chore(security): pin dev/CI Node to 22.23.4 (CVE-2026-111497) (#353)

Pin the Node used for development, CI and publishing to the patched
22.23.4 release (CVE-2026-111497, Brotli decoder OOB write).

Files:
- .nvmrc: v18 -> v22.23.4
- .devcontainer/devcontainer.json: javascript-node:1-18-bullseye ->
  javascript-node:1-22-bullseye + node feature pinned to 22.23.4
- .github/workflows/react_release.yml: node-version 22 -> 22.23.4
- .github/workflows/ghr_backfill.yml: node-version 18 -> 22.23.4
- .github/workflows/react.yml: matrix leg '22' -> '22.23.4'
  (18/20/24 compatibility legs unchanged)

package.json engines (>=18.0.0) intentionally unchanged.

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: micahheineckoptimizely

.devcontainer/devcontainer.json

@@ -1,6 +1,11 @@
 {
   "name": "React SDK",
-  "image": "mcr.microsoft.com/devcontainers/javascript-node:1-18-bullseye",
+  "image": "mcr.microsoft.com/devcontainers/javascript-node:1-22-bullseye",
+  "features": {
+    "ghcr.io/devcontainers/features/node:1": {
+      "version": "22.23.4"
+    }
+  },
   "postCreateCommand": "npm i -g yarn@1.22.22 && yarn install",
   "customizations": {
     "vscode": {

.github/workflows/ghr_backfill.yml

@@ -36,7 +36,7 @@ jobs:
     - name: Set up Node
       uses: actions/setup-node@v4
       with:
-        node-version: 18
+        node-version: 22.23.4
 
     - name: Configure GHR auth
       run: echo "//npm.pkg.github.com/:_authToken=\${NODE_AUTH_TOKEN}" >> ~/.npmrc

.github/workflows/react.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node: [ '18', '20', '22', '24' ]
+        node: [ '18', '20', '22.23.4', '24' ]
     steps:
     - name: Checkout branch
       uses: actions/checkout@v4

.github/workflows/react_release.yml

@@ -25,7 +25,7 @@ jobs:
     - name: Set up Node
       uses: actions/setup-node@v4
       with:
-        node-version: 22
+        node-version: 22.23.4
         cache: 'npm'
 
     - name: Upgrade npm for OIDC support

.nvmrc

@@ -1 +1 @@
-v18
+v22.23.4