array(16), // AAGUID(16)
 			credentialIdLength,
 			param.credentialId,
 			credentialPublicKey,
 		]);
 
+		const credentialIdBase64url = Buffer.from(param.credentialId).toString('base64url');
+
 		return {
 			password,
 			token: param.token,
 			name: param.keyName,
 			credential: <RegistrationResponseJSON>{
-				id: param.credentialId.toString('base64url'),
+				id: credentialIdBase64url,
-				rawId: param.credentialId.toString('base64url'),
+				rawId: credentialIdBase64url,
 				response: <AuthenticatorAttestationResponseJSON>{
 					clientDataJSON: Buffer.from(JSON.stringify({
 						type: 'webauthn.create',
@@ -107,11 +109,11 @@ describe('2要素認証', () => {
 						origin: config.scheme + '://' + config.host,
 						androidPackageName: 'org.mozilla.firefox',
 					}), 'utf-8').toString('base64url'),
-					attestationObject: cbor.encode({
+					attestationObject: Buffer.from(encodeToCbor({
 						fmt: 'none',
 						attStmt: {},
-						authData,
+						authData: new Uint8Array(authData),
-					}).toString('base64url'),
+					})).toString('base64url'),
 				},
 				clientExtensionResults: {},
 				type: 'public-key',

packages/backend/test/utils.ts

@@ -9,10 +9,10 @@ import { basename, isAbsolute } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { inspect } from 'node:util';
 import WebSocket, { ClientOptions } from 'ws';
-import fetch, { RequestInit, type Headers } from 'node-fetch';
+import fetch, { Blob, FormData } from 'node-fetch';
+import type { RequestInit, Headers, Response } from 'node-fetch';
 import * as htmlParser from 'node-html-parser';
 import { DataSource } from 'typeorm';
-import { type Response } from 'node-fetch';
 import Fastify from 'fastify';
 import { entities } from '@/postgres.js';
 import { loadConfig } from '@/config.js';

packages/frontend-builder/package.json

@@ -11,7 +11,7 @@
 	},
 	"devDependencies": {
 		"@types/estree": "1.0.9",
-		"@types/node": "24.13.2",
+		"@types/node": "26.0.0",
 		"@typescript-eslint/eslint-plugin": "8.61.1",
 		"@typescript-eslint/parser": "8.61.1",
 		"rollup": "4.62.2"

packages/frontend-embed/package.json

@@ -34,7 +34,7 @@
 		"@testing-library/vue": "8.1.0",
 		"@types/estree": "1.0.9",
 		"@types/micromatch": "4.0.10",
-		"@types/node": "24.13.2",
+		"@types/node": "26.0.0",
 		"@types/punycode.js": "npm:@types/punycode@2.1.4",
 		"@types/tinycolor2": "1.4.6",
 		"@types/ws": "8.18.1",

packages/frontend-shared/package.json

@@ -8,7 +8,7 @@
 		"lint": "pnpm typecheck && pnpm eslint"
 	},
 	"devDependencies": {
-		"@types/node": "24.13.2",
+		"@types/node": "26.0.0",
 		"@types/tinycolor2": "1.4.6",
 		"@typescript-eslint/eslint-plugin": "8.61.1",
 		"@typescript-eslint/parser": "8.61.1",

packages/frontend/package.json

@@ -99,7 +99,7 @@
 		"@types/insert-text-at-cursor": "0.3.2",
 		"@types/matter-js": "0.20.2",
 		"@types/micromatch": "4.0.10",
-		"@types/node": "24.13.2",
+		"@types/node": "26.0.0",
 		"@types/punycode.js": "npm:@types/punycode@2.1.4",
 		"@types/sanitize-html": "2.16.1",
 		"@types/seedrandom": "3.0.8",

packages/frontend/test/init.ts

@@ -7,18 +7,46 @@ import { vi } from 'vitest';
 import createFetchMock from 'vitest-fetch-mock';
 import type { Ref } from 'vue';
 import { ref } from 'vue';
-// Set i18n
-import locales from 'i18n';
-import { updateI18n } from '@/i18n.js';
 
 const fetchMocker = createFetchMock(vi);
 fetchMocker.enableMocks();
 
-updateI18n(locales['en-US']);
-
 // XXX: misskey-js panics if WebSocket is not defined
 vi.stubGlobal('WebSocket', class WebSocket extends EventTarget { static CLOSING = 2; });
 
+// XXX: localStorageがない場合がある
+const localStorageMock = (() => {
+	const store = new Map<string, string>();
+	return {
+		getItem(key: string) {
+			return store.get(key) ?? null;
+		},
+		setItem(key: string, value: string) {
+			store.set(key, value);
+		},
+		removeItem(key: string) {
+			store.delete(key);
+		},
+		clear() {
+			store.clear();
+		},
+	};
+})();
+vi.stubGlobal('localStorage', localStorageMock);
+
+// 中でlocalStorageを使うので上と順番を変えてはいけない
+const { default: locales } = await import('i18n');
+
+fetchMocker.mockIf(/^\/assets\/locales\/.*\.json$/, async () => {
+	return {
+		status: 200,
+		body: JSON.stringify(locales['en-US']),
+	};
+});
+
+const { updateI18n } = await import('@/i18n.js');
+updateI18n(locales['en-US']);
+
 export const preferState: Record<string, unknown> = {
 
