[markhm]

What

The tests workflow ran its test step on Node 20, which is end-of-life and has no release that fixes CVE-2026-111497 (out-of-bounds write in the Brotli decoder). This moves it to Node 24.

• actions/setup-node installs node-version: '24' with check-latest: true, so it looks up the newest 24.x in the actions/node-versions manifest and downloads it when the runner's cached copy is older. Without check-latest, an earlier run of this branch got the cached 24.21.0, which predates the fixed 24.22.1.
• actions/checkout and actions/setup-node go from @v4 to @v7, the current majors. This does not change the Node the action code runs on: the runner was already forcing the v4 actions onto Node 24 with a deprecation warning. v7 declares node24 itself, so the warning goes.
• README and CHANGELOG now say Node 24.

Verification

• Local: bash test/run.sh under Node 24.16.0: passed 298, failed 0 (macOS bash 3.2).
• CI on this head, push and pull_request runs: setup-node resolved and put v24.22.1 on PATH, test suite passed 298, failed 0, no ##[warning] lines. The suite's JS checks skip silently when node is absent (pre-existing command -v node || return 0), so the pass count alone does not prove they ran on 24.22.1; the setup-node step output does.

Notes

• After the first review round the branch was squashed into one commit and force-pushed, so an earlier commit message claiming "latest 24.x" without check-latest does not land on master.
• No fp issue: requested directly after the CVE exposure check.

🤖 Generated with Claude Code