[Micah Heineck (micahheineckoptimizely)]

Ticket: EXPIN-51

Summary

Pins the exact patched Node.js release for the release/publish workflows and the Node 22 CI legs, to remediate CVE-2026-111497 (out-of-bounds write in Node.js's bundled Brotli decoder, possible RCE). Node released the fix on 2026-10-21; patched versions are 22.23.4, 24.22.1 and 26.12.1. The company remediation guidance requires pinning the exact patched version.

This only changes the Node used in CI and publishing. The SDK's supported range (engines.node: >=18.0.0) is unchanged.

• Node.js security release: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• Company remediation steps: https://optimizely.atlassian.net/wiki/spaces/SEC/pages/5158666245/Node.js+Security+Release+CVE-2026-111497+and+Company-wide+Remediation+Steps

Files changed

File	Job	Old	New
.github/workflows/release.yml	publish (npm + GHR publish)	node-version: 22	node-version: 22.23.4
.github/workflows/ghr_backfill.yml	backfill (republishes npm tarballs to GHR)	node-version: 18	node-version: 22.23.4
.github/workflows/javascript.yml	react_native_metro_test	node-version: 22	node-version: 22.23.4
.github/workflows/javascript.yml	unit_tests matrix	['18', '20', '22', '24']	['18', '20', '22.23.4', '24.22.1']

Notes:

• ghr_backfill.yml is a manually triggered publish job. It runs npm view / npm pack on published versions and calls scripts/publish.sh to push them to GHR. It does no build, and Node 18 has no upstream fix, so it now uses the same patched 22.23.4 as release.yml. Node 18 and Node 22.23.4 both ship npm 10.x.
• unit_tests matrix: the 22 and 24 legs are pinned to the patched releases of those lines. Coveralls flag names follow matrix.node, so they become run-22.23.4 / run-24.22.1.

Verification (local, Node 22.23.4 unless noted)

What	Command	Result
Release job steps	npm ci --ignore-scripts && npm test && npm run build && npm pack --ignore-scripts	Pass. Mocha 815 passing, Vitest 80/80 files and 1103/1103 tests, posttest lint (tsc --noEmit + eslint) clean, build and pack OK (optimizely-optimizely-sdk-6.6.1.tgz).
Flaky test (pre-existing)	npm test, first run	One failure in lib/event_processor/event_store.spec.ts, "should resave events without time information on get": expected 1792677000285 to be greater than or equal to 1792677000331. It's a wall-clock timestamp comparison. A full rerun passed, and the file alone passed 5/5 on both Node 22.23.4 and 22.17.0. Not related to the Node version.
react_native_metro_test	npm run test-rn-metro	Pass (28 passed, 0 failed)
ghr_backfill flow	clean npm config: npm view @optimizely/optimizely-sdk versions, npm pack @optimizely/optimizely-sdk@6.6.1, DRY_RUN=true scripts/publish.sh https://registry.npmjs.org <tarball>	Pass. Lists 97 versions, packs, and publish.sh reports "already on registry, skipping" (exit 0). Not run against GHR (needs the workflow token).

Not run locally: browser tests (BrowserStack credentials) and integration suites (CI secrets).

For the owners to decide

• These jobs still run Node lines that get no upstream fix for this CVE: unit_tests matrix 18 and 20, lint (16), commonjs_test (18), and typescript_test, browser_tests, generate_messages_test (20). They only run in CI to check compatibility with customers' Node versions. Whether to keep or drop them is your call; this PR leaves them unchanged.
• .devcontainer/devcontainer.json uses typescript-node:1-18-bookworm (Node 18). That's a local dev environment and moving it would be a major-version change, so it's left as is.

Required follow-up

The fix only counts once the change is rebuilt and redeployed: the next SDK release must be built and published through the updated release.yml. Merging alone doesn't change anything already published.

🤖 Generated with Claude Code

[datadog-optimizely-experimentation]

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

Jira ticket reference check | jira_ticket_reference_check

View in Datadog · View in GitHub Actions

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 602be49 | Docs | View more details | Give us feedback!}

[Coveralls (coveralls)]

coverage: 77.624%. remained the same — security/cve-2026-111497-node-22.23.4 into master