From 47ab411a150771fe9fdc45df3108148828037a06 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Thu, 22 Oct 2026 09:35:04 -0500 Subject: [PATCH] fix(ci): pin supported Node security patch versions --- .github/workflows/apidocs-drift.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/coverage.yml | 2 +- .github/workflows/js.yml | 10 +++++----- .github/workflows/nightly.yml | 2 +- .github/workflows/publish-js.yml | 12 ++++++------ .github/workflows/publish-wasm.yml | 2 +- .github/workflows/site.yml | 4 ++-- 8 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/apidocs-drift.yml b/.github/workflows/apidocs-drift.yml index 28bbe3950..57de51fd4 100644 --- a/.github/workflows/apidocs-drift.yml +++ b/.github/workflows/apidocs-drift.yml @@ -92,7 +92,7 @@ jobs: - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: - node-version: "22" + node-version: "22.23.4" cache: pnpm cache-dependency-path: crates/bashkit-js/pnpm-lock.yaml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 742f01b87..d144507e4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -230,7 +230,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: - node-version: "22" + node-version: "22.23.4" - name: Security audit (cargo, npm, PyPI) # Lockfile discovery and the advisory suppression lists live in the diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index c70828d04..7483003ba 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -163,7 +163,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: - node-version: "22" + node-version: "22.23.4" cache: pnpm cache-dependency-path: crates/bashkit-js/pnpm-lock.yaml diff --git a/.github/workflows/js.yml b/.github/workflows/js.yml index bc411705f..2a9093395 100644 --- a/.github/workflows/js.yml +++ b/.github/workflows/js.yml @@ -54,7 +54,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: - node-version: "22" + node-version: "22.23.4" cache: pnpm cache-dependency-path: crates/bashkit-js/pnpm-lock.yaml @@ -82,10 +82,10 @@ jobs: version: "20" run: "node" - runtime: node - version: "22" + version: "22.23.4" run: "node" - runtime: node - version: "24" + version: "24.22.1" run: "node" - runtime: node version: "latest" @@ -134,7 +134,7 @@ jobs: if: matrix.runtime != 'node' uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: - node-version: "22" + node-version: "22.23.4" cache: pnpm cache-dependency-path: | crates/bashkit-js/pnpm-lock.yaml @@ -259,7 +259,7 @@ jobs: version: 10.33.0 - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: - node-version: "24" + node-version: "24.22.1" cache: pnpm cache-dependency-path: crates/bashkit-js/pnpm-lock.yaml - run: pnpm install --frozen-lockfile diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 7772d04a5..e0f3fc3a3 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -77,7 +77,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: - node-version: "22" + node-version: "22.23.4" - name: Security audit (cargo, npm, PyPI) run: ./scripts/audit-lockfiles.sh diff --git a/.github/workflows/publish-js.yml b/.github/workflows/publish-js.yml index 9e6916915..909ab7c97 100644 --- a/.github/workflows/publish-js.yml +++ b/.github/workflows/publish-js.yml @@ -93,7 +93,7 @@ jobs: - name: Setup node uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: - node-version: 24 + node-version: "24.22.1" cache: pnpm cache-dependency-path: crates/bashkit-js/pnpm-lock.yaml @@ -182,7 +182,7 @@ jobs: - host: macos-latest target: x86_64-apple-darwin architecture: x64 - node: ["20", "22", "24"] + node: ["20", "22.23.4", "24.22.1"] runs-on: ${{ matrix.settings.host }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -274,7 +274,7 @@ jobs: # repository code runs. Mask the output before crossing the step boundary. - name: Fetch OpenAI example key id: openai - if: steps.doppler.outputs.available == 'true' && !(runner.os == 'Windows' && matrix.node == '24') + if: steps.doppler.outputs.available == 'true' && !(runner.os == 'Windows' && matrix.node == '24.22.1') shell: bash env: DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }} @@ -284,7 +284,7 @@ jobs: printf 'OPENAI_API_KEY=%s\n' "$key" >> "$GITHUB_OUTPUT" - name: Run AI examples - if: steps.doppler.outputs.available == 'true' && !(runner.os == 'Windows' && matrix.node == '24') + if: steps.doppler.outputs.available == 'true' && !(runner.os == 'Windows' && matrix.node == '24.22.1') shell: bash env: OPENAI_API_KEY: ${{ steps.openai.outputs.OPENAI_API_KEY }} @@ -305,7 +305,7 @@ jobs: target: - x86_64-unknown-linux-gnu - aarch64-unknown-linux-gnu - node: ["20", "22", "24"] + node: ["20", "22.23.4", "24.22.1"] runs-on: ${{ contains(matrix.target, 'aarch64') && 'ubuntu-24.04-arm' || 'ubuntu-latest' }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -504,7 +504,7 @@ jobs: - name: Setup node uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: - node-version: 24 + node-version: "24.22.1" cache: pnpm cache-dependency-path: crates/bashkit-js/pnpm-lock.yaml registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/publish-wasm.yml b/.github/workflows/publish-wasm.yml index 7e2612d11..ad41a8449 100644 --- a/.github/workflows/publish-wasm.yml +++ b/.github/workflows/publish-wasm.yml @@ -128,7 +128,7 @@ jobs: - name: Setup node uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: - node-version: 24 + node-version: "24.22.1" registry-url: "https://registry.npmjs.org" - name: Download pkg diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml index 891c6a704..c0d2e7181 100644 --- a/.github/workflows/site.yml +++ b/.github/workflows/site.yml @@ -44,7 +44,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: - node-version: "22" + node-version: "22.23.4" - name: Verify docs route metadata run: node site/scripts/verify-doc-routes.mjs @@ -66,7 +66,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: - node-version: "22" + node-version: "22.23.4" cache: pnpm cache-dependency-path: site/pnpm-lock.yaml - name: Install dependencies