[Security] Upgrade Node.js to release containing eMudhra CA blocklist #8

Priority assessment

Security follow-up, not urgent: this is a Node OpenTelemetry example repository.

Why this matters

Node.js historically accepted TLS chains through the compromised eMudhra intermediates because its embedded Mozilla root store did not have browser-style online revocation/blocklist handling. Node merged an SPKI blocklist for all eight compromised intermediates on 20 October 2026, but the change must be backported and released on each active Node line.

• Incident: https://emudhra.we-have-a-problem.com/
• Upstream fix: nodejs/node@d9a3f3d
• Upstream PR/backport status: tls: reject chains containing blocked public keys nodejs/node#66871

The latest public Node releases observed during this audit—v26.12.0, v24.22.0, and v22.23.3—predate the fix and must not be treated as patched merely because they are currently latest.

Repository evidence

• Dockerfile:2 — FROM node:18
• package.json — Node package/build manifest

Required remediation

1. Inventory every Node version used by this repository in development, CI, package publishing, container builds, and production runtime.
2. Upgrade each supported release line to the first Node release whose source contains commit d9a3f3d150f7959f2d448d9a61aa11f5a75aa2b3 (or its official backport). Verify this from Node's release notes/source tag; do not assume an older "latest" tag contains the fix.
3. If this repository uses an end-of-life major (for example Node 10, 14, 16, or 18), migrate to a supported major that contains the fix instead of waiting for a backport that will not arrive.
4. Update all applicable pins: Docker base tags/digests, actions/setup-node inputs, .nvmrc, .node-version, tool-version files, package engines.node, release workflows, and documentation.
5. Rebuild containers, server bundles, CLIs, desktop applications, extensions, actions, and published packages from a clean dependency/base-image cache. Redeploy runtime artifacts through the normal release process where applicable.
6. Keep TLS verification enabled. Do not use NODE_TLS_REJECT_UNAUTHORIZED=0, rejectUnauthorized: false, broad custom trust roots, or similar bypasses.

Acceptance criteria

• Every Node execution surface used by this repository is documented in the fixing PR, including CI/build-only usage when there is no production Node runtime.
• Each selected Node release is proven to contain the upstream SPKI-blocklist fix or an official backport of it.
• Pinned Node versions, images, workflows, and engine constraints are updated consistently; obsolete majors are removed where applicable.
• With default TLS verification enabled, Node rejects https://dv-g3b-emudhra.we-have-a-problem.com/ with a certificate-validation error.
• The same updated Node runtime successfully connects to a normal trusted HTTPS endpoint.
• Relevant dependency installation, lint, unit, integration, build, packaging, and release checks pass.
• Any shipped artifact is rebuilt without stale base-image/dependency caches and redeployed or republished where applicable.
• The fixing PR links this issue and records process.version, the release/backport evidence, TLS-test output, and build/deployment evidence.

Scope note

This issue covers Node's embedded trust-policy fix. Updated host/container CA packages and other affected runtimes or dependency bundles remain separate requirements for the wider eMudhra incident response.