Repository navigation
Conversation
- Update and pin dependencies with scoped security overrides - Replace legacy BLS helpers with native BLST and Lodestar SSZ - Preserve keystore password handling and ethers 5 behavior - Update Hardhat, CI, TypeScript, lint and test tooling - Build production-only Docker images and add runtime probes - Add regression tests with generated TLS and keystore inputs - Remove unused dependencies and obsolete configuration
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔵 Needs a closer look
Native cryptography changes and cross-major dependency overrides require human validation, particularly with hosted CI still unverified.
No open issues 🎉
What changed in this PR
Upgrades validator-ejector to Node.js 24.22.1 across development, CI, and Docker, with dependency compatibility checks.
Changes:
- Pins runtime and tooling versions and separates production dependencies.
- Migrates signature verification to native BLST and replaces the metrics client.
- Adds regression tests, runtime probes, and dependency documentation.
| File | Description |
|---|---|
| vite.e2e.config.ts | Uses Vitest configuration imports. |
| vite.config.ts | Uses Vitest configuration imports. |
| tsconfig.json | Updates resolution and typechecking scope. |
| tsconfig.build.json | Excludes tests from production builds. |
| src/test/tls-certificate.ts | Generates ephemeral TLS certificates. |
| src/services/webhook-caller/webhook-caller.spec.ts | Adapts Nock header assertions. |
| src/services/prom/service.ts | Replaces the metrics client. |
| src/services/prom/service.spec.ts | Checks metric compatibility. |
| src/services/messages-processor/test/prepare-deps.ts | Supports encryption tests and mock cleanup. |
| src/services/messages-processor/service.ts | Integrates crypto helpers and context validation. |
| src/services/messages-processor/messages-processor.spec.ts | Covers fork selection and malformed inputs. |
| src/services/messages-processor/encryption.spec.ts | Tests encryption and password-file compatibility. |
| src/services/messages-processor/crypto.ts | Implements BLST verification and SSZ helpers. |
| src/services/messages-processor/crypto.spec.ts | Tests roots and signature validation. |
| src/services/http-handler/service.ts | Updates registry types. |
| src/services/exit-logs/fetcher.spec.ts | Adapts Nock request parsing. |
| src/services/execution-api/el.spec.ts | Adapts Nock request parsing. |
| src/services/cloud-storage.spec.ts | Tests cloud SDK HTTP compatibility. |
| src/lib/request/runtime.spec.ts | Tests real HTTP and TLS behavior. |
| src/lib/request/middlewares.ts | Updates metrics imports and types. |
| src/lib/request/middlewares.spec.ts | Updates metrics and timeout mocks. |
| src/lib/job/index.ts | Updates histogram types. |
| src/app/service.ts | Updates interval timer typing. |
| scripts/check-startup.ts | Probes development and built startup. |
| scripts/check-runtime.mjs | Checks production runtime and native dependencies. |
| README.md | Documents setup and validation procedures. |
| package.json | Pins dependencies and updates scripts. |
| eslint.config.js | Adds flat ESLint configuration. |
| docs/dependencies.md | Documents compatibility and security constraints. |
| Dockerfile | Updates Node and isolates production dependencies. |
| .nvmrc | Pins Node.js 24.22.1. |
| .gitignore | Ignores coverage output. |
| .github/workflows/tests_and_checks.yml | Updates CI runtime and checks. |
| .github/workflows/test.yml | Updates CI runtime and checks. |
| .eslintrc | Removes legacy ESLint configuration. |
| .dockerignore | Excludes secrets and generated artifacts. |
Review effort: Balanced
- replaced static password with random bytes for better security - updated test cases to reflect new password generation method
- replace error message with a generic failure message - ensure consistent response structure for failed requests
| "@lodestar/params": "1.50.0", | ||
| "@lodestar/types": "1.50.0", | ||
| "@prometheus-io/client": "0.16.1", | ||
| "dotenv": "18.0.8", |
There was a problem hiding this comment.
After the update to dotenv 18, the daemon prints one extra line to stderr at every start: "◇ injected env (N) from .env". It also prints it when there is no .env file. The line is not JSON, so it can confuse log pipelines. src/app/module.ts:37 calls dotenv.config() with no options. Suggest dotenv.config({ quiet: true }) there and in src/scripts/*.ts.
|
|
||
| ## Requirements | ||
|
|
||
| - Node.js 24.22.1 and Yarn 1.22.22 for local installation and development |
There was a problem hiding this comment.
The README is correct here. The public guide is now outdated: https://docs.lido.fi/guides/validator-ejector-guide, section Requirements, still says "Node.js 16", and section "Running directly" has the old install steps (yarn, yarn build, yarn start). After this merge the only supported runtime is Node 24.22.1 with Yarn 1.22.22. A docs PR with these two edits is needed after the merge.
| COPY --from=production-dependencies /app/node_modules ./node_modules | ||
| COPY --from=build /app/dist ./dist | ||
| COPY package.json ./ | ||
| COPY scripts/check-runtime.mjs ./scripts/check-runtime.mjs |
There was a problem hiding this comment.
These two probes (check-runtime.mjs and check-startup.ts) run only by hand from the README. Why not run them in CI? For example: build the image and run node scripts/check-runtime.mjs inside it, and run check-startup.ts built after yarn build. Then a broken Dockerfile or a missing native blst build for alpine would fail the PR, not the deploy.
Update validator-ejector to Node.js 24.22.1 across development, CI and Docker.
Changes:
Validation on 2026-10-21:
Known limitations: