From e4c44e3960ddbde2b2a4d148234b8bd55e6e688b Mon Sep 17 00:00:00 2001
From: kkdev92 <112151103+kkdev92@users.noreply.github.com>
Date: Wed, 21 Oct 2026 23:11:13 +0900
Subject: [PATCH] ci: pin Node.js security releases in build workflows

Select patched Node.js versions explicitly so cached runtimes cannot
precede the security fixes.

Node.js versions: 22.23.4, 24.22.1, 26.12.1.

Validation: configuration parsing and git diff --check.

Co-Authored-By: Codex <noreply@openai.com>
---
 .github/workflows/ci.yml      | 12 +++++++-----
 .github/workflows/pages.yml   |  2 +-
 .github/workflows/release.yml |  4 ++--
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 232d371..23ba4f4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,7 +34,9 @@ jobs:
       - name: Setup Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version: >-
+            ${{ matrix.node-version == 22 && '22.23.4' ||
+                matrix.node-version == 24 && '24.22.1' || '26.12.1' }}
           cache: 'npm'
 
       - name: Install dependencies
@@ -81,7 +83,7 @@ jobs:
       - name: Setup Node.js 26
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 26
+          node-version: 26.12.1
           cache: 'npm'
 
       - name: Install dependencies
@@ -117,7 +119,7 @@ jobs:
       - name: Setup Node.js 26
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 26
+          node-version: 26.12.1
           cache: 'npm'
 
       - name: Install dependencies
@@ -150,7 +152,7 @@ jobs:
       - name: Setup Node.js 26
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 26
+          node-version: 26.12.1
           cache: 'npm'
 
       - name: Install dependencies
@@ -188,7 +190,7 @@ jobs:
       - name: Setup Node.js 26
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 26
+          node-version: 26.12.1
           cache: 'npm'
 
       - name: Install dependencies
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index b1ddad7..7014b8b 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -40,7 +40,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 26
+          node-version: 26.12.1
           cache: 'npm'
 
       - name: Install dependencies
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8bf7d0d..40661e4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,7 +39,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 26
+          node-version: 26.12.1
           cache: 'npm'
 
       - name: Install dependencies
@@ -104,7 +104,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 26
+          node-version: 26.12.1
           registry-url: 'https://registry.npmjs.org'
           cache: 'npm'