From 43f964ec8a06c2f3fb0015ec4b8f9b8bd1db8f5e Mon Sep 17 00:00:00 2001
From: Affan Dar <affandar@hotmail.com>
Date: Wed, 21 Oct 2026 22:05:42 -0700
Subject: [PATCH] ci: run on Node.js 24.22.1 and 22.23.4 instead of end-of-life
 Node.js 20

Node.js 20 is end-of-life and gets no fix for the October 2026 security
release. Build, test and pack now use 24.22.1. The platform smoke tests use
22.23.4, the oldest Node.js line that still gets security fixes.

No package change. The addon uses N-API, and none of these CVEs touch
N-API. engines still says ">= 18".
---
 .github/workflows/build.yml | 16 ++++++++--------
 CHANGELOG.md                |  6 ++++++
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3919933..8f7a640 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -39,7 +39,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: "24.22.1"
       - name: Set up Rust from repository toolchain
         shell: bash
         run: |
@@ -69,7 +69,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: "24.22.1"
       - name: Start PostgreSQL
         run: |
           sudo systemctl start postgresql.service
@@ -93,7 +93,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: "24.22.1"
       - name: Install dependencies
         run: npm install --omit=optional --ignore-scripts --no-audit --no-fund --package-lock=false
       - name: Download all binary artifacts
@@ -136,23 +136,23 @@ jobs:
           - os: ubuntu-latest
             platform: linux-x64-gnu
             shell: bash
-            node: 20
+            node: "22.23.4"
           - os: ubuntu-24.04-arm
             platform: linux-arm64-gnu
             shell: bash
-            node: 20
+            node: "22.23.4"
           - os: macos-14        # arm64
             platform: darwin-arm64
             shell: bash
-            node: 20
+            node: "22.23.4"
           - os: macos-15-intel  # x64
             platform: darwin-x64
             shell: bash
-            node: 20
+            node: "22.23.4"
           - os: windows-latest
             platform: windows-x64
             shell: pwsh
-            node: 20
+            node: "22.23.4"
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1a4ec59..8e052df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- **CI runs on patched Node.js** — build, test and pack use Node.js `24.22.1`; the
+  platform smoke tests use `22.23.4`. Both are the October 2026 security releases.
+  CI used Node.js 20 before, which is end-of-life and gets no security fixes.
+
 ## [0.2.2] - 2026-10-21
 
 ### Changed