Repository navigation
Conversation
Patch Node 22.15.0 -> 22.23.4 on the 26.1 line: all hardcoded node-version pins in the fe-* workflows, .nvmrc, .tool-versions, package.json engines (node 22.23.4 / npm 10.9.9) and @types/node ^22.20.5. package-lock.json regenerated with npm 10.9.9. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
senthanal
requested review from
alekhya-cplace and
slaven3kopic
as code owners
October 27, 2026 17:34
senthanal
requested review from
vladimir-arsov
and removed request for
alekhya-cplace and
slaven3kopic
October 27, 2026 17:53
This was referenced Oct 27, 2026
Kaltenbach
approved these changes
Oct 28, 2026
Kaltenbach
left a comment
Kaltenbach
left a comment
Contributor
There was a problem hiding this comment.
Approved for the CVE-2026-111497 (Node2Shell) roll-out.
Reviewed head 6a955be40e against base release/26.1 (26.1 line):
- only the expected files changed (16 files)
- every hunk is the expected substitution (Node 22.15.0 → 22.23.4, npm 10.9.2 → 10.9.9, @types/node 22.15.0 → 22.20.5 (tarball and integrity verified against registry.npmjs.org))
- package-lock.json changes are limited to the root engines/version block and the @types/node entry
- no old Node pin left in workflows or root files of the head branch
- CI green at review time
Review method: rule-based diff check with Claude Code, verified and approved by Christian Kaltenbach.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves PFM-TASK-8694 (part of PFM-ISSUE-35242)
changelog: Platform Experience: [PFM-TASK-8694] Functionality: Node 22.23.4 security patch rollout (CVE-2026-111497) [PR github-actions#184]Patches Node
22.15.0→22.23.4onrelease/26.1to address CVE-2026-111497 (Node2Shell, Brotli decoder). Same pattern as the 24.20.0 rollout (#179). Patch bump within Node 22, no Angular impact.Files changed
.github/workflows/fe-*.yml(12 files)node-version: 22.15.0→22.23.4.nvmrcv22.15.0→v22.23.4.tool-versionsnodejs 22.23.4, addednpm 10.9.9package.jsonengines(node22.23.4/ npm10.9.9, the npm bundled with 22.23.4);@types/node^22.15.0→^22.20.5(latest 22.x types)package-lock.jsonnpm install --package-lock-onlyon Node 22.23.4: rootengines+@types/nodeonlyfe-sonar.ymlalready usesnode-version-file: .nvmrc; no change.Testing
npm ciandnpm teston Node 22.23.4: 51 passed, 8 failed. The same 8 tests (tools/scripts/artifacts/*) fail on unchangedrelease/26.1, so this change did not cause them.Follow-up
release/26.2/release/26.3. There,fe-e2e.ymluses containercypress/browsers:22.15.0. No 22.23.x Cypress image exists, so it will switch toactions/setup-nodewith 22.23.4.Developer Checklist:
to Guidelines
🤖 Generated with Claude Code