From 1b4f6e082f2a674383099e2992f8c103f8a2e27f Mon Sep 17 00:00:00 2001
From: Michael Sumner <75835774+michael-sumner@users.noreply.github.com>
Date: Fri, 23 Oct 2026 10:25:24 +0100
Subject: [PATCH] fix(ci): bump Node.js to 22.23.4 for CVE-2026-111497

---
 .github/docker/Dockerfile.ci | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/docker/Dockerfile.ci b/.github/docker/Dockerfile.ci
index d45ad6a75..9bb7a6151 100644
--- a/.github/docker/Dockerfile.ci
+++ b/.github/docker/Dockerfile.ci
@@ -90,7 +90,7 @@ RUN curl --retry 5 --retry-delay 5 --retry-connrefused -fsSL https://cli.github.
 # and "gnupg" was renamed to "gpg" on Ubuntu 24.04 anyway, so NodeSource's script
 # fails before it can add its own repo. Direct tarball download is network-simpler
 # (one host: nodejs.org) and doesn't touch apt at all.
-ENV NODE_VERSION=22.20.0
+ENV NODE_VERSION=22.23.4
 RUN curl --retry 5 --retry-delay 5 --retry-connrefused -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" -o /tmp/node.tar.xz \
     && tar -xJ -C /usr/local --strip-components=1 --no-same-owner -f /tmp/node.tar.xz \
     && rm -f /tmp/node.tar.xz \