ci(SEC-104): bump Node to 22.23.4 for CVE-2026-111497
What
Bumps the Node.js version pinned in this repo's GitHub Actions to 22.x.
| File | Line | From | To |
|---|---|---|---|
.github/workflows/release.yml | 16 | 18.x | 22.x |
.github/workflows/build.yml | 10 | 18.x | 22.x |
Why
CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in the Brotli decoder of node:zlib that can lead to remote code execution. It is fixed in Node 22.23.4, 24.22.1 and 26.12.1 (21 Oct 2026 security release). Production runtimes were patched under SEC-104; this PR covers the CI runners and build steps, which still pinned an affected version.
Node 18 and 20 are end of life and get no fix, so those pins move to Node 22. That is a major version change for these jobs: if a job fails here on engines or a native dependency, that is the reason.
Verification
Only the version strings above change; no other workflow logic is touched. Jobs that run on pull_request exercise the new version on this PR. Jobs that only run on push to main (deploys, releases) first use it after merge.
Follow-up commits
- Floating major pins (
22,22.x,24) are now exact (22.23.4/24.22.1). setup-node defaultscheck-latestto false, so a floating major can resolve to a cached build that predates the fix.
Requested by guillaume@stackone.com in Slack (SEC-104 follow-up).
š¤ Generated with Claude Code