[marcel-rbro]

Why?

setup-node without check-latest uses the runner's cached Node release, which can lag behind security patches. The October 2026 Node.js security releases fix a high-severity Brotli decoder RCE (CVE-2026-111497) and TLS hostname verification issues across 22.x, 24.x, and 26.x (fixed in 22.23.4, 24.22.1, 26.12.1). The risk in CI is low, but release and publish jobs run with credentials, so this is worth the hygiene fix.

Same change as apify/apify-docs#3129.

What?

• Add check-latest: true to all 4 setup-node steps (3 workflows), so CI resolves the newest patch release of each Node line

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.66%. Comparing base (25a64b6) to head (7a44042).
⚠️ Report is 6 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1191   +/-   ##
=======================================
  Coverage   95.66%   95.66%           
=======================================
  Files          61       61           
  Lines        6465     6465           
=======================================
  Hits         6185     6185           
  Misses        280      280           

Flag	Coverage Δ
integration	91.43% <ø> (-0.04%)	⬇️
unit	90.36% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[marcel-rbro]

Same fix as apify/apify-docs#3129, which was reviewed and approved by the Tooling team. This PR uses essentially the same approach: check-latest: true on the setup-node steps.