chore: upgrade Node.js runtime from 20 to 22 LTS

[danskmt]

• Tests written and linted
• Documentation written / README.md updated https://snyk.io/docs/snyk-for-node/
• Follows CONTRIBUTING agreement
• Commit history is tidy https://git-scm.com/book/en/v2/Git-Branching-Rebasing
• Reviewed by Snyk team

Depends on #6764

What this does

Upgrades the Snyk CLI repository to Node.js 22 LTS (CLI-1469): engines.node → ^22, .nvmrc and CI defaults aligned on the chosen 22.x patch, dependency / lockfile updates as needed, and GitHub Actions + CircleCI config adjusted so Linux/Windows/macOS pipelines install and test against 22 (including native build / embedded CLI paths where applicable). Documentation is updated so supported Node versions match what we actually run in CI.

Why Node 22 and not Node 24 (for now)

• Still LTS, smaller jump: 22 is a supported LTS line and is a deliberate step up from 20 without adopting the newest major immediately.
• Avoid Node 24–specific test / stderr churn: On Node 24 we saw deprecation warnings on stderr (e.g. legacy url.parse, child_process + shell behaviour) from transitive dependencies. Many Jest acceptance tests assert stderr is empty, so those warnings fail CI unless we upgrade dependencies, change spawn behaviour, or filter stderr in tests. On 22, we expect to validate real behaviour without that layer of suppression.
• Stabilize CI first: Land 22, get green pipelines and product confidence, then plan 24 with dependency upgrades and any intentional code changes, rather than coupling the version bump to test-harness workarounds.

Notes for the reviewer

• Confirm CircleCI executor images, GitHub Actions node-version, .nvmrc, and engines are all consistent with the same 22.x line.
• Confirm Windows install path (install-node.ps1 / NVM + MSI fallback) matches the pinned version and checksum where used.
• If we narrow or change test matrices, confirm that matches intended support policy for the CLI.

More information

• CLI-1469

Screenshots

N/A

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Smoke Test Matrix Mismatch 🟠 [major] The smoke test matrix still includes Node 16, 18, and 20, but the PR makes changes that break compatibility with these versions. Specifically, package.json now requires Node ^22, and several core dependencies like snyk-gradle-plugin (v6.0.0) and snyk-nodejs-plugin (v2.0.0) have moved their minimum requirements to Node 20.19+ or 22+ (see package-lock.json). Running smoke tests on 16 or 18 will fail during npm install or execution. node_version: [16, 18, 20, 22] Unexplained Major Plugin Bumps 🟠 [major] The PR includes major version bumps for core scanning plugins: snyk-gradle-plugin (5.1.1 to 6.0.0) and snyk-nodejs-plugin (1.6.3 to 2.0.0). These are critical modules for the CLI's scanning logic. While necessary for Node 22 support, these major versions likely contain breaking changes in manifest parsing or dependency resolution that are not mentioned in the PR description, posing a significant operational risk to the scanner's stability. "snyk-gradle-plugin": "6.0.0", "snyk-module": "3.1.0", "snyk-mvn-plugin": "^4.7.0", "snyk-nodejs-lockfile-parser": "2.7.1", "snyk-nodejs-plugin": "^2.0.0", Restrictive Node Engine 🟡 [minor] Setting engines.node to ^22 is overly restrictive for a CLI tool. It prevents the package from being installed on Node 20 (which is still a supported LTS) and will block installation on future major versions like Node 23 or 24. Standard practice for Node LTS upgrades is to use a range like >=22 or ^20 || ^22 to maintain compatibility with existing LTS environments while targeting the new version. "node": "^22"

📚 Repository Context Analyzed This review considered 27 relevant code sections from 1 files (average relevance: 0.88) package-lock.json (15 segments, lines 2932-3216)