[senthanal]

Resolves PFM-TASK-8711 (part of PFM-ISSUE-35254)

changelog: Platform Experience: [PFM-TASK-8711] Functionality: Node 22.23.4 security patch rollout (CVE-2026-111497) [PR github-actions#186]

Patches Node 22.15.0 → 22.23.4 on release/26.3 to address CVE-2026-111497 (Node2Shell, Brotli decoder). This is the 26.3 counterpart of #184 (26.1) and #185 (26.2); the commit is the #185 change applied on release/26.3 without conflicts. Patch bump within Node 22, no Angular impact.

Files changed

File	Change
.github/workflows/fe-*.yml (11 files)	node-version: 22.15.0 → 22.23.4
.github/workflows/fe-e2e.yml	removed container cypress/browsers:22.15.0 (--user 1001); added actions/setup-node (v6.4.0, same SHA pin as the other workflows) with 22.23.4 after checkout, as on release/26.1
.nvmrc	v22.15.0 → v22.23.4
.tool-versions	nodejs 22.23.4, added npm 10.9.9
package.json	added engines (node 22.23.4 / npm 10.9.9, the npm bundled with 22.23.4); @types/node ^22.15.0 → ^22.20.5
package-lock.json	root engines + @types/node only (same lock diff as #184 / #185)

fe-sonar.yml already uses node-version-file: .nvmrc; no change.

Points for review

• fe-e2e container removed. There is no cypress/browsers image for Node 22.23.x. Without it, the e2e job runs on the plain ubuntu-latest runner with its preinstalled browsers, as on release/26.1, and may run slower. The NODE_OPTIONS / CYPRESS_NO_COMMAND_LOG env vars are kept.
• Apart from the run-many@release/26.3 ref, fe-e2e.yml matches the PFM-TASK-8708 - Roll out Node 22.23.4 to github-actions repo (26.2) #185 version.

Testing

• Not run locally for 26.3 (same change as PFM-TASK-8708 - Roll out Node 22.23.4 to github-actions repo (26.2) #185, whose tests were run on Node 22.23.4). CI must be green.

Follow-up

• Merge order: github-actions → cplace-asc (v2.3.9) → frontend → backend. No Friday merges.

Developer Checklist:

• Updated documentation if needed
• Created Changelog according
  to Guidelines

🤖 Generated with Claude Code

[Kaltenbach]

Review note (CVE-2026-111497 roll-out, head 40b0620):

All version bumps match the expected pattern. As in #185, fe-e2e.yml leaves the cypress/browsers container and runs with setup-node 22.23.4 on ubuntu-latest (no Node 22 Cypress image newer than 22.21.0 exists). This changes the runtime of every partner e2e job on 26.3 and nothing in this repo's CI exercises it.

Could you link one green e2e run that used this branch (for example a cplace-fe release/26.3 run calling fe-e2e.yml@feature/PFM-TASK-8711-Roll-out-Node-22-23-4-to-github-actions-repo)? With that evidence I will approve.