From aa62f44886b4ff1a18352ec2c68345151f85da3a Mon Sep 17 00:00:00 2001 From: Ben Brandt Date: Fri, 23 Oct 2026 11:19:16 +0200 Subject: [PATCH] ci: resolve latest Node LTS patches before using runner cache (#1404) ## Summary - Enable `check-latest: true` for all three Node setup steps: CI, stable publishing and preview publishing. - Preserve the existing `lts/*` policy, action pins, npm settings, package version and `engines.node` requirement. ## Why The latest sampled [CI](https://github.com/agentclientprotocol/claude-agent-acp/actions/runs/39865544394) and [preview publishing](https://github.com/agentclientprotocol/claude-agent-acp/actions/runs/39865544489) runs both selected cached Node **24.21.0**. That predates **24.22.1**, the fixed Node 24 release for the [October 21 security updates](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases), including CVE-2026-111497. ## Validation The same checks passed before and after: - Baseline on local Node **24.22.0**: `npm ci && npm run check && npm run build && npm run test:run`. - After on official Node **24.22.1** (archive SHA-256 verified): `npm ci && npm run check && npm run build && npm run test:run`. - Both runs: **3,272 passed, 30 skipped**; the skipped/integration coverage remains unverified. - Parsed workflow configuration to verify all three setup steps keep `lts/*` and enable `check-latest`. - Tests ran natively on macOS; GitHub runner selection remains to be confirmed by PR CI. No publish or release commands were run. ## Risk / rollout Low-risk CI-only runtime freshness change. Verify the next CI/stable/preview job's setup-node log resolves at least **24.22.1** for Node 24. Reverting restores cache-first selection, which can restore an unpatched runtime; it is not a mitigation. This patches the build/publishing environment, not end users' separately installed Node runtimes. No application-code or release-version changes are included. --- .github/workflows/ci.yml | 1 + .github/workflows/publish.yml | 2 ++ 2 files changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 39556691..9b0ce51a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,6 +27,7 @@ jobs: uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 with: node-version: "lts/*" + check-latest: true cache: "npm" - name: Install dependencies diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 4c03b4e8..ec203bbc 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -77,6 +77,7 @@ jobs: - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 with: node-version: "lts/*" + check-latest: true registry-url: "https://registry.npmjs.org" - run: npm ci - run: npm run build @@ -132,6 +133,7 @@ jobs: - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 with: node-version: "lts/*" + check-latest: true registry-url: "https://registry.npmjs.org" # Ahead of the version bump, so this still validates the committed lockfile. - run: npm ci