[ktsu2i]

Summary

• Bump .node-version from 24.22.0 to 24.22.1, the 24.x patch from the October 21, 2026 Node.js security release.
• 24.22.0 is affected by 4 high, 3 medium and 1 low CVEs.

Details

• Production is static assets on Cloudflare Workers, so Node only runs at build time and in CI.
• The build does fetch external content over HTTPS: the Bengo4 RSS feed, X oEmbed, and OGP pages for link cards. That makes CVE-2026-111497 (Brotli decoder out-of-bounds write, possible RCE) and the TLS hostname verification bypasses (CVE-2026-105483 / CVE-2026-106069) relevant in theory. Exploitation is unlikely, but the upgrade is a one-line change.
• @types/node stays at 24.x because it only tracks the Node major version.
• Local asdf (node-build) has no definition for 24.22.1 yet; it is pending in Scraped latest definitions nodenv/node-build#1143.

Test Plan

• CI workflows pass, and their logs show Node v24.22.1
• The Cloudflare Workers Build succeeds and its log shows Node v24.22.1

🤖 Generated with Claude Code

[github-actions]

Code Metrics Report

	main (ca36d6d)	#124 (bf1c8f6)	+/-
Coverage	100.0%	100.0%	0.0%
Test Execution Time	4s	6s	+2s

Details

  |                     | main (ca36d6d) | #124 (bf1c8f6) | +/-  |
  |---------------------|----------------|----------------|------|
  | Coverage            |         100.0% |         100.0% | 0.0% |
  |   Files             |             28 |             28 |    0 |
  |   Lines             |            209 |            209 |    0 |
  |   Covered           |            209 |            209 |    0 |
- | Test Execution Time |             4s |             6s |  +2s |

---

Reported by octocov