Repository navigation
Conversation
CI and local development installed 22.22.0, which is below the patched 22.23.4 release for the 22.x line. Co-authored-by: nyaomaru <nyaonyao0725@gmail.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pin the development and CI Node.js toolchain to 22.23.4, the patched 22.x release from the October 21, 2026 security releases.
Description
Node.js published security releases on October 21, 2026. The highest severity issue on the 22.x line is high (Brotli decoder RCE, TLS hostname bypasses, dns NUL truncation, and related fixes). The patched 22.x release is 22.23.4.
This repository installed an exact Node 22.22.0 through mise for local development and GitHub Actions (
jdx/mise-action). That pin is below the patched release, so CI andmise installwould keep using a vulnerable runtime.Updated:
mise.toml:22.22.0→22.23.4(used by CI and local development)docs/mise.toml:22.22.0→22.23.4README.md,DEVELOPER.md,AGENTS.md, and the Node.js placeholder in.github/ISSUE_TEMPLATE/bug.ymlLeft unchanged:
package.jsonengines.nodestays>=22. That range only declares the minimum consumer version.22.x,24.x) and the npm publish job (node-version: '24') already float and pick up the patched releases.bench/struct-exact-results.mdstill records that those measurements ran on Node 22.22.0.Verified locally with mise-installed Node v22.23.4:
pnpm lint,pnpm build,pnpm test(24 suites, 243 tests), andpnpm test:types.