[niran]

Motivation

Node.js 20 reached end of life on April 30, 2026. Keep development runtimes on Node.js 24 LTS. The existing devcontainer also requests Python 3.14 packages that are unavailable in Ubuntu 22.04's default repositories.

Solution

• Install Node.js 24 from NodeSource in the devcontainer.
• Install Python 3.14 and its development and virtual-environment packages from the signed deadsnakes Jammy repository. Verify its signing-key fingerprint and limit the repository's apt priority.
• Keep Ubuntu's system python3 intact and install Vyper in a Python 3.14 virtual environment.
• Select nodejs_24 explicitly in the Nix development shell, so a future nixpkgs update cannot silently change the major version.
• Leave consumer-facing npm engine requirements unchanged.

The deadsnakes PPA is a third-party source and does not guarantee timely security updates. The existing Nix flake lock resolves Node.js 24.12.0; refresh the lock separately to pick up newer Node.js 24 security updates.

The @foundry-rs/anvil meta package has no engines field; generated platform packages declare node: ">=20". Consider a >=22 consumer minimum separately after compatibility testing.

PR Checklist

• Tests: Ran the checks below.
• Documentation: No documentation changes are needed for this configuration change.
• Breaking changes: No npm consumer-facing behavior or requirements changed.

Pre-existing CI fixes

• Correct rustdoc links and code formatting in cheatcode descriptions, and update the generated JSON descriptions.
• Update compatible vulnerable dependencies: crypto-bigint 0.7.10, libz-sys 1.1.31, pulldown-cmark 0.13.6, zstd 0.13.4, zstd-safe 7.4.0, and zstd-sys 2.1.2.

Known residual issue (pre-existing)

cargo-deny fails on RUSTSEC-2026-0387 for crypto-bigint 0.5.5, which is pulled in through alloy-signer 2.5.0 → elliptic-curve 0.13.8, and through k256 0.13.4 and p256 0.13.2. The fix requires crypto-bigint ≥0.7.6; no compatible 0.5 release provides it. The alloy and elliptic-curve migration will be addressed separately. RUSTSEC-2026-0387 is not suppressed.

ci-success also fails because it aggregates cargo-deny; all other applicable checks pass. Docs deployment is skipped for pull requests.

Test plan

• Syntax-checked all six shell-form Dockerfile RUN instructions without executing them.
• Ran bash -n on NodeSource's setup_24.x; verified its signed nodistro package indexes and checked that the Node 24 nodejs packages for amd64 and arm64 return HTTP 200.
• Verified the deadsnakes signing key and signed Jammy indexes; confirmed matching Python 3.14, -dev, and -venv packages for amd64 and arm64. Checked that the key validation rejects an additional primary key.
• On macOS with Python 3.14.7, installed Vyper 0.4.3 in a virtual environment and compiled a sample contract. The immutables dependency built its C extension from source; no cargo build was run.
• Ran npm/src/bin.mjs --help and the optional-dependency path of npm/src/install.mjs with Node.js 24.22.0, using a local platform-package fixture linked to an installed Anvil binary. Repeated both checks with Node.js 22.19.0.
• Ran git diff --check.
• Reproduced the reported rustdoc formatting errors in a standalone fixture; rustdoc -D warnings passed after the changes.
• Ran cargo metadata --locked; it passed. cargo deny --locked check advisories reports only the remaining crypto-bigint 0.5.5 advisory.
• Did not run cargo doc, cargo check, or cargo test locally.
• Did not build the devcontainer: the Docker daemon was unavailable, and the Dockerfile also builds cargo-nextest. Did not evaluate the Nix shell because nix was unavailable; checked the locked nixpkgs definition instead.

type=routine
risk=low
impact=sev5