CI: run the tests on Node 24 (CVE-2026-111497)

.github/workflows/tests.yml

@@ -7,9 +7,10 @@ jobs:
   tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
-          node-version: '20'
+          node-version: '24'
+          check-latest: true
       - name: Run test suite
         run: bash test/run.sh

CHANGELOG.md

@@ -21,6 +21,10 @@ template, or tooling — not the issue data a given report happens to show.
 - `install.sh` and `export.sh` moved to `tools/`. The engine itself did not move, so
   existing `~/bin/fp-report` symlinks keep working — only the install/export commands
   gain a `tools/` prefix.
+- **CI runs the suite on Node 24, not Node 20.** Node 20 is end-of-life and has no release
+  fixing CVE-2026-111497 (Brotli decoder). `check-latest` makes setup-node take the newest
+  24.x rather than the runner's cached one, which was 24.21.0, older than the fixed 24.22.1.
+  `actions/checkout` and `actions/setup-node` move from v4 to v7.
 
 ### Fixed
 - **`fp-report-deploy` works when installed as a symlink** (`tools/install.sh`, a bin

README.md

@@ -665,7 +665,7 @@ bash test/run.sh        # the whole suite; exits non-zero if anything fails
 through the real engine with `--issues-file` and asserts on the produced HTML. It needs
 `bash` + `python3`; `node` is optional and only unlocks the JS-level checks (they skip
 silently without it). CI runs the same one line on every push
-(`.github/workflows/tests.yml`, Node 20).
+(`.github/workflows/tests.yml`, Node 24).
 
 What it covers: placeholder replacement and injection safety (a hostile issue title must
 not break out of the embedded JSON), prefix/title/theme/status/taxonomy injection and