chore(deps): build and test on Node 24.22.1 for the Brotli decoder fix

.changeset/brotli-patched-node.md

@@ -0,0 +1,11 @@
+---
+"nostream": patch
+---
+
+chore(deps): build and test on Node 24.22.1, which patches the Brotli decoder
+
+CVE-2026-111497 is an out-of-bounds write in every Brotli decoder up to 1.2.0,
+reachable by anything that decodes a `br` stream. Node bundles its own decoder,
+so the fix is the Node release: 24.22.1 on the 24 line. `.nvmrc` and both
+Dockerfile stages move from floating `node:24-alpine` to a pinned
+`node:24.22.1-alpine`.

.nvmrc

@@ -1 +1 @@
-v24.14.1
+v24.22.1

Dockerfile

@@ -1,6 +1,6 @@
 ARG PNPM_VERSION=10.33.0
 
-FROM node:24-alpine AS build
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build
 
 ARG PNPM_VERSION
 
@@ -14,7 +14,7 @@ COPY . .
 
 RUN pnpm build
 
-FROM node:24-alpine
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 
 ARG PNPM_VERSION