[ryancbahan]

WHY are these changes introduced?

The Oct 21 Node.js security releases — 22.23.4, 24.22.1 and 26.12.1 — fix high-severity issues in TLS hostname checks for non-canonical IP addresses, dns.resolve with NUL bytes, and an out-of-bounds write in Brotli.

Every Node version pinned in this repo (as of main @ 8fa26af) was on an affected release. None of these pins reach users — the CLI doesn't ship Node — they only control what our own developers run locally and what CI runs. This PR moves all of them to the patched release in their line.

Context: Slack thread

WHAT is this pull request doing?

Pure version-string bumps, no logic changes:

Old	New	Where
26.1.0	26.12.1	.nvmrc, dev.yml, DEFAULT_NODE_VERSION in tests-pr / tests-main / tests-manual, test matrices + if: guards, maintenance-prs, gardener-backlog-prs, update-graphql-deps
24.12.0	24.22.1	release.yml (3 jobs)
24.1.0	24.22.1	PLAYWRIGHT_NODE_VERSION, test matrices
22.12.0	22.23.4	test matrices (tests-pr, tests-main, tests-manual)

All three target versions are confirmed present on the Node release index as security: true releases and are the latest in their lines. The sharding include/exclude entries in tests-pr.yml and the matrix.node == … guards in tests-main.yml were updated in lockstep so they still match the matrix.

Deliberately unchanged (audited, not pins of a runtime we install):

• engines.node: ">=22.12.0" in the package.json files — this is the user-facing minimum supported version. Raising it would be a product/breaking-change decision, not a CVE fix.
• pages.yml node-version: "22" — major-only pin, already resolves to the latest (patched) 22.x.
• @types/node and node_version values in test fixtures — not runtime versions.

Note

Reviewer call-out: the 22.12.0 matrix entry matched engines.node, so it may have been giving us exact-minimum-version coverage. Bumping it to 22.23.4 means CI no longer exercises the floor, and 22.x minor releases can add APIs that 22.12 lacks. If we'd rather keep that coverage, the alternative is to leave 22.12.0 in the matrix only (ephemeral CI runners executing trusted code are low-risk for these specific CVEs) and bump everything else. Happy to go either way.

How to manually test your changes?

• nvm use / dev up should now install Node v26.12.1.
• CI on this PR runs the full matrix on the new versions — green checks are the test.
• Optional: trigger tests-manual.yml via workflow_dispatch and confirm the Node version dropdown offers 22.23.4 / 24.22.1 / 26.12.1.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows) — matrix covers all three; versions have binaries for every platform in the release index.
• I've considered possible documentation changes — none; user-facing supported range is unchanged.
• I've considered analytics changes to measure impact — n/a.
• The change is not user-facing — no changeset needed (same as the previous Node bump in 82cf498).

[ryancbahan]

The Type check failure on the first run was a pre-existing race in CI, not related to this change — it passed on re-run with no code changes. Root cause (type-check and build sharing dist/tsconfig.tsbuildinfo, leading downstream tsc -b to re-emit cli-kit/dist while other tasks read it) is explained and fixed in #8983.