Qiyuanqiii · Oct 22, 2026 · Oct 21, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -125,7 +125,7 @@ jobs:
         if: ${{ contains(fromJSON(needs.classify.outputs.go_plan).test, 'cyberagent-workbench/internal/dependencycache') }}
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: '24.22.1'
       - name: Prepare integrity-pinned package preparation fixtures
         if: ${{ contains(fromJSON(needs.classify.outputs.go_plan).test, 'cyberagent-workbench/internal/dependencycache') }}
         run: |
@@ -335,7 +335,7 @@ jobs:
           cache: true
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: '24.22.1'
       - name: Install reviewed real language servers
         shell: pwsh
         run: |
@@ -384,7 +384,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: '24.22.1'
           cache: npm
           cache-dependency-path: web/package-lock.json
       - run: npm ci
@@ -452,6 +452,8 @@ jobs:
           cache: true
       - name: Report Go toolchain
         run: go version
+      - name: Update rustup certificate trust
+        run: rustup self update
       - name: Install pinned Rust toolchain
         run: rustup toolchain install 1.97.1 --profile minimal --component rustfmt --component clippy
       - run: cargo fmt --all -- --check
@@ -546,7 +548,7 @@ jobs:
           esac
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: '24.22.1'
           cache: npm
           cache-dependency-path: web/package-lock.json
       - name: Build embedded renderer
@@ -657,9 +659,11 @@ jobs:
           ./scripts/prepare-windows-fixed-go.ps1 -ExpectedGoVersion $env:TRAVERSE_CI_GO_VERSION
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: '24.22.1'
           cache: npm
           cache-dependency-path: web/package-lock.json
+      - name: Update rustup certificate trust
+        run: rustup self update
       - name: Install pinned Rust toolchain
         run: rustup toolchain install 1.97.1 --profile minimal
       - name: Build deterministic Rust fixture

diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml
@@ -199,10 +199,10 @@ jobs:
           go-version-file: go.mod
           cache: true
 
-      - name: Set up pinned Node 24.16.0
+      - name: Set up pinned Node 24.22.1
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '24.16.0'
+          node-version: '24.22.1'
           cache: npm
           cache-dependency-path: web/package-lock.json
 
@@ -218,6 +218,8 @@ jobs:
         working-directory: web
         run: npm ci --ignore-scripts
 
+      - name: Update rustup certificate trust
+        run: rustup self update
       - name: Install pinned Rust toolchain
         run: rustup toolchain install 1.97.1 --profile minimal
 
@@ -258,10 +260,10 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
-      - name: Set up pinned Node 24.16.0
+      - name: Set up pinned Node 24.22.1
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '24.16.0'
+          node-version: '24.22.1'
           cache: npm
           cache-dependency-path: web/package-lock.json
       - name: Build embedded renderer
@@ -337,13 +339,15 @@ jobs:
           go-version-file: go.mod
           cache: true
 
-      - name: Set up pinned Node 24.16.0
+      - name: Set up pinned Node 24.22.1
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '24.16.0'
+          node-version: '24.22.1'
           cache: npm
           cache-dependency-path: web/package-lock.json
 
+      - name: Update rustup certificate trust
+        run: rustup self update
       - name: Install pinned Rust toolchain for the fixture oracle
         shell: pwsh
         run: rustup toolchain install 1.97.1 --profile minimal

diff --git a/README.en.md b/README.en.md
@@ -52,7 +52,7 @@ Packages retain their historical filenames; the product name shown in the applic
 
 ### Option 2: Build from Source
 
-Install **Go as pinned in [go.mod](go.mod), currently 1.26.10**, and **Node.js 24** (CI uses 24.16.0), then clone the repository:
+Install **Go as pinned in [go.mod](go.mod), currently 1.26.10**, and **Node.js 24** (CI uses 24.22.1), then clone the repository:
 
 ```bash
 git clone https://github.com/CWNU-Open-Source-Community/Universal-Code.git

diff --git a/README.md b/README.md
@@ -52,7 +52,7 @@
 
 ### 方式二：从源码构建运行
 
-安装 **Go（版本遵循 [go.mod](go.mod)，当前为 1.26.10）** 与 **Node.js 24**（CI 使用 24.16.0），然后克隆仓库：
+安装 **Go（版本遵循 [go.mod](go.mod)，当前为 1.26.10）** 与 **Node.js 24**（CI 使用 24.22.1），然后克隆仓库：
 
 ```bash
 git clone https://github.com/CWNU-Open-Source-Community/Universal-Code.git

diff --git a/docs/ci.md b/docs/ci.md
@@ -56,6 +56,34 @@ changing the schedule. Go 1.26 requires macOS 12+, so native build flags, bundle
 metadata and package verification use that same minimum; the earlier macOS 11
 declaration was already inconsistent with Go 1.25's supported platforms.
 
