[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing and Code of Conduct guidelines.
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

Security fix. Bump the exact Node.js runtime pin for the November 11, 2026 Node.js security releases. No application code changed. Published engines ranges are unchanged.

Pins

Pin	Old	New
.nvmrc	24.18.0	24.22.3

Left unchanged:

• GitHub Actions node-version values 22, 24, and 26 (floating majors, no patch, no digest).
• Published engines ranges (>=22 on packages, ^22.19.0 \|\| >=24.0.0 at the repo root).
• Dev Container image mcr.microsoft.com/devcontainers/javascript-node:5.2.1-24-trixie (major 24 plus a digest). The pinned digest still matches the current MCR manifest index for that tag. No 24.22.3 variant of that image is published.

v24.22.3 is on the Node.js dist index (2026-11-10). Official Docker Hub node:24.22.3 tags are not published yet. This repository has no Node image pin, so no image tag or digest was changed.

CVEs

Highest severity is HIGH. No active exploitation is reported. Patched lines are Node.js v22.23.5, v24.22.3, and v26.13.1. This repository only pins 24.x, so the pin moves to 24.22.3.

• CVE-2026-123863 — HTTP/2 remote abort (CHECK_EQ in ~Http2Session()), affects 24.x/26.x
• CVE-2026-123864 — HTTPS zero-length TLS write re-enters llhttp_execute()
• CVE-2026-123865 — HTTP/2 session leak on protocol error during shutdown
• CVE-2026-123866 — HTTP/2 stream teardown can send freed response memory
• CVE-2026-123874 — HTTP/2 use-after-free in respondWithFile() during a pending write
• CVE-2026-123875 — HTTP/2 NULL dereference when a respondWithFile() download is cancelled
• CVE-2026-123828 — HTTP/2 heap-buffer-overflow in session.altsvc()
• CVE-2026-123868 — HTTP/2 inbound data not charged to maxSessionMemory
• CVE-2026-126051 — remotely triggerable uncaught exception in TLS servers via deferred handshake callbacks
• CVE-2026-123872 — TLS 1.2 renegotiation can change servername and bypass client-certificate authentication
• CVE-2026-123867 — CA-only SNI client-CA overrides fail open to the default CA
• CVE-2026-123871 — proxy credentials disclosed in ERR_PROXY_INVALID_CONFIG
• CVE-2026-123877 — certificate validation bypass in https.Agent via cross-policy TLS session reuse

Also includes llhttp, undici, and sqlite dependency updates in the Node.js release.

After merge

Rebuild and redeploy is required after merge (for runtime images). This library has no runtime image; the change is the local/dev .nvmrc pin used by nvm use.

No minimumReleaseAgeExclude entry was added.

  

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T19:13:10.055102Z	65ec2ac	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (d11d3a4) to head (65ec2ac).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #255   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           13        13           
  Lines         1723      1723           
  Branches       304       304           
=========================================
  Hits          1723      1723           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.