From 4e8360b1e5321a7fc58a6e5214754ead954236f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A9d=C3=A9ric=20Hurier=20=28Fmind=29?=
 <github@fmind.dev>
Date: Sat, 24 Oct 2026 12:56:33 +0200
Subject: [PATCH 1/2] fix(deps): pin Node.js 24.22.1 for the October security
 release

Node.js 24.20.0 predates the 2026-10-21 security release (ten CVEs, among them a Brotli RCE), and the npm publish job ran it with id-token: write.
---
 .github/workflows/release.yml |  2 +-
 mise.lock                     | 14 +++++---------
 mise.toml                     |  2 +-
 3 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 531acb4..fbe8f57 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -153,7 +153,7 @@ jobs:
       - name: Install Node.js for npm publication
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 24.20.0
+          node-version: 24.22.1
           registry-url: https://registry.npmjs.org
           package-manager-cache: false
       - name: Checkout release toolchain
diff --git a/mise.lock b/mise.lock
index a813ff2..7d4c109 100644
--- a/mise.lock
+++ b/mise.lock
@@ -137,20 +137,16 @@ url = "https://github.com/lycheeverse/lychee/releases/download/lychee-v0.24.2/ly
 url_api = "https://api.github.com/repos/lycheeverse/lychee/releases/assets/409957951"
 
 [[tools.node]]
-version = "24.20.0"
+version = "24.22.1"
 backend = "core:node"
 
 [tools.node."platforms.linux-x64"]
-checksum = "sha256:855d581f8a4eb1a8117e3426de25fe02770592febcfb31369aee1ffbfee9e8ec"
-url = "https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.gz"
+checksum = "sha256:eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c"
+url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-x64.tar.gz"
 
 [tools.node."platforms.macos-arm64"]
-checksum = "sha256:40e5607e5ecb3db9192723776da2d75d966260fc74a7a9e731c1bd67dda96bc8"
-url = "https://nodejs.org/dist/v24.20.0/node-v24.20.0-darwin-arm64.tar.gz"
-
-[tools.node."platforms.windows-x64"]
-checksum = "sha256:6cac9ffbca8f6a47091e4b5c772e0606049c3871cb67d900c0cedde630e545ba"
-url = "https://nodejs.org/dist/v24.20.0/node-v24.20.0-win-x64.zip"
+checksum = "sha256:89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7"
+url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-darwin-arm64.tar.gz"
 
 [[tools.npm]]
 version = "12.0.2"
diff --git a/mise.toml b/mise.toml
index 40b685d..d2b61c7 100644
--- a/mise.toml
+++ b/mise.toml
@@ -19,7 +19,7 @@ gotestsum = "1.13.0"
 hugo-extended = "0.165.0"
 lefthook = "2.1.11"
 lychee = "0.24.2"
-node = "24.20.0"
+node = "24.22.1"
 npm = "12.0.2"
 shellcheck = "0.11.0"
 sqlite = "3.53.4"

From a500d3d0f79e17b6475ee58c453e0332355d6180 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A9d=C3=A9ric=20Hurier=20=28Fmind=29?=
 <github@fmind.dev>
Date: Sat, 24 Oct 2026 13:13:53 +0200
Subject: [PATCH 2/2] fix(deps): lock Node.js 24.22.1 for Windows too

---
 mise.lock | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mise.lock b/mise.lock
index 7d4c109..be26383 100644
--- a/mise.lock
+++ b/mise.lock
@@ -148,6 +148,10 @@ url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-x64.tar.gz"
 checksum = "sha256:89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7"
 url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-darwin-arm64.tar.gz"
 
+[tools.node."platforms.windows-x64"]
+checksum = "sha256:d2046d28c2c3dcd211ac5145c0bf30e2047ef9dfb306693c8c6e2eccd8b95fa5"
+url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-win-x64.zip"
+
 [[tools.npm]]
 version = "12.0.2"
 backend = "aqua:npm/cli"