From cc71083bc826039d65e7a5aff228cf25e13f4431 Mon Sep 17 00:00:00 2001 From: Mark HM Date: Sun, 25 Oct 2026 20:53:07 +0100 Subject: [PATCH] CI: run the tests on the newest Node 24.x Node 20 is end-of-life and has no release fixing CVE-2026-111497 (Brotli decoder). setup-node now installs node-version '24' with check-latest, so it looks up the newest 24.x in the actions/node-versions manifest and downloads it when the runner's cached copy is older. Without check-latest the cache supplied 24.21.0, which predates the fixed 24.22.1. actions/checkout and actions/setup-node move from v4 to v7. The runner was already forcing the v4 actions onto Node 24 with a deprecation warning; v7 declares node24 itself, so the warning goes. README and CHANGELOG say Node 24. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/tests.yml | 7 ++++--- CHANGELOG.md | 4 ++++ README.md | 2 +- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 098a53d..20d83af 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -7,9 +7,10 @@ jobs: tests: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: - node-version: '20' + node-version: '24' + check-latest: true - name: Run test suite run: bash test/run.sh diff --git a/CHANGELOG.md b/CHANGELOG.md index dbde3b6..61f4899 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,6 +21,10 @@ template, or tooling — not the issue data a given report happens to show. - `install.sh` and `export.sh` moved to `tools/`. The engine itself did not move, so existing `~/bin/fp-report` symlinks keep working — only the install/export commands gain a `tools/` prefix. +- **CI runs the suite on Node 24, not Node 20.** Node 20 is end-of-life and has no release + fixing CVE-2026-111497 (Brotli decoder). `check-latest` makes setup-node take the newest + 24.x rather than the runner's cached one, which was 24.21.0, older than the fixed 24.22.1. + `actions/checkout` and `actions/setup-node` move from v4 to v7. ### Fixed - **`fp-report-deploy` works when installed as a symlink** (`tools/install.sh`, a bin diff --git a/README.md b/README.md index cdece9d..6b3bf36 100644 --- a/README.md +++ b/README.md @@ -665,7 +665,7 @@ bash test/run.sh # the whole suite; exits non-zero if anything fails through the real engine with `--issues-file` and asserts on the produced HTML. It needs `bash` + `python3`; `node` is optional and only unlocks the JS-level checks (they skip silently without it). CI runs the same one line on every push -(`.github/workflows/tests.yml`, Node 20). +(`.github/workflows/tests.yml`, Node 24). What it covers: placeholder replacement and injection safety (a hostile issue title must not break out of the embedded JSON), prefix/title/theme/status/taxonomy injection and