From 75febb50d12edb9b7d868d19c9c1749bb29c383b Mon Sep 17 00:00:00 2001 From: Chetan Sharma Date: Fri, 23 Oct 2026 12:09:38 +0530 Subject: [PATCH] chore(ci): unpin release Node and always resolve latest 22.x Remove the 22.22.1 pin from the release workflow now that nodejs/node#62425 is fixed, and set check-latest on setup-node in the test workflow and npm-publish action so jobs do not use an older 22.x cached on the runner image. The Oct 2026 Node security releases (22.23.4) fix CVE-2026-111497 and others. --- .github/actions/npm-publish/action.yml | 1 + .github/workflows/release.yml | 5 +---- .github/workflows/test.yml | 1 + 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/actions/npm-publish/action.yml b/.github/actions/npm-publish/action.yml index 90f3fca20..364686902 100644 --- a/.github/actions/npm-publish/action.yml +++ b/.github/actions/npm-publish/action.yml @@ -21,6 +21,7 @@ runs: uses: actions/setup-node@v4 with: node-version: ${{ inputs.node-version }} + check-latest: true cache: 'npm' registry-url: 'https://registry.npmjs.org' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f6c7ff9bd..4fda9464d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,10 +18,7 @@ jobs: release: uses: ./.github/workflows/npm-release.yml with: - # Pinned to 22.22.1 — 22.22.2 has a regression (nodejs/node#62425) where - # the bundled npm is missing promise-retry, breaking npm install -g npm@11. - # Revert to node-version: 22 once the upstream fix is released. - node-version: 22.22.1 + node-version: 22 require-build: true secrets: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 44e4ff770..da9c231ae 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -33,6 +33,7 @@ jobs: uses: actions/setup-node@v7 with: node-version: 22 + check-latest: true cache: 'npm' - name: Install dependencies