Skip to content

fix(ci): pin Node.js to 22.23.4 #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Zach Dunn (zachdunn) merged 1 commit into from
Oct 21, 2026
Merged

fix(ci): pin Node.js to 22.23.4 #50

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,8 @@ jobs:

- uses: actions/setup-node@v7
with:
node-version: 22
# 22.23.4 is the first 22.x that distrusts the compromised eMudhra intermediates (CVE-2026-111943). A bare `22` can reuse an older cached release.
node-version: 22.23.4

- name: Syntax
run: |
Expand Down Expand Up @@ -92,7 +93,8 @@ jobs:

- uses: actions/setup-node@v7
with:
node-version: 22
# 22.23.4 is the first 22.x that distrusts the compromised eMudhra intermediates (CVE-2026-111943). A bare `22` can reuse an older cached release.
node-version: 22.23.4

- name: ffmpeg
run: sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg
Expand Down
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,3 +89,7 @@ Until the first release, changes are recorded under [Unreleased].
- Headless Chrome gets 45 s to start instead of 20, since a busy CI runner starting several at once can take longer.
- `references/visuals.md`: how to hide sticky headers before a capture, and a crop command that honours its offset (`sips -c` crops around the centre).
- Plain replaces the template's previous look: Archivo, Newsreader and IBM Plex Mono on a white page, and figures (flows, steps, diagrams) on plain ground between two rules instead of a bordered dot grid.

### Security

- GitHub Actions pins Node.js to 22.23.4, the first 22.x release that distrusts the compromised eMudhra intermediate certificates ([CVE-2026-111943](https://www.cve.org/CVERecord?id=CVE-2026-111943), [Cloudflare](https://blog.cloudflare.com/emudhra-certificate-compromise/)). `actions/setup-node` with `node-version: 22` and no `check-latest` can keep an older cached 22.x. The minimum stays Node.js 22 (`package.json` engines `>=22`).
Loading