From c77fb07b20db26b3b5a82cc4258c17f945f17e1e Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 21 Oct 2026 14:47:36 +0000 Subject: [PATCH] fix(ci): pin Node.js to 22.23.4 actions/setup-node with node-version 22 and no check-latest can reuse an older cached 22.x. 22.23.4 is the first 22.x release that distrusts the compromised eMudhra intermediates (CVE-2026-111943). Co-authored-by: Zach Dunn --- .github/workflows/ci.yml | 6 ++++-- CHANGELOG.md | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 60ee217..9597146 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,7 +23,8 @@ jobs: - uses: actions/setup-node@v7 with: - node-version: 22 + # 22.23.4 is the first 22.x that distrusts the compromised eMudhra intermediates (CVE-2026-111943). A bare `22` can reuse an older cached release. + node-version: 22.23.4 - name: Syntax run: | @@ -92,7 +93,8 @@ jobs: - uses: actions/setup-node@v7 with: - node-version: 22 + # 22.23.4 is the first 22.x that distrusts the compromised eMudhra intermediates (CVE-2026-111943). A bare `22` can reuse an older cached release. + node-version: 22.23.4 - name: ffmpeg run: sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg diff --git a/CHANGELOG.md b/CHANGELOG.md index 0ece758..a8ec7c2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -89,3 +89,7 @@ Until the first release, changes are recorded under [Unreleased]. - Headless Chrome gets 45 s to start instead of 20, since a busy CI runner starting several at once can take longer. - `references/visuals.md`: how to hide sticky headers before a capture, and a crop command that honours its offset (`sips -c` crops around the centre). - Plain replaces the template's previous look: Archivo, Newsreader and IBM Plex Mono on a white page, and figures (flows, steps, diagrams) on plain ground between two rules instead of a bordered dot grid. + +### Security + +- GitHub Actions pins Node.js to 22.23.4, the first 22.x release that distrusts the compromised eMudhra intermediate certificates ([CVE-2026-111943](https://www.cve.org/CVERecord?id=CVE-2026-111943), [Cloudflare](https://blog.cloudflare.com/emudhra-certificate-compromise/)). `actions/setup-node` with `node-version: 22` and no `check-latest` can keep an older cached 22.x. The minimum stays Node.js 22 (`package.json` engines `>=22`).