From 5846e9cef456c4356468f94145dca7e718e9e07c Mon Sep 17 00:00:00 2001
From: wfostersbp <70692712+wfostersbp@users.noreply.github.com>
Date: Thu, 22 Oct 2026 10:59:24 +0200
Subject: [PATCH] fix(node): bump bundled Node to 22.23.4 for the October 2026
 security release

Node.js 22.23.4 fixes CVE-2026-111497 (High, Brotli decoder out-of-bounds
write, remote code execution), CVE-2026-105482 (dns.resolve NUL truncation)
and CVE-2026-106069 (TLS hostname bypass), among others. The .deb bundles
the runtime, so the Pi ships whatever packaging/assemble.sh fetches; the
mise pin keeps CI testing on the same build.

Tracked in LABS-1035.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .mise.toml            | 2 +-
 AGENTS.md             | 2 +-
 packaging/assemble.sh | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.mise.toml b/.mise.toml
index a4a7d62..0353746 100644
--- a/.mise.toml
+++ b/.mise.toml
@@ -8,7 +8,7 @@
 # bump NODE_VERSION there, bump it here too.
 
 [tools]
-node = "22.20.0"
+node = "22.23.4"
 zizmor = "1.29.0"     # GitHub Actions security audit
 actionlint = "1.7.12" # GitHub Actions schema + expression lint
 
diff --git a/AGENTS.md b/AGENTS.md
index 0b7fe25..5fba90a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -58,7 +58,7 @@ that is a real choice.
 
 ## Development commands
 
-Use `mise`. It pins the toolchain — including Node `22.20.0`, the same version
+Use `mise`. It pins the toolchain — including Node `22.23.4`, the same version
 `packaging/assemble.sh` bundles into the `.deb` — and CI runs the same tasks, so
 local and CI cannot drift.
 
diff --git a/packaging/assemble.sh b/packaging/assemble.sh
index 928e0ed..60c097a 100755
--- a/packaging/assemble.sh
+++ b/packaging/assemble.sh
@@ -9,7 +9,7 @@ set -euo pipefail
 
 cd "$(dirname "$0")/.."  # repo root
 
-NODE_VERSION="${NODE_VERSION:-22.20.0}"   # current Node LTS line — override if newer
+NODE_VERSION="${NODE_VERSION:-22.23.4}"   # current Node LTS line — override if newer
 NODE_ARCH="${NODE_ARCH:-arm64}"
 STAGE="build/stage"
 OPT="$STAGE/opt/penplotter271"