[cschetan77]

Changes

• release.yml: remove the 22.22.1 pin and go back to node-version: 22. The pin was a workaround for Possible NodeJS 22.22.2 regression when installing latest NPM nodejs/node#62425 (Node 22.22.2 shipped an npm missing promise-retry, which broke npm install -g npm@11). That issue was closed on 2026-05-14 and fixed in 22.22.3.
• test.yml and actions/npm-publish: add check-latest: true to actions/setup-node. Without it, node-version: 22 uses whatever 22.x is cached on the runner image. A recent test run used the cached 22.23.3.

Why now: the October 2026 Node security releases (22.23.4, 24.22.1, 26.12.1) fix CVE-2026-111497 (Brotli decoder out-of-bounds write, rated High) plus several TLS and DNS issues. The old pin would keep releases on an affected Node, and the cached 22.23.3 on the runners is also older than the fix.

This only affects build, test and release tooling.

References

• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• Possible NodeJS 22.22.2 regression when installing latest NPM nodejs/node#62425
• fix(release): revert v14.3.0 and fix release pipeline Node.js regression #2774 (introduced the pin)

Testing

CI-only change, not run locally. The "Setup Node" step in this PR's test run should show the latest 22.x (22.23.4 or newer) being downloaded instead of "Found in cache". The release workflow can only be exercised by a real release.

• This change adds unit test coverage
• This change adds integration test coverage
• This change has been tested on the latest version of the platform/language

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All code quality tools/guidelines have been run/followed
• All relevant assets have been compiled