Repository navigation
Conversation
The 2026-10-21 Node.js security release fixed CVE-2026-111497 (Brotli decoder out-of-bounds write, potential RCE) plus nine other CVEs; the patched 24.x line is v24.22.1. The workflows were pinned to 24.19.0, which predates the fix. Use a floating 24.x spec so future security patches are picked up automatically. Co-Authored-By: Claude Code <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Both workflows can still select a pre-fix Node.js 24 release from the runner cache because setup-node does not enable check-latest, leaving the security update dependent on runner-image updates.
1 open issue
What changed in this PR
This PR updates the site’s CI and deployment workflows to use the floating Node.js 24.x range, intended to pick up security fixes without manually updating a pinned version.
Changes:
- Replaces Node.js
24.19.0with24.xin both workflow matrices. - Leaves existing build, test, and deployment steps unchanged.
| File | Description |
|---|---|
.github/workflows/pr-build.yml |
Uses Node.js 24.x for pull-request tests and builds. |
.github/workflows/deploy.yml |
Uses Node.js 24.x for deployment builds. |
Review effort: Balanced
bingenito
enabled auto-merge
November 2, 2026 17:52
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 2026-10-21 Node.js security release fixed CVE-2026-111497 (high-severity Brotli decoder out-of-bounds write, potential RCE) plus nine other CVEs across c-ares, OpenSSL, SQLite, and Undici. The patched 24.x line is v24.22.1; these workflows were pinned to 24.19.0, which predates the fix.
What changed
.github/workflows/deploy.yml—node-version: [24.19.0]→[24.x].github/workflows/pr-build.yml—node-version: [24.19.0]→[24.x]How it was verified
24.xspec resolves to the latest 24.x patch (24.22.1+ today) and automatically picks up future security releases — the pattern already used by the other org repos.pr-build.ymlexercises the updated Node version on this PR.🤖 Generated with Claude Code