[cbeaudin-robotiq]

Upgrade CI Node.js to 22 (CVE-2026-111497)

Why

CVE-2026-111497 ("Node2Shell") is a memory-corruption bug in the Brotli decoder bundled with Node.js. A crafted Brotli stream can corrupt memory in whatever process decompresses it. Our build decompresses remote content: fetch() in fetch-profile-readme.js accepts Content-Encoding: br. Node 20, which CI and deploy use today, never got a fix.

What changed

• New .nvmrc (22): the single place that picks the Node release line for CI, deploy and local installs (nvm install / nvm use).

• .github/workflows/ci.yml and deploy.yml: node-version: 20 is replaced by node-version-file: .nvmrc with check-latest: true, so every run uses the newest 22.x patch instead of whatever version is cached on the runner.

• New scripts/check-node-version.js: fails unless the runtime is on a fixed release line at or above its first patched version:

  • 22.x ≥ 22.23.4

  • 24.x ≥ 24.22.1

  • 26.x ≥ 26.12.1

    Every other line fails the check: Node 20, the end-of-life odd lines (23, 25), and any release line not in the list.

• package.json: engines.node goes from >=20.0 to ^22.23.4 || ^24.22.1 || ^26.12.1, matching the check, so npm warns on install too.

To move to a new release line: add its first fixed version to FIXED in check-node-version.js, then update engines and .nvmrc.

Testing

• CI passes on this branch and the "Check Node.js version" step logs that the runtime isn't affected
• setup-node resolves the latest 22.x from .nvmrc (see the step log)
• Locally, node scripts/check-node-version.js exits 1 on a vulnerable Node version (e.g. 20.x)

Reference

https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

[mbegin-robotiq]

Approving: the check logic is correct. I ran isFixed against 20.19.0, 22.23.3/4, 22.24.0, 22.9.9, 23.0.0, 24.22.0/1, 26.12.1, 27.0.0, 22.23.4-rc.1 and 22.23, and every result was right; odd version strings are rejected. The inline threads are follow-ups, and the first two are worth doing before or soon after merge.

Note that CI hasn't run on this branch yet: the only run is in action_required and needs a maintainer to approve it.