[senthanal]

Resolves PFM-TASK-8708 (part of PFM-ISSUE-35253)

changelog: Platform Experience: [PFM-TASK-8708] Functionality: Node 22.23.4 security patch rollout (CVE-2026-111497) [PR github-actions#185]

Patches Node 22.15.0 → 22.23.4 on release/26.2 to address CVE-2026-111497 (Node2Shell, Brotli decoder). This is the 26.2 counterpart of #184 (26.1). Patch bump within Node 22, no Angular impact.

Files changed

File	Change
.github/workflows/fe-*.yml (11 files)	node-version: 22.15.0 → 22.23.4
.github/workflows/fe-e2e.yml	removed container cypress/browsers:22.15.0 (--user 1001); added actions/setup-node (v6.4.0, same SHA pin) with 22.23.4 after checkout, as on release/26.1
.nvmrc	v22.15.0 → v22.23.4
.tool-versions	nodejs 22.23.4, added npm 10.9.9
package.json	added engines (node 22.23.4 / npm 10.9.9, the npm bundled with 22.23.4); @types/node ^22.15.0 → ^22.20.5
package-lock.json	regenerated with npm install --package-lock-only on Node 22.23.4: root engines + @types/node only (same lock diff as #184)

fe-sonar.yml already uses node-version-file: .nvmrc; no change.

Points for review

• fe-e2e container removed. There is no cypress/browsers image for Node 22.23.x. The container came in with Test/use container cypress browsers #121 (PFM-ISSUE-33128, Cypress performance). Without it, the e2e job runs on the plain ubuntu-latest runner with its preinstalled browsers, as on release/26.1, and may run slower. The 26.2-only NODE_OPTIONS / CYPRESS_NO_COMMAND_LOG env vars are kept.
• Apart from those 26.2-only lines and the run-many@release/26.2 ref, fe-e2e.yml is now identical to the PFM-TASK-8694 - Roll out Node 22.23.4 to github-actions repo (26.1) #184 version.

Testing

• npm ci and npm test on Node 22.23.4: 51 passed, 8 failed. The same 8 tests fail on Node 22.15.0 with the same code, so this change did not cause them.
• prettier --check on changed files: OK.

Follow-up

• Merge order: github-actions → cplace-asc (v2.3.9) → frontend → backend. No Friday merges.

Developer Checklist:

• Updated documentation if needed
• Created Changelog according
  to Guidelines

🤖 Generated with Claude Code

[Kaltenbach]

Review note (CVE-2026-111497 roll-out, head bdff5ff):

All version bumps match the expected pattern. The one structural change is fe-e2e.yml: the job leaves the cypress/browsers container and runs with setup-node 22.23.4 on ubuntu-latest. The reasoning is right (Cypress has not published a Node 22 image since 22.21.0), but this changes the runtime of every partner e2e job on this line, and nothing in this repo's CI exercises it.

Could you link one green e2e run that used this branch (for example a cplace-fe run calling fe-e2e.yml@feature/PFM-TASK-8708-Roll-out-Node-22-23-4-to-github-actions-repo)? With that evidence I will approve.

[Kaltenbach]

Approved for the CVE-2026-111497 (Node2Shell) roll-out.

Reviewed head bdff5ffe07 against base release/26.2 (26.2 line):

• only the expected files changed (16 files: 12 fe-*.yml workflows, .nvmrc, .tool-versions, package.json, package-lock.json)
• every hunk is the expected substitution (Node 22.15.0 → 22.23.4 in every setup-node step, npm 10.9.2 → 10.9.9, new engines block, @types/node ^22.15.0 → ^22.20.5)
• package-lock.json compared structurally against the merge base: root engines block and the @types/node entry only
• no old Node pin left in workflows or root files of the head branch
• CI green at review time

Note on fe-e2e.yml: the job leaves the cypress/browsers:22.15.0 container (no Node 22.23.4 image exists, Cypress stopped publishing Node 22 images at 22.21.0) and runs with setup-node 22.23.4 on ubuntu-latest. This is a runtime change for every partner e2e job on this line and is not exercised by this repo's CI. Known and flagged in the review note above; we accept it for the security roll-out and verify it with the first real e2e run after the merge, with a follow-up if that run shows problems.

Review method: rule-based diff check with Claude Code, verified and approved by Christian Kaltenbach.