From 467d98b45fa2dc8e519f6786ca80ba8971b4dbf8 Mon Sep 17 00:00:00 2001
From: Duncan Faulkner <duncan@anglebrackets.dev>
Date: Fri, 23 Oct 2026 08:32:09 +0100
Subject: [PATCH] ci: pin Node 24.22.1 (October 2026 security release)

Node 26.12.1, 24.22.1 and 22.23.4 fix a remote code execution
vulnerability. Pin CI to Node 24.22.1.
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3ee1ab4..c40afd4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 24.19.0
+          node-version: 24.22.1
           cache: npm
       - run: npm ci
       - run: npm run build