Luis OrtizandClaude Sonnet 5.5 2a335a8f35 fix(deps): pin Node 24.22.1 for the October 21, 2026 security release ...

Node.js 24.14.0 carries CVE-2026-111497 ("Node2Shell"), an out-of-bounds
write in the bundled Brotli decoder that can lead to remote code
execution, plus several high-severity DNS, TLS and URL-parsing fixes.
24.22.1 is the first patched 24.x release.

- Dockerfile: node:24.22.1-slim, digest re-pinned to the multi-arch index
- CI: 24.22.1 in the verify matrix and the other two jobs; the
  allocation-gate requirement now keys on 24.22.1
- Docs: contributor setup and the dependency baseline name 24.22.1

The engines floor and the setup doctor are unchanged.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

2026-10-28 15:34:04 -04:00

..

ci.yml

fix(deps): pin Node 24.22.1 for the October 21, 2026 security release

2026-10-28 15:34:04 -04:00