Repository navigation
chore: restore Node 24.22.1 now that Workers Builds ships it - #1327
Conversation
Node 24.22.1 fixes the Brotli RCE (CVE-2026-111497 / GHSA-9v8h-qqgm-4m35). Workers Builds images include that release as of 2026-10-23, which was the blocker for the 24.18.0 pin in #1256. CI reads .nvmrc again. Co-authored-by: Zach Dunn <zachdunn@users.noreply.github.com>
|
|
Important Review skippedAuto reviews are limited based on label configuration. 🏷️ Required labels (at least one): 2
🚫 Excluded labels (none allowed): 1
Please check the settings in the CodeRabbit UI or the
|
.nvmrcis back on Node 24.22.1. Zach Dunn (@zachdunn) pinned 24.18.0 in #1256 because Workers Builds could not install 24.22.1. The Oct 23 build image includes 24.22.1, and that release fixes the actively exploited Brotli RCE (CVE-2026-111497 / GHSA-9v8h-qqgm-4m35).What it does
.nvmrcto24.22.1..nvmrc. Actions was already on 24.22.1 through a hardcodedNODE_VERSIONwhile.nvmrcstayed on 24.18.0.What it is not
enginesstays>=24.Test plan