fix(ci): pin supported Node security patch versions

.github/workflows/apidocs-drift.yml

@@ -92,7 +92,7 @@ jobs:
 
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
-          node-version: "22"
+          node-version: "22.23.4"
           cache: pnpm
           cache-dependency-path: crates/bashkit-js/pnpm-lock.yaml
 

.github/workflows/ci.yml

@@ -230,7 +230,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
-          node-version: "22"
+          node-version: "22.23.4"
 
       - name: Security audit (cargo, npm, PyPI)
         # Lockfile discovery and the advisory suppression lists live in the

.github/workflows/coverage.yml

@@ -163,7 +163,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
-          node-version: "22"
+          node-version: "22.23.4"
           cache: pnpm
           cache-dependency-path: crates/bashkit-js/pnpm-lock.yaml
 

.github/workflows/js.yml

@@ -54,7 +54,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
-          node-version: "22"
+          node-version: "22.23.4"
           cache: pnpm
           cache-dependency-path: crates/bashkit-js/pnpm-lock.yaml
 
@@ -82,10 +82,10 @@ jobs:
             version: "20"
             run: "node"
           - runtime: node
-            version: "22"
+            version: "22.23.4"
             run: "node"
           - runtime: node
-            version: "24"
+            version: "24.22.1"
             run: "node"
           - runtime: node
             version: "latest"
@@ -134,7 +134,7 @@ jobs:
         if: matrix.runtime != 'node'
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
-          node-version: "22"
+          node-version: "22.23.4"
           cache: pnpm
           cache-dependency-path: |
             crates/bashkit-js/pnpm-lock.yaml
@@ -259,7 +259,7 @@ jobs:
           version: 10.33.0
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
-          node-version: "24"
+          node-version: "24.22.1"
           cache: pnpm
           cache-dependency-path: crates/bashkit-js/pnpm-lock.yaml
       - run: pnpm install --frozen-lockfile

.github/workflows/nightly.yml

@@ -77,7 +77,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
-          node-version: "22"
+          node-version: "22.23.4"
 
       - name: Security audit (cargo, npm, PyPI)
         run: ./scripts/audit-lockfiles.sh

.github/workflows/publish-js.yml

@@ -93,7 +93,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
-          node-version: 24
+          node-version: "24.22.1"
           cache: pnpm
           cache-dependency-path: crates/bashkit-js/pnpm-lock.yaml
 
@@ -182,7 +182,7 @@ jobs:
           - host: macos-latest
             target: x86_64-apple-darwin
             architecture: x64
-        node: ["20", "22", "24"]
+        node: ["20", "22.23.4", "24.22.1"]
     runs-on: ${{ matrix.settings.host }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -274,7 +274,7 @@ jobs:
       # repository code runs. Mask the output before crossing the step boundary.
       - name: Fetch OpenAI example key
         id: openai
-        if: steps.doppler.outputs.available == 'true' && !(runner.os == 'Windows' && matrix.node == '24')
+        if: steps.doppler.outputs.available == 'true' && !(runner.os == 'Windows' && matrix.node == '24.22.1')
         shell: bash
         env:
           DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }}
@@ -284,7 +284,7 @@ jobs:
           printf 'OPENAI_API_KEY=%s\n' "$key" >> "$GITHUB_OUTPUT"
 
       - name: Run AI examples
-        if: steps.doppler.outputs.available == 'true' && !(runner.os == 'Windows' && matrix.node == '24')
+        if: steps.doppler.outputs.available == 'true' && !(runner.os == 'Windows' && matrix.node == '24.22.1')
         shell: bash
         env:
           OPENAI_API_KEY: ${{ steps.openai.outputs.OPENAI_API_KEY }}
@@ -305,7 +305,7 @@ jobs:
         target:
           - x86_64-unknown-linux-gnu
           - aarch64-unknown-linux-gnu
-        node: ["20", "22", "24"]
+        node: ["20", "22.23.4", "24.22.1"]
     runs-on: ${{ contains(matrix.target, 'aarch64') && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -504,7 +504,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
-          node-version: 24
+          node-version: "24.22.1"
           cache: pnpm
           cache-dependency-path: crates/bashkit-js/pnpm-lock.yaml
           registry-url: "https://registry.npmjs.org"

.github/workflows/publish-wasm.yml

@@ -128,7 +128,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
-          node-version: 24
+          node-version: "24.22.1"
           registry-url: "https://registry.npmjs.org"
 
       - name: Download pkg

.github/workflows/site.yml

@@ -44,7 +44,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
-          node-version: "22"
+          node-version: "22.23.4"
       - name: Verify docs route metadata
         run: node site/scripts/verify-doc-routes.mjs
 
@@ -66,7 +66,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
-          node-version: "22"
+          node-version: "22.23.4"
           cache: pnpm
           cache-dependency-path: site/pnpm-lock.yaml
       - name: Install dependencies