Repository navigation
ci(SEC-104): bump Node to 22.23.4 for CVE-2026-111497 - #30
Conversation
Refs SEC-104. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 2 files
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Auto-approved: Bumps Node.js in CI workflows from 18.x to 22.x to address an EOL CVE; the diff is confined to two version strings with no workflow logic changes.
View guided diff | Turn on auto-fix | Re-trigger cubic
glebedel
changed the title
setup-node defaults check-latest to false, so a floating 22 can resolve to a cached Node 22 older than 22.23.4. Addresses review feedback. Refs SEC-104. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
0 issues found across 2 files (changes from recent commits).
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Auto-approved: Bumps Node.js in CI workflows from EOL 18.x to the patched 22.23.4 to address CVE-2026-111497; the diff changes only two version strings with no other workflow logic altered.
View guided diff | Turn on auto-fix | Re-trigger cubic
glebedel
changed the title
What
Bumps the Node.js version pinned in this repo's GitHub Actions to 22.x.
.github/workflows/release.yml18.x22.x.github/workflows/build.yml18.x22.xWhy
CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in the Brotli decoder of
node:zlibthat can lead to remote code execution. It is fixed in Node 22.23.4, 24.22.1 and 26.12.1 (21 Oct 2026 security release). Production runtimes were patched under SEC-104; this PR covers the CI runners and build steps, which still pinned an affected version.Node 18 and 20 are end of life and get no fix, so those pins move to Node 22. That is a major version change for these jobs: if a job fails here on engines or a native dependency, that is the reason.
Verification
Only the version strings above change; no other workflow logic is touched. Jobs that run on
pull_requestexercise the new version on this PR. Jobs that only run on push tomain(deploys, releases) first use it after merge.Follow-up commits
22,22.x,24) are now exact (22.23.4/24.22.1). setup-node defaultscheck-latestto false, so a floating major can resolve to a cached build that predates the fix.Requested by guillaume@stackone.com in Slack (SEC-104 follow-up).
🤖 Generated with Claude Code