Repository navigation
ci: run tests on Node 24 instead of EOL Node 23 - #222
taylanpince wants to merge 2 commits into
Conversation
Node.js ships its own root store, which trusted the compromised eMudhra intermediates until v26.12.1, v24.22.1 and v22.23.4. Pin a patched release. See https://emudhra.we-have-a-problem.com/ Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q1Vsk7Jb4cDNF21XuYhjHk
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c3dc2e36da
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 23 | ||
| node-version: 24 |
There was a problem hiding this comment.
On runners that already cache an older 24.x build, this major-only spec can still select the vulnerable build: setup-node@v4 defaults check-latest to false and checks its local cache for any matching semver before downloading (setup-node documentation). Since the security fixes first appear in 24.22.1 (Node.js advisory), this workflow does not guarantee the stated remediation on either ubuntu-latest or macos-latest; use the exact patched version (or enable check-latest).
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Good catch, thanks. Added check-latest: true so setup-node downloads the patched Node 24 instead of using a stale cached build.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c3dc2e36da
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 23 | ||
| node-version: 24 |
There was a problem hiding this comment.
On either Ubuntu or macOS runners that still cache an older 24.x build, this does not guarantee the intended security fix: actions/setup-node@v4 treats 24 as a semver range, defaults check-latest to false, and uses the first locally cached match rather than downloading 24.22.1, as confirmed by the v4 documentation. Pin 24.22.1 (or enable check-latest) so these CI jobs cannot continue running a pre-fix Node 24 release.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Good catch, thanks. Added check-latest: true so setup-node downloads the patched Node 24 instead of using a stale cached build.
setup-node resolves a major version from the runner's tool cache first, which can still hold a pre-24.22.1 build until the runner image refreshes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q1Vsk7Jb4cDNF21XuYhjHk
Summary
node-version:23→24. Node 23 is end of life and will not get the eMudhra CA fix.check-latest: true. Without it,setup-nodetakes the first matching Node 24 from the runner's tool cache, which can still be a pre-24.22.1 build until the runner image refreshes.Why
Eight eMudhra intermediate CA keys are compromised (advisory). Node.js does not use the OS trust store, it ships its own. The fix is in the Node.js October 21 security release (v26.12.1, v24.22.1 and v22.23.4), which also fixes three TLS hostname-check bypasses (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072). Node 18 and 20 get no patch.
The floating
node:*tags caught up with the release only this afternoon, so a cached base layer can still hold the vulnerable build. An exact pin rules that out.Test plan
🤖 Generated with Claude Code
https://claude.ai/code/session_01Q1Vsk7Jb4cDNF21XuYhjHk