[yeelali14]

Security hotfix for the undici Brotli decompression advisory. The action ran on Node 20.12.2, which is EOL and won't receive the fix.

• action.yml: setup-node 20.12.2 → 22.23.4
• .nvmrc: v22.13.0 → v22.23.4
• package.json / lockfile root engines: >=20 → >=22 (gitstream-core already requires >=22)

Unit tests pass on 22.23.4. This is a major runtime bump for customers, so please smoke-test on a real PR before merging.

Dependency fixes (Orca findings)

• undici 6.29.0 → 6.29.1 (via @actions/http-client) — CVE-2026-109869
• follow-redirects 1.16.0 → 1.16.2 (via gitstream-core → axios) — CVE-2026-111755, CVE-2026-111756
• vendor-plugins now pins follow-redirects@1.16.2: the copy vendored into dist/node_modules for plugins was also 1.16.0 and isn't scanned by Orca (no lockfile); without the pin npm install --prefix dist keeps the existing version.
• dist rebuilt with npm run bundle on Node 22.23.4; a second rebuild is a no-op (matches Check dist/).

🤖 Generated with Claude Code

✨ PR Description

Purpose: Upgrade the action runtime to Node 22.23.4 as a security hotfix.

Main changes:

• Updated node-version in action.yml and .nvmrc to 22.23.4
• Bumped minimum Node engine to >=22 in package.json
• Updated @linearb/gitstream-core to 2.1.314 and added follow-redirects to vendor-plugins script

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how}

[linearb]

✨ PR Review

LGTM

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Review using Guidelines Learn how}

[orca-security-us]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	OSS Licenses	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   3   0   0	View in Orca

☢️ The following Vulnerabilities (CVEs) have been detected

	PACKAGE	FILE	CVE ID	INSTALLED VERSION	FIXED VERSION
	follow-redirects	./package-lock.json	CVE-2026-111755	1.16.0	1.16.1	View in code
	follow-redirects	./package-lock.json	CVE-2026-111756	1.16.0	1.16.1	View in code
	undici	./package-lock.json	CVE-2026-109869	6.29.0	6.29.1, 7.30.1, 8.12.2	View in code

[Copilot]

🔵 Needs a closer look

The customer-facing major runtime upgrade still needs confirmation of the real-PR smoke test requested in the description.

No open issues 🎉

What changed in this PR

Updates the action’s Node.js runtime to 22.23.4 for the stated undici Brotli security fix, aligning local development and package requirements with Node.js 22.

Changes:

• Bumps the action runtime from Node.js 20.12.2 to 22.23.4.
• Aligns .nvmrc with the action runtime.
• Raises the minimum Node.js engine requirement to 22 in both package manifests.

File	Description
package.json	Requires Node.js 22 or later.
package-lock.json	Synchronizes the root engine requirement.
action.yml	Pins the action runtime to Node.js 22.23.4.
.nvmrc	Pins local development to Node.js 22.23.4.

_{Review effort: Balanced}

[orca-security-us]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	OSS Licenses	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[Copilot]

🔵 Needs a closer look

The customer-facing major runtime upgrade needs the requested real-PR smoke test, whose outcome has not been verified in this review.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The customer-facing Node.js major-version upgrade needs the requested real-PR smoke test before final approval.

No open issues 🎉

_{Review effort: Balanced}