fix: use patched Node runtimes for certificate security (#98)

Pin standalone builds to Node 26.12.1, managed connectors to 24.22.1,
and CI to supported security-patched Node lines.

Author: callumflack

.github/workflows/ci.yml

@@ -23,13 +23,13 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     strategy:
       matrix:
-        node-version: [20, 22]
+        node-version: [22.23.4, 24.22.1, 26.12.1]
     steps:
       - uses: actions/checkout@v5
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: 24
+          node-version: 24.22.1
       - run: echo "VANA_PDPP_NODE=$(command -v node)" >> "$GITHUB_ENV"
       - uses: actions/setup-node@v6
         with:
@@ -50,7 +50,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26.12.1
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm clean
@@ -69,7 +69,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26.12.1
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm clean
@@ -88,7 +88,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26.12.1
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm clean

.github/workflows/deploy-worker.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 22.23.4
       - run: npm ci
         working-directory: worker
       - run: npx wrangler deploy

.github/workflows/nextjs-starter.yml

@@ -46,7 +46,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 22.23.4
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm test test/examples/nextjs-starter.test.ts

.github/workflows/prerelease.yml

@@ -50,7 +50,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26.12.1
           cache: pnpm
           registry-url: https://registry.npmjs.org
       - run: pnpm install --frozen-lockfile
@@ -75,7 +75,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26.12.1
           cache: pnpm
           registry-url: https://registry.npmjs.org
       - run: pnpm install --frozen-lockfile
@@ -100,7 +100,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26.12.1
           cache: pnpm
           registry-url: https://registry.npmjs.org
       - run: pnpm install --frozen-lockfile

.github/workflows/release.yml

@@ -40,7 +40,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26.12.1
           cache: pnpm
           registry-url: https://registry.npmjs.org
       - run: pnpm install --frozen-lockfile
@@ -112,7 +112,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26.12.1
           cache: pnpm
           registry-url: https://registry.npmjs.org
       - run: pnpm install --frozen-lockfile
@@ -183,7 +183,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26.12.1
           cache: pnpm
           registry-url: https://registry.npmjs.org
       - run: pnpm install --frozen-lockfile
@@ -222,7 +222,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26.12.1
           cache: pnpm
           registry-url: https://registry.npmjs.org
       - run: pnpm install --frozen-lockfile
@@ -289,7 +289,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26.12.1
           cache: pnpm
           registry-url: https://registry.npmjs.org
       - run: pnpm install --frozen-lockfile

package.json

@@ -64,8 +64,8 @@
   },
   "scripts": {
     "build": "tsc --build && node ./scripts/copy-vendor.mjs",
-    "build:sea": "npx -y node@25 ./scripts/build-sea.mjs",
-    "build:sea:smoke": "npx -y node@25 ./scripts/build-sea.mjs --smoke",
+    "build:sea": "npx -y node@26.12.1 ./scripts/build-sea.mjs",
+    "build:sea:smoke": "npx -y node@26.12.1 ./scripts/build-sea.mjs --smoke",
     "clean": "node ./scripts/clean-build.mjs",
     "cli": "node dist/cli/bin.js",
     "demo:vhs": "pnpm build && node ./scripts/render-vhs.mjs",
@@ -106,7 +106,7 @@
     ]
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "dependencies": {
     "@inquirer/prompts": "8.3.0",

src/pdpp/host.ts

@@ -26,16 +26,16 @@ export function getPdppHome(): string {
  * SHASUMS256.txt values, so a download is checked against a hash that
  * shipped with the CLI rather than one fetched next to the tarball.
  */
-export const PDPP_NODE_VERSION = "24.21.0";
+export const PDPP_NODE_VERSION = "24.22.1";
 const PDPP_NODE_SHA256: Record<string, string> = {
   "darwin-arm64":
-    "bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057",
+    "89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7",
   "darwin-x64":
-    "1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097",
+    "d132557e7ee2b85af08b0c8c34338e65c6430f2238d01f727728ef42dc83b035",
   "linux-arm64":
-    "724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5",
+    "33c37be234ba8bee041961047b19160f4d7d0f164e8e246f78bdd10feff148b3",
   "linux-x64":
-    "6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff",
+    "eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c",
 };
 
 /** What a signed artifact's provenance asks of the machine running it. */