[bdchatham]

Upgrades Node.js to the 22.x security release 22.23.5 (release: Node.js 22).

Pins bumped:

• .nvmrc: 22.23.4 → 22.23.5 (read by actions/setup-node via node-version-file in .github/actions/setup/action.yml)

Left alone: the engines.node range in package.json (>=22.23.4 <23), which already admits 22.23.5.

Checks: git diff --check.

[tempoxyz-bot]

👁️ Cyclops Security Review

✅ Reviewed c22f433 (latest) · Coverage: partial · no open findings · report
⚠️ Not checked: Repository-local compatibility and CI wiring of the Node.js pin, transition from Node.js 22.23.4 pin to Node.js 22.23.5 pin: ruled out without reading the cited code at this commit
⚠️ Not checked: Repository-local compatibility and CI wiring of the Node.js pin, transition from Installed-dependency cache key for the old pin to A cache key incorporating the new pin: ruled out without reading the cited code at this commit
⚠️ Not checked: Repository-local compatibility and CI wiring of the Node.js pin, competing explanation "The runtime bump reuses the previous runtime's installed-dependency cache key.": ruled out without reading the cited code at this commit
⚠️ 4 more unchecked questions are listed in the report
ℹ️ Not verifiable from the source alone (needs running code or deployed state): The inspected repository and review inputs do not establish successful installation or execution of Node 22.23.5. No project tests were executed, so runtime availability and toolchain compatibility re (4 more in the report)

[claude]

LGTM. This is a one-line patch bump of the Node.js pin.

What was reviewed:

• .nvmrc now reads 22.23.5 and still ends with a single trailing newline. CI picks it up through node-version-file: .nvmrc in .github/actions/setup/action.yml.
• engines.node in package.json is >=22.23.4 <23, which already allows 22.23.5. No Dockerfile or workflow pins Node anywhere else.
• docs/development/README.md says "22.23.4 or newer in the 22.x line". That is still accurate, so the docs don't need an edit.

Extended reasoning...

The only change is to .nvmrc, which moves the pinned Node.js version from 22.23.4 to 22.23.5 within the 22.x line. It touches no source code and no security-sensitive surface such as auth, crypto or permissions. The engines range in package.json and the CI setup action that reads .nvmrc both work with the new version. There is no CODEOWNERS file and the PR timeline has no outstanding reviewer objections. That, plus the change being a mechanical version bump, is why I approved.