[bntvllnt]

Why

The 21 October 2026 Node.js security release fixes four HIGH-severity bugs: a Brotli decoder out-of-bounds write (remote code execution), two TLS hostname-check bypasses and a dns.resolve NUL truncation. Patched releases: 22.23.4, 24.22.1, 26.12.1 (https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Node 20 and older are end of life.

Files changed

File	Old	New
.github/workflows/ci.yml	node-version: 22 node-version: [18, 22]	node-version-file: .node-version node-version: [22.23.4, 24.22.1]
.github/workflows/publish.yml	node-version: 22 (×3)	node-version-file: .node-version (×3)
.node-version	—	24.22.1

Notes

• Published package: only CI and tooling pins change. engines.node (>=18) is not touched.
• The test matrix drops Node 18 (end of life) and tests the supported LTS lines 22 and 24 on their patched releases.
• Merging runs the Publish workflow on main, which publishes a canary build of the current version.

Checks

CI on 9c66346 (GitHub Actions, 2026-10-22):

• Tests (24.22.1, shard 3/4): pass
• Tests (24.22.1, shard 4/4): pass
• Quality Gates: pass
• Tests (22.23.4, shard 1/4): pass
• Tests (22.23.4, shard 2/4): pass
• Tests (22.23.4, shard 3/4): pass
• Tests (22.23.4, shard 4/4): pass
• Tests (24.22.1, shard 1/4): pass
• Tests (24.22.1, shard 2/4): pass

[github-actions]

Codebase Intelligence CI

Verdict: PASS
Base: origin/main
Mode: new-only
Changed workspaces: 1 workspace(s); 1 changed since origin/main; 0 cross-package cycle(s).

Gate	Verdict	Summary
check	pass	0 error(s), 0 warning(s) — PASS
health	pass	Health 67.00/0 pass; top risk src/analyzer/index.ts (86.18).

Codebase Intelligence

Verdict: PASS
Summary: 0 error(s), 0 warning(s) — PASS

No findings.