From 602be4910221a5d09d1fb099d9f8237d43544f83 Mon Sep 17 00:00:00 2001 From: Micah Heineck Date: Thu, 22 Oct 2026 09:57:39 -0400 Subject: [PATCH] chore(security): pin Node 22.23.4 (CVE-2026-111497) Pin the exact patched Node.js release for CVE-2026-111497 in CI/publish workflows. Changed files: - .github/workflows/release.yml: node-version 22 -> 22.23.4 - .github/workflows/ghr_backfill.yml: node-version 18 -> 22.23.4 - .github/workflows/javascript.yml: react_native_metro_test 22 -> 22.23.4; unit_tests matrix '22' -> '22.23.4', '24' -> '24.22.1' Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/ghr_backfill.yml | 2 +- .github/workflows/javascript.yml | 4 ++-- .github/workflows/release.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ghr_backfill.yml b/.github/workflows/ghr_backfill.yml index fe0141b73..da9180970 100644 --- a/.github/workflows/ghr_backfill.yml +++ b/.github/workflows/ghr_backfill.yml @@ -42,7 +42,7 @@ jobs: - name: Set up Node uses: actions/setup-node@v4 with: - node-version: 18 + node-version: 22.23.4 - name: Configure GitHub Package Registry auth run: echo "//npm.pkg.github.com/:_authToken=\${NODE_AUTH_TOKEN}" >> ~/.npmrc diff --git a/.github/workflows/javascript.yml b/.github/workflows/javascript.yml index 2ccda8115..36bb1becf 100644 --- a/.github/workflows/javascript.yml +++ b/.github/workflows/javascript.yml @@ -64,7 +64,7 @@ jobs: - name: Set up Node uses: actions/setup-node@v3 with: - node-version: 22 + node-version: 22.23.4 cache-dependency-path: | ./package-lock.json ./tests/react-native-metro/fixtures/*/package-lock.json @@ -151,7 +151,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - node: ['18', '20', '22', '24'] + node: ['18', '20', '22.23.4', '24.22.1'] steps: - uses: actions/checkout@v3 - name: Set up Node ${{ matrix.node }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8b79c33b8..018773183 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,7 +25,7 @@ jobs: - name: Setup Node uses: actions/setup-node@v4 with: - node-version: 22 + node-version: 22.23.4 - name: Upgrade npm for OIDC support run: npm install -g npm@latest