[peakematt]

Why

Part of the November 2026 Node.js security release rollout (High severity: HTTP/2, TLS, llhttp, undici and others; advisory). The repo pinned only the Node major in .nvmrc (24), so the version a build got depended on when it ran. This pins the patched release exactly.

What changed

• .nvmrc: 24 → 24.22.3.
• The CI test matrix (node-version: ${{ matrix.node }}) is left alone, since it checks the library against several Node majors.

package.json engines ranges are unchanged. They describe compatibility, not the version we build with.

Link to Devin session: https://app.devin.ai/sessions/827b6f7f4f5c4db69b167f83971f02df
Open in Devin Desktop: https://app.devin.ai/desktop/session/827b6f7f4f5c4db69b167f83971f02df?variant=devin
Requested by: @peakematt

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from Matt Peake

SYSTEM:
<latest_message>
Matt Peake (U0BQ539BLBG) [ts=1794400900.139529]: @Devin NodeJS announced that they are going to release security updates today or tomorrow: <https://nodejs.org/en/blog/vulnerability/november-2026-security-releases|nodejs.org/en/blog/vulnerability/november-2026-security-releases>.

Set up an automation that checks for the Node security release every 15 minutes until it is announced. Once it is announced, read the notion page linked in this thread and issue PRs on all of the repos described in that notion doc to update node. Add links to PRs and update the status field in Notion accordingly.
</latest_message>

=== BEGIN THREAD HISTORY (in #team-security) ===
Matt Peake (U0BQ539BLBG) [ts=1794400756.414429]: November 2026 NodeJS Updates 🧵

Matt Peake (U0BQ539BLBG) [ts=1794400768.394649]: Tracking sheet: <https://app.notion.com/p/workos/Node-js-security-release-rollout-November-2026-847d458aea8b83649076810cd59daea0?source=copy_link|app.notion.com/p/workos/Node-js-security-release-rollout-November-2026…?source=copy_link>

:large_green_circle: Node.js security release rollout - November 2026

Matt Peake (U0BQ539BLBG) [ts=1794400900.139529]: @Devin NodeJS announced that they are going to release security updates today or tomorrow: <https://nodejs.org/en/blog/vulnerability/november-2026-security-releases|nodejs.org/en/blog/vulnerability/november-2026-security-releases>.

Set up an automation that checks for the Node security release every 15 minutes until it is announced. Once it is announced, read the notion page linked in this thread and issue PRs on all of the repos described in that notion doc to update node. Add links to PRs and update the status field in Notion accordingly.

[Slack unfurl — this is an automatic link preview, not a user message]
Preview of a link: https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
> # nodejs.org
> #``# [Node.js — Wednesday, November 11, 2026 Security Releases](https://nodejs.org/en/blo... (811 chars truncated...)

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

Devin Review

🟢 Devin Review found nothing to fix · View findings

[greptile-apps]

Confidence Score: 5/5

[Low impact] The PR appears safe to merge; no actionable issue was found.

Summary

Pins .nvmrc from 24 to 24.22.3. CI formatting, lint, build, and release jobs already read this file.

• Builds now use Node.js 24.22.3.

_{Reviews (1) · Last reviewed commit: "Pin Node to 24.22.3 for the November 202..." · Reviewed by Greptile}