From 1ad477e174357376364bfe7e88fa0a129ad6086e Mon Sep 17 00:00:00 2001
From: Micah Heineck <micah.heineck@optimizely.com>
Date: Thu, 22 Oct 2026 09:55:21 -0400
Subject: [PATCH] chore(security): pin dev/CI Node to 22.23.4 (CVE-2026-111497)

Pin the Node used for development, CI and publishing to the patched
22.23.4 release (CVE-2026-111497, Brotli decoder OOB write).

Files:
- .nvmrc: v18 -> v22.23.4
- .devcontainer/devcontainer.json: javascript-node:1-18-bullseye ->
  javascript-node:1-22-bullseye + node feature pinned to 22.23.4
- .github/workflows/react_release.yml: node-version 22 -> 22.23.4
- .github/workflows/ghr_backfill.yml: node-version 18 -> 22.23.4
- .github/workflows/react.yml: matrix leg '22' -> '22.23.4'
  (18/20/24 compatibility legs unchanged)

package.json engines (>=18.0.0) intentionally unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .devcontainer/devcontainer.json     | 7 ++++++-
 .github/workflows/ghr_backfill.yml  | 2 +-
 .github/workflows/react.yml         | 2 +-
 .github/workflows/react_release.yml | 2 +-
 .nvmrc                              | 2 +-
 5 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 3b514668..e1914f94 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,6 +1,11 @@
 {
   "name": "React SDK",
-  "image": "mcr.microsoft.com/devcontainers/javascript-node:1-18-bullseye",
+  "image": "mcr.microsoft.com/devcontainers/javascript-node:1-22-bullseye",
+  "features": {
+    "ghcr.io/devcontainers/features/node:1": {
+      "version": "22.23.4"
+    }
+  },
   "postCreateCommand": "npm i -g yarn@1.22.22 && yarn install",
   "customizations": {
     "vscode": {
diff --git a/.github/workflows/ghr_backfill.yml b/.github/workflows/ghr_backfill.yml
index d6d6db1d..7591c78d 100644
--- a/.github/workflows/ghr_backfill.yml
+++ b/.github/workflows/ghr_backfill.yml
@@ -36,7 +36,7 @@ jobs:
     - name: Set up Node
       uses: actions/setup-node@v4
       with:
-        node-version: 18
+        node-version: 22.23.4
 
     - name: Configure GHR auth
       run: echo "//npm.pkg.github.com/:_authToken=\${NODE_AUTH_TOKEN}" >> ~/.npmrc
diff --git a/.github/workflows/react.yml b/.github/workflows/react.yml
index 796f49d5..8d756685 100644
--- a/.github/workflows/react.yml
+++ b/.github/workflows/react.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node: [ '18', '20', '22', '24' ]
+        node: [ '18', '20', '22.23.4', '24' ]
     steps:
     - name: Checkout branch
       uses: actions/checkout@v4
diff --git a/.github/workflows/react_release.yml b/.github/workflows/react_release.yml
index 45edf538..e7465856 100644
--- a/.github/workflows/react_release.yml
+++ b/.github/workflows/react_release.yml
@@ -25,7 +25,7 @@ jobs:
     - name: Set up Node
       uses: actions/setup-node@v4
       with:
-        node-version: 22
+        node-version: 22.23.4
         cache: 'npm'
 
     - name: Upgrade npm for OIDC support
diff --git a/.nvmrc b/.nvmrc
index 3f430af8..a9276c4b 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-v18
+v22.23.4