From ec1d75a3acde5d90f1ab6f9b4cc9cfe1f965a66c Mon Sep 17 00:00:00 2001 From: Brian Ingenito Date: Mon, 2 Nov 2026 12:40:58 -0500 Subject: [PATCH] fix(ci): bump pinned Node 24.19.0 to 24.x (CVE-2026-111497) The 2026-10-21 Node.js security release fixed CVE-2026-111497 (Brotli decoder out-of-bounds write, potential RCE) plus nine other CVEs; the patched 24.x line is v24.22.1. The workflows were pinned to 24.19.0, which predates the fix. Use a floating 24.x spec so future security patches are picked up automatically. Co-Authored-By: Claude Code --- .github/workflows/deploy.yml | 2 +- .github/workflows/pr-build.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index b8564b619..70ed53fa4 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -16,7 +16,7 @@ jobs: build: strategy: matrix: - node-version: [24.19.0] + node-version: [24.x] runs-on: ubuntu-latest diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml index 52325bcc5..24910d535 100644 --- a/.github/workflows/pr-build.yml +++ b/.github/workflows/pr-build.yml @@ -13,7 +13,7 @@ jobs: build: strategy: matrix: - node-version: [24.19.0] + node-version: [24.x] runs-on: ubuntu-latest