Pin Node 24.22.2, the current 24 LTS patch, keeping 24.22.1 as the security floor

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -40,7 +40,7 @@ body:
     attributes:
       label: OS, Node version, browser
       description: Include the versions you can find. Write "unknown" for anything unavailable.
-      placeholder: "Windows 11, Node 24.22.1, Chrome 151"
+      placeholder: "Windows 11, Node 24.22.2, Chrome 151"
     validations:
       required: true
   - type: input

.github/workflows/ci.yml

@@ -20,10 +20,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: [24.22.1, 26.x]
+        node: [24.22.2, 26.x]
     env:
       PUPPETEER_SKIP_DOWNLOAD: '1'
-      GEV_REQUIRE_ALLOCATION_GATE: ${{ matrix.node == '24.22.1' && '1' || '0' }}
+      GEV_REQUIRE_ALLOCATION_GATE: ${{ matrix.node == '24.22.2' && '1' || '0' }}
     steps:
       - name: Check out source
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -76,7 +76,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 24.22.1
+          node-version: 24.22.2
           cache: npm
 
       - name: Install locked dependencies and headless Chrome
@@ -131,7 +131,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 24.22.1
+          node-version: 24.22.2
           cache: npm
 
       - name: Run the Pinokio install path

CONTRIBUTING.md

@@ -11,8 +11,8 @@ fixes, including CVE-2026-111497 (a Brotli decoder flaw).
 ```bash
 git clone https://github.com/bilawalsidhu/gods-eye-view.git
 cd gods-eye-view
-nvm install 24.22.1
-nvm use 24.22.1
+nvm install 24.22.2
+nvm use 24.22.2
 npm install
 npm run doctor
 ./scripts/dev-fresh.sh        # or: npm run dev (keys are optional)

Dockerfile

@@ -4,7 +4,7 @@
 # proxies (ADS-B, AIS, Overpass, OpenAI Realtime, ...) as middleware, so there
 # is nothing else to containerise. See compose.yaml for the usual entry point.
 # Same Node as CI (package.json engines, .github/workflows), pinned by digest.
-FROM node:24.22.1-slim@sha256:be8204d4bd327363357f532187b752ff62759c31bedf98e9e18fc08c9cbd605c
+FROM node:24.22.2-slim@sha256:c86ecead9e55a5210ac1727de38a4ca840bf03dcaf34dc9749addbf383b1920c
 
 # Puppeteer is only used by the QA scripts; skip its ~150MB Chromium download.
 ENV PUPPETEER_SKIP_DOWNLOAD=1

changelog.d/1458-node-24-22-1-security-release.md

@@ -1,3 +1,4 @@
-- The Docker image and CI now pin Node 24.22.1, the first 24.x release with
-  the October 21, 2026 security fixes, including CVE-2026-111497 in the Brotli
-  decoder (Luis Ortiz, @anobjectn, #1458).
+- The Docker image and CI now pin Node 24.22.2, the current 24 LTS patch. It
+  carries the October 21, 2026 security fixes first released in 24.22.1,
+  including CVE-2026-111497 in the Brotli decoder (Luis Ortiz, @anobjectn,
+  #1458).

docs/CURRENT-STATE.md

@@ -3436,7 +3436,7 @@ down | auth-failed` (plus the unchanged `missing-key`/`unsupported`) with
 >   operator-side; the final accounting records only comparable population
 >   reductions and deterministic Node allocation/solve measurements. Those
 >   allocation gates were calibrated on Node.js 24.14.x and run in CI on the
->   pinned Node.js 24.22.1 with the same ceilings; `package.json` permits
+>   pinned Node.js 24.22.2 with the same ceilings; `package.json` permits
 >   supported product runtimes on Node 24 or 26, while the allocation runner
 >   separately enforces Node 24 for these two calibrated probes. Each probe
 >   compiles synchronously and discards explicit-GC
@@ -6183,8 +6183,9 @@ The lockfile uses DOMPurify 3.4.17, protobufjs 8.8.0, PostCSS 8.5.28,
 source-map-js 1.2.2 and nanoid 3.3.19. Cesium remains on 1.138.0. Browser QA
 uses Puppeteer 25.10.0; image-processing tools use Sharp 0.35.5. QA scripts await Puppeteer's asynchronous
 executable-path lookup before testing or passing the path to Chrome. Supported Node versions remain
-Node 24 (24.14.0 or later) and 26.x; the Docker image and CI pin 24.22.1, the first 24.x release with
-the October 21, 2026 Node.js security fixes (including CVE-2026-111497). Use
+Node 24 (24.14.0 or later) and 26.x; the Docker image and CI pin 24.22.2,
+the current 24 LTS patch, which carries the October 21, 2026 Node.js security
+fixes first released in 24.22.1 (including CVE-2026-111497). Use
 `npm ci` to reproduce the checked-in dependency tree.
 
 ### Traffic city navigation