From 0e924a723b3b2d8819807d646837874d4fac3e86 Mon Sep 17 00:00:00 2001
From: rrader26 <rrader26@gmail.com>
Date: Wed, 28 Oct 2026 11:54:07 -0400
Subject: [PATCH] fix(security): upgrade Node to patched release for
 CVE-2026-111497 (Node2Shell)

---
 .github/workflows/ci.yml            | 8 ++++----
 .github/workflows/release.yml       | 6 +++---
 packaging/README.md                 | 2 +-
 packaging/scripts/build-windows.ps1 | 2 +-
 packaging/scripts/common.sh         | 2 +-
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 30516b5..58f8d4e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [20, 22]
+        node-version: [22.23.4, 24.22.1]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -35,7 +35,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22.23.4
       - run: npm install --no-audit --no-fund
       - name: Install Chromium for playwright-core
         run: npx playwright-core install --with-deps chromium
@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22.23.4
       - run: npm install --no-audit --no-fund
       - run: npm run build
       - run: npm test
@@ -69,7 +69,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22.23.4
           registry-url: 'https://registry.npmjs.org'
       # `npm install` instead of `npm ci` — works around npm bug
       # https://github.com/npm/cli/issues/4828 where lockfiles
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 238240b..7d784df 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,7 +33,7 @@ jobs:
       - name: Setup Node (build-time)
         uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 22.23.4
           cache: 'pnpm'
 
       - name: Build .pkg
@@ -87,7 +87,7 @@ jobs:
       - name: Setup Node (build-time)
         uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 22.23.4
           cache: 'pnpm'
 
       - name: Setup .NET 8
@@ -126,7 +126,7 @@ jobs:
       - name: Setup Node (build-time)
         uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 22.23.4
           cache: 'pnpm'
 
       - name: Install FUSE (needed for appimagetool on Ubuntu 22+)
diff --git a/packaging/README.md b/packaging/README.md
index 943faa9..ad4092f 100644
--- a/packaging/README.md
+++ b/packaging/README.md
@@ -98,7 +98,7 @@ in parallel and uploads artifacts to the GitHub Release. See
 
 | Component | Version | Where |
 |---|---|---|
-| Node | 22.11.0 (LTS) | `packaging/scripts/common.sh:NODE_VERSION` |
+| Node | 22.23.4 (LTS) | `packaging/scripts/common.sh:NODE_VERSION` |
 | .NET | 8.0 | bridge `csproj` |
 | Swift | 5.9+ | bridge `Package.swift` |
 | WiX | 4.x | installed via `dotnet tool install --global wix` in the workflow |
diff --git a/packaging/scripts/build-windows.ps1 b/packaging/scripts/build-windows.ps1
index 518a44d..8abd6fe 100644
--- a/packaging/scripts/build-windows.ps1
+++ b/packaging/scripts/build-windows.ps1
@@ -22,7 +22,7 @@ $ProgressPreference = 'SilentlyContinue'
 # ──────────────────────────────────────────────────────────────────────
 # Pinned versions
 # ──────────────────────────────────────────────────────────────────────
-$NodeVersion = if ($env:NODE_VERSION) { $env:NODE_VERSION } else { '22.11.0' }
+$NodeVersion = if ($env:NODE_VERSION) { $env:NODE_VERSION } else { '22.23.4' }
 $BundleId = if ($env:BUNDLE_ID) { $env:BUNDLE_ID } else { 'ai.thinkfleet.agentmark' }
 $DisplayName = if ($env:DISPLAY_NAME) { $env:DISPLAY_NAME } else { 'ThinkFleet AgentMark' }
 
diff --git a/packaging/scripts/common.sh b/packaging/scripts/common.sh
index 40e7c54..91adbe9 100755
--- a/packaging/scripts/common.sh
+++ b/packaging/scripts/common.sh
@@ -5,7 +5,7 @@
 
 # Pinned Node runtime. Bump when needed — every platform installer
 # downloads from the official Node.js distribution.
-NODE_VERSION="${NODE_VERSION:-22.11.0}"
+NODE_VERSION="${NODE_VERSION:-22.23.4}"
 
 # Bundle identifier (macOS) + Microsoft Product ID semantics (Windows).
 BUNDLE_ID="${BUNDLE_ID:-ai.thinkfleet.agentmark}"