+## October 2026 runtime security updates
+
+CI and desktop release jobs use Node.js **24.22.1**. Local frontend builds should
+use the same version. The [October 21 Node security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
+fixes TLS/DNS validation, Brotli decoding, and other runtime issues, and updates
+certificate trust. Updating npm packages alone does not update the Node executable.
+
+Before downloading pinned Rust toolchains, CI and release jobs run
+`rustup self update`. Local builders should also update rustup to **1.29.2 or
+newer** before installing toolchains or targets; [rustup 1.29.2](https://blog.rust-lang.org/2026/10/20/Rustup-1.29.2/)
+updates certificate verification dependencies for the eMudhra/emSign incident.
+The analyzer compiler remains pinned to Rust 1.97.1 so the embedded WASI build
+continues to use its established reproducible toolchain.
+
+The [Python security announcement](https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576)
+requires pip **26.2.2**, certifi **2026.10.19**, and uv **0.13.4** or newer where
+those tools perform HTTPS requests. Update existing virtual environments as well
+as base installations and rebuild container images with updated CA certificates.
+UC's project-preparation pip path uses local wheel URLs, `--no-index`,
+`--no-deps`, `--require-hashes`, and `--disable-pip-version-check`; downloads go
+through the Go dependency broker. Its pip >=25.3 requirement describes offline
+lockfile compatibility, not a safe version for general network use. The Python
+3.9 CI job remains an offline macOS archive compatibility test.
+
+Updating build configuration does not replace installed application binaries,
+user-managed interpreters, or existing sandbox images. Go-built releases must
+be rebuilt with the fixed toolchain; image owners must supply refreshed digests.
+
 ## Go impact selection
 
 `scripts/ci/run_go_checks.py` uses `go list -json ./...` to identify package

diff --git a/docs/evidence/runtime-security-october/after.png b/docs/evidence/runtime-security-october/after.png
diff --git a/docs/evidence/runtime-security-october/before.png b/docs/evidence/runtime-security-october/before.png
diff --git a/docs/macos-release.md b/docs/macos-release.md
@@ -37,7 +37,7 @@ Extract the Actions transport ZIP, then the product ZIP inside it, and open `Tra
 
 ## 构建与核验
 
-本机源码构建需要 Xcode Command Line Tools、[go.mod](../go.mod) 固定的 Go（当前 1.26.10）、Node.js 24（CI 为 24.16.0）和 CGO。在仓库根目录运行：
+本机源码构建需要 Xcode Command Line Tools、[go.mod](../go.mod) 固定的 Go（当前 1.26.10）、Node.js 24（CI 为 24.22.1）和 CGO。在仓库根目录运行：
 
 ```sh
 CGO_ENABLED=1 bash scripts/build-desktop-darwin.sh -Version v1.0.0-dev

diff --git a/docs/project-preparation.md b/docs/project-preparation.md
@@ -79,6 +79,8 @@ editable 安装，以及 requirements/Poetry/uv 专有锁文件需要先导出
 声明的 wheel 字节数也会核对。安装使用本地文件、`--no-index --no-deps
 --require-hashes --only-binary=:all: --target`，不执行源码构建。
 
+通用联网使用的 pip、证书包及既有镜像应按[运行时安全更新](ci.md#october-2026-runtime-security-updates)升级；下述版本是离线安装的兼容性下限。
+
 此入口当前使用 Standard Code Docker Engine。镜像需已包含 pip >=25.3；
 旧版本在安装记录中给出明确错误。依赖只写入任务的 `.traverse-preparation`
 私有目录，安装成功后才发布；解释器、兼容标签、环境或锁文件变化后需要

diff --git a/docs/windows-release.md b/docs/windows-release.md
@@ -30,7 +30,7 @@ If this artifact has expired, select a newer successful [Desktop release run](ht
 
 ### 从源码构建与启动 / Build and launch from source
 
-在仓库根目录使用 PowerShell、[go.mod](../go.mod) 固定的 Go（当前 1.26.10）与 Node.js 24（CI 为 24.16.0）：
+在仓库根目录使用 PowerShell、[go.mod](../go.mod) 固定的 Go（当前 1.26.10）与 Node.js 24（CI 为 24.22.1）：
 
 ```powershell
 .\scripts\build-desktop.ps1 -Version v1.0.0-dev