 	// なんかtestがうまいこと動かないのでここに書く

packages/frontend/vite.config.ts

@@ -1,5 +1,4 @@
 /// <reference types="vitest/config" />
-
 import path from 'path';
 import pluginVue from '@vitejs/plugin-vue';
 import pluginGlsl from 'vite-plugin-glsl';
@@ -265,6 +264,7 @@ export function getConfig(): UserConfig {
 
 		test: {
 			environment: 'happy-dom',
+			setupFiles: ['./test/init.ts'],
 			deps: {
 				optimizer: {
 					web: {

packages/i18n/package.json

@@ -29,7 +29,7 @@
 	],
 	"devDependencies": {
 		"@types/js-yaml": "4.0.9",
-		"@types/node": "24.13.2",
+		"@types/node": "26.0.0",
 		"@typescript-eslint/eslint-plugin": "8.61.1",
 		"@typescript-eslint/parser": "8.61.1",
 		"chokidar": "5.0.0",

packages/icons-subsetter/package.json

@@ -11,7 +11,7 @@
 		"lint": "pnpm typecheck && pnpm eslint"
 	},
 	"devDependencies": {
-		"@types/node": "24.13.2",
+		"@types/node": "26.0.0",
 		"@types/wawoff2": "1.0.2",
 		"@typescript-eslint/eslint-plugin": "8.61.1",
 		"@typescript-eslint/parser": "8.61.1"

packages/misskey-bubble-game/package.json

@@ -25,7 +25,7 @@
 	},
 	"devDependencies": {
 		"@types/matter-js": "0.20.2",
-		"@types/node": "24.13.2",
+		"@types/node": "26.0.0",
 		"@types/seedrandom": "3.0.8",
 		"@typescript-eslint/eslint-plugin": "8.61.1",
 		"@typescript-eslint/parser": "8.61.1",

packages/misskey-js/generator/package.json

@@ -8,7 +8,7 @@
 	},
 	"devDependencies": {
 		"@readme/openapi-parser": "6.1.3",
-		"@types/node": "24.13.2",
+		"@types/node": "26.0.0",
 		"@typescript-eslint/eslint-plugin": "8.61.1",
 		"@typescript-eslint/parser": "8.61.1",
 		"openapi-types": "12.1.3",

packages/misskey-js/package.json

@@ -38,7 +38,7 @@
 	},
 	"devDependencies": {
 		"@microsoft/api-extractor": "7.58.9",
-		"@types/node": "24.13.2",
+		"@types/node": "26.0.0",
 		"@typescript-eslint/eslint-plugin": "8.61.1",
 		"@typescript-eslint/parser": "8.61.1",
 		"@vitest/coverage-v8": "4.1.9",

packages/misskey-reversi/package.json

@@ -24,7 +24,7 @@
 		"lint": "pnpm typecheck && pnpm eslint"
 	},
 	"devDependencies": {
-		"@types/node": "24.13.2",
+		"@types/node": "26.0.0",
 		"@typescript-eslint/eslint-plugin": "8.61.1",
 		"@typescript-eslint/parser": "8.61.1",
 		"esbuild": "0.28.1",

pnpm-workspace.yaml

@@ -15,6 +15,7 @@ allowBuilds:
   '@nestjs/core': true
   '@parcel/watcher': true
   '@sentry/profiling-node': true
+  '@sentry-internal/node-cpu-profiler': true
   '@sentry/node-cpu-profiler': true
   bufferutil: true
   canvas: true

scripts/changelog-checker/package-lock.json

@@ -9,7 +9,7 @@
       "version": "1.0.0",
       "devDependencies": {
         "@types/mdast": "4.0.4",
-        "@types/node": "24.13.2",
+        "@types/node": "26.0.0",
         "@vitest/coverage-v8": "4.1.9",
         "mdast-util-to-string": "4.0.0",
         "remark": "15.0.1",
@@ -505,13 +505,13 @@
       "dev": true
     },
     "node_modules/@types/node": {
-      "version": "24.13.2",
+      "version": "26.0.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.2.tgz",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.0.0.tgz",
-      "integrity": "sha512-fRa09kZTgu8o71KFcDjUFuc7F+dEbZYZmkI0mg5YBTRs0yMKjYHsq/c0urDKeDb+D5qVgXOdFcuu+DZPKOITwA==",
+      "integrity": "sha512-vf2YFi1iY9lHGwNJMs01biZFbKJkrZR1T6/MlzjhJLPdntOHLhTrDSnSVcdtvjihi4VQNlrFRIxLsDBlQpAipA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~7.18.0"
+        "undici-types": "~8.3.0"
       }
     },
     "node_modules/@types/unist": {
@@ -2074,9 +2074,9 @@
       }
     },
     "node_modules/undici-types": {
-      "version": "7.18.2",
+      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
-      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
+      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
       "dev": true,
       "license": "MIT"
     },

scripts/changelog-checker/package.json

@@ -10,7 +10,7 @@
   },
   "devDependencies": {
     "@types/mdast": "4.0.4",
-    "@types/node": "24.13.2",
+    "@types/node": "26.0.0",
     "@vitest/coverage-v8": "4.1.9",
     "mdast-util-to-string": "4.0.0",
     "remark": "15.0.1",