chore(deps): pin Node 22.23.4 for the October 2026 security release

CI was hard-pinned to Node 22.12.0, which is affected by the October 2026 Node.js security release (CVE-2026-111497 Brotli OOB write, CVE-2026-106069 TLS hostname bypass, and others).

- CI setup-node: 22.12.0 -> 22.23.4
- WebUI build stage: node:22-alpine -> node:22.23.4-alpine
- webui engines: >=22.12.0 -> >=22.23.4

Author: nextroad-dev

.github/workflows/ci.yml

@@ -38,7 +38,7 @@ jobs:
           cache: true
       - uses: actions/setup-node@v4
         with:
-          node-version: "22.12.0"
+          node-version: "22.23.4"
           cache: npm
           cache-dependency-path: webui/package-lock.json
       - run: npm ci

Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.7
 
-FROM node:22-alpine AS webui-build
+FROM node:22.23.4-alpine AS webui-build
 WORKDIR /src/webui
 COPY webui/package.json webui/package-lock.json ./
 RUN npm ci

webui/package-lock.json

@@ -4,7 +4,7 @@
   "version": "1.0.0",
   "type": "module",
   "engines": {
-    "node": ">=22.12.0"
+    "node": ">=22.23.4"
   },
   "scripts": {
     "fonts:generate": "node scripts/generate-fonts.mjs",