fix(security): upgrade Node to patched release for CVE-2026-111497 (Node2Shell)

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [20, 22]
+        node-version: [22.23.4, 24.22.1]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -35,7 +35,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22.23.4
       - run: npm install --no-audit --no-fund
       - name: Install Chromium for playwright-core
         run: npx playwright-core install --with-deps chromium
@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22.23.4
       - run: npm install --no-audit --no-fund
       - run: npm run build
       - run: npm test
@@ -69,7 +69,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22.23.4
           registry-url: 'https://registry.npmjs.org'
       # `npm install` instead of `npm ci` — works around npm bug
       # https://github.com/npm/cli/issues/4828 where lockfiles

.github/workflows/release.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Setup Node (build-time)
         uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 22.23.4
           cache: 'pnpm'
 
       - name: Build .pkg
@@ -87,7 +87,7 @@ jobs:
       - name: Setup Node (build-time)
         uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 22.23.4
           cache: 'pnpm'
 
       - name: Setup .NET 8
@@ -126,7 +126,7 @@ jobs:
       - name: Setup Node (build-time)
         uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 22.23.4
           cache: 'pnpm'
 
       - name: Install FUSE (needed for appimagetool on Ubuntu 22+)

packaging/README.md

@@ -98,7 +98,7 @@ in parallel and uploads artifacts to the GitHub Release. See
 
 | Component | Version | Where |
 |---|---|---|
-| Node | 22.11.0 (LTS) | `packaging/scripts/common.sh:NODE_VERSION` |
+| Node | 22.23.4 (LTS) | `packaging/scripts/common.sh:NODE_VERSION` |
 | .NET | 8.0 | bridge `csproj` |
 | Swift | 5.9+ | bridge `Package.swift` |
 | WiX | 4.x | installed via `dotnet tool install --global wix` in the workflow |

packaging/scripts/build-windows.ps1

@@ -22,7 +22,7 @@ $ProgressPreference = 'SilentlyContinue'
 # ──────────────────────────────────────────────────────────────────────
 # Pinned versions
 # ──────────────────────────────────────────────────────────────────────
-$NodeVersion = if ($env:NODE_VERSION) { $env:NODE_VERSION } else { '22.11.0' }
+$NodeVersion = if ($env:NODE_VERSION) { $env:NODE_VERSION } else { '22.23.4' }
 $BundleId = if ($env:BUNDLE_ID) { $env:BUNDLE_ID } else { 'ai.thinkfleet.agentmark' }
 $DisplayName = if ($env:DISPLAY_NAME) { $env:DISPLAY_NAME } else { 'ThinkFleet AgentMark' }
 

packaging/scripts/common.sh

@@ -5,7 +5,7 @@
 
 # Pinned Node runtime. Bump when needed — every platform installer
 # downloads from the official Node.js distribution.
-NODE_VERSION="${NODE_VERSION:-22.11.0}"
+NODE_VERSION="${NODE_VERSION:-22.23.4}"
 
 # Bundle identifier (macOS) + Microsoft Product ID semantics (Windows).
 BUNDLE_ID="${BUNDLE_ID:-ai.thinkfleet.agentmark}"