From 15fe0c05bda07f34a70e841b680c9ae7d0e1c6ef Mon Sep 17 00:00:00 2001
From: Nikola Tosic <1170273+toshke@users.noreply.github.com>
Date: Mon, 26 Oct 2026 13:50:36 +1100
Subject: [PATCH] fix(ci): pin Node to 22.23.4

Node 22.23.4 fixes CVE-2026-111497 in the bundled Brotli decoder. CI and .nvmrc must use the same exact version.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml              | 4 ++--
 .github/workflows/is-compatible.yml   | 2 +-
 .github/workflows/release-please.yaml | 2 +-
 .nvmrc                                | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d723218..bf5d63e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
       - name: Setup Node.js environment
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # ratchet:actions/setup-node@v6
         with:
-          node-version: '22'
+          node-version: '22.23.4'
           cache: 'npm'
 
       - name: Cache node_modules for future jobs
@@ -106,7 +106,7 @@ jobs:
       - name: Setup Node.js environment
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # ratchet:actions/setup-node@v6
         with:
-          node-version: '22'
+          node-version: '22.23.4'
 
       - name: Restore node_modules
         uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # ratchet:actions/cache/restore@v4
diff --git a/.github/workflows/is-compatible.yml b/.github/workflows/is-compatible.yml
index 321cd82..5fa8a87 100644
--- a/.github/workflows/is-compatible.yml
+++ b/.github/workflows/is-compatible.yml
@@ -11,7 +11,7 @@ jobs:
       - name: Setup Node.js environment
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # ratchet:actions/setup-node@v6
         with:
-          node-version: '22'
+          node-version: '22.23.4'
           cache: 'npm'
       - name: Install dependencies
         run: npm ci
diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
index 69e5063..52385db 100644
--- a/.github/workflows/release-please.yaml
+++ b/.github/workflows/release-please.yaml
@@ -34,7 +34,7 @@ jobs:
       - name: Setup Node.js environment
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # ratchet:actions/setup-node@v6
         with:
-          node-version: '22'
+          node-version: '22.23.4'
           cache: 'npm'
 
       - name: Setup Go environment
diff --git a/.nvmrc b/.nvmrc
index c6a66a6..a9276c4 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-v22.21.1
+v22.23.4