[decofe]

Update the Node.js pins to 24.22.1, which rejects certificate chains containing blocked public keys from the eMudhra incident.

Update the pnpm-managed Node runtime and its lockfile archive URLs/checksums so package scripts cannot switch back to the older locked runtime. The runtime entry was resolved with the pinned pnpm 11.0.7, so it keeps the Alpine/musl variants for both x64 and arm64 (libc: musl) alongside the glibc, macOS and Windows archives. Retain all unrelated dependency resolutions.

Validation:

• git diff --check
• pnpm install --lockfile-only with pnpm 11.0.7 leaves the lockfile unchanged.
• Parsed the lockfile, verified every Node archive checksum against the upstream release SHASUMS256.txt, and checked that unrelated dependency resolutions are unchanged.
• Frozen install, pnpm check, and pnpm check:types passed on Node 24.22.1; integration tests failed during local fee-payer setup (RPC HTTP 400), and browser setup could not load the unbuilt better-sqlite3 native addon.

Check / Verify currently fails on pnpm audit with the same 18 advisories on main; that is unrelated to this change.

Prompted by: @grandizzy

[claude]

I re-reviewed after the musl fix commit and found no bugs: both musl variants now use cpu: x64 / cpu: arm64 with libc: musl again, so Alpine hosts get a musl binary. I'm still leaving the final call to a person because I couldn't check the new download URLs and sha256 hashes against the upstream v24.22.1 SHASUMS256.txt from here.

What was reviewed:

• package.json devEngines.runtime bump to ^24.22.1, plus the matching importer specifier, packages and snapshots entries in pnpm-lock.yaml.
• Every platform variant moves from v24.15.0 to v24.22.1 URLs. Targets, bins and zip prefixes are unchanged.
• linux/x64/musl now has two entries: the official nodejs.org linux-x64-musl tarball, listed first, and the unofficial-builds one. Both are musl builds, so whichever one pnpm picks should run on Alpine.

Extended reasoning...

The change bumps the pnpm-managed Node runtime from 24.15.0 to 24.22.1 in package.json and pnpm-lock.yaml. It includes a follow-up commit that hand-corrects the musl targets. There is no application code. What it touches that matters for security is supply chain: each lockfile entry pins a download URL and sha256 hash for a Node binary that pnpm fetches and runs (onFail: download). I couldn't confirm those hashes against the upstream release, and part of the lockfile was edited by hand. That is why I'm leaving the final call to a person rather than approving.

[github-actions]

The latest Tipbot preview deployment for bf240eb

Name	Status	Preview	Updated (UTC)
pr105	Shut Down	pr105.tip.bot	Oct 21, 2026, 9:56 PM