From b7570b97055dbf36e42b0877bb427a34a5f0869b Mon Sep 17 00:00:00 2001 From: "Jude.Chen" Date: Thu, 22 Oct 2026 10:45:23 +0800 Subject: [PATCH] chore: pin Node 22.23.4 in CI workflows Align CI with the October 2026 Node.js security release (22.23.4), which fixes a Brotli decoder OOB write (CVE-2026-111497) and TLS hostname verification bypasses. Node only runs at build/test time here. --- .github/workflows/android-apk.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/ios-unsigned.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/android-apk.yml b/.github/workflows/android-apk.yml index ce82c47..ac04a8f 100644 --- a/.github/workflows/android-apk.yml +++ b/.github/workflows/android-apk.yml @@ -38,7 +38,7 @@ jobs: - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 22 + node-version: 22.23.4 cache: npm - run: npm ci diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1377b2c..027e3c1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,7 +12,7 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: { persist-credentials: false } - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 - with: { node-version: 22, cache: npm } + with: { node-version: 22.23.4, cache: npm } - run: npm ci - run: npm run typecheck - run: npm run lint diff --git a/.github/workflows/ios-unsigned.yml b/.github/workflows/ios-unsigned.yml index c45f573..fec354e 100644 --- a/.github/workflows/ios-unsigned.yml +++ b/.github/workflows/ios-unsigned.yml @@ -28,7 +28,7 @@ jobs: - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 22 + node-version: 22.23.4 cache: npm - run: npm ci