[johnxie]

Refs taskade/infra#394

Why

The Dockerfile builds on node:20-slim. Node 20 is end of life, and the Node.js October 2026 security release (2026-10-21) gives it no fix. The fixed versions are 22.23.4, 24.22.1 and 26.12.1. Third-party Docker hosts (Glama, per glama.json) build this image, so each new build ships an unpatched Node.

What changed

File	Change
Dockerfile	FROM node:20-slim -> FROM node:24.22.1-slim. Nothing else
.github/workflows/ci.yml	Verify runs on Node 20 and Node 24 (fail-fast: false). It tested only Node 20, an end-of-life line. Node 20 stays in the matrix, because the package states no engines floor

Why Node 24 is safe for this package:

• @taskade/mcp-server 0.1.4 on npm has no engines field and no runtime dependencies. bin/cli.mjs is one esbuild bundle with target: 'node18'.
• The package has no native module.
• The image still runs npm install -g @taskade/mcp-server and the same ENTRYPOINT.

Verification

Local, Docker 29.8.2. I built the old image (main) and the new image (this branch) with --pull --no-cache --platform linux/amd64.

	node:20-slim (main)	node:24.22.1-slim (this PR)
node -v	v20.20.2	v24.22.1
npm -v	10.8.2	11.19.1
@taskade/mcp-server installed	0.1.4	0.1.4
zlib.constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (the fix marker)	undefined	-17
Image size	201 MB	233 MB

initialize over stdio. The server needs TASKADE_API_KEY to start, but it does no network call on initialize, so a placeholder value is enough:

$ printf '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"0"}}}\n' \
    | docker run -i --rm -e TASKADE_API_KEY=placeholder-not-a-real-token <img>

node20: {"result":{"protocolVersion":"2025-06-18","capabilities":{"tools":{"listChanged":true}},"serverInfo":{"name":"taskade","version":"0.1.4"}},"jsonrpc":"2.0","id":1}
node24: {"result":{"protocolVersion":"2025-06-18","capabilities":{"tools":{"listChanged":true}},"serverInfo":{"name":"taskade","version":"0.1.4"}},"jsonrpc":"2.0","id":1}
initialize results IDENTICAL (diff exit 0). stderr on both: Taskade MCP Server running on stdio. Exit 0 on both.

tools/list after initialize: 62 tools on both images, and the same sorted tool-name hash (52cebc0436ff137c).

Without TASKADE_API_KEY, both images print the same error and exit 1:

ERROR: TASKADE_API_KEY environment variable is not set.

To fix this:
1. Generate a Personal Access Token at: https://www.taskade.com/settings/api
2. Set the environment variable:
   export TASKADE_API_KEY="your_token_here"

The CI steps on Node 24 (node:24.22.1-slim container, yarn 1.22.22): yarn install --frozen-lockfile OK, yarn build OK, git diff --exit-code clean, yarn lint OK, yarn test 6 files and 24 tests passed.

Deploy

• Nothing deploys on merge. release.yml runs changesets/action on a push to main. This PR adds no changeset, and 0.1.4 is already on npm, so no npm publish and no MCP Registry publish happen.
• Docker hosts that build from this repo (Glama) pick up the new base image on their next build.

Rollback

git revert this commit. The image goes back to node:20-slim, and CI goes back to Node 20 only.

[changeset-bot]

⚠️ No Changeset found

Latest commit: ad49fef

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[johnxie]

@deanzaka for review.

Impact: the @taskade/mcp-server Docker image moves off end-of-life Node 20 (no fix for the October 2026 CVEs) to Node 24.22.1. The server answers initialize and tools/list the same as before (62 tools), and no npm publish happens on merge.

BEFORE                                   AFTER
Docker image (Glama and other hosts)     Docker image (Glama and other hosts)
  node:20-slim -> v20.20.2 (EOL)           node:24.22.1-slim -> v24.22.1
  brotli fix marker: undefined             brotli fix marker: -17
npm package @taskade/mcp-server 0.1.4    npm package @taskade/mcp-server 0.1.4 (unchanged)
CI Verify: Node 20                       CI Verify: Node 20 + Node 24

Step	Action	Expected result
1	Open the CI run on this PR	Verify (Node 20) and Verify (Node 24) both green
2	docker build -t mcp-test . on this branch	Build succeeds
3	docker run --rm --entrypoint node mcp-test -p "process.version + ' ' + zlib.constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH"	v24.22.1 -17
4	Pipe the initialize request from the PR body into docker run -i --rm -e TASKADE_API_KEY=placeholder-not-a-real-token mcp-test	JSON-RPC result with serverInfo taskade 0.1.4
5	docker run -i --rm mcp-test with no key	Same TASKADE_API_KEY environment variable is not set error, exit 1
6	After merge, check the release.yml run on main	No version PR and no npm publish

[Copilot]

🟢 Approval recommended

The runtime update and corresponding CI changes are narrowly scoped and consistent, with no unresolved findings.

No open issues 🎉

What changed in this PR

Updates the Docker runtime from end-of-life Node 20 to Node 24.22.1 and adds CI coverage for the new runtime while retaining Node 20 compatibility checks.

Changes:

• Pins the Docker base image to node:24.22.1-slim, leaving installation and startup unchanged.
• Runs verification on Node 20 and Node 24 with fail-fast disabled.

File	Description
Dockerfile	Updates the base image to Node 24.22.1 slim.
.github/​workflows/​ci.yml	Adds a Node 20/24 verification matrix and version-specific job names.

_{Review effort: Balanced}