[matthewbraddock]

Summary

Update Node.js from 24.22.0 to 24.22.1 in the GitHub Actions workflows to address security vulnerabilities, including the eMudhra Intermediate CA compromise.

Node.js 24.22.1 was released on October 21, 2026, as part of the official security updates.

Changes

• Update Node.js to 24.22.1 in .github/workflows/check-dist.yml.
• Update Node.js to 24.22.1 in .github/workflows/main.yml.

References

• Node.js October 2026 Security Releases
• Node.js v24.22.1 Release Notes
• Previous Node.js update: chore(deps): update dependency node to v24.22.0 #1941

[matthewbraddock]

@jennifer-shehane, it looks like Firefox timed out during the CI run. Would you be able to re-run it? I don't have the permissions, it seems, to do it myself.

Command timed out after 30000 milliseconds: /home/runner/.cache/Cypress/16.2.0/Cypress/Cypress --no-sandbox --smoke-test --ping=255
Timed out

[matthewbraddock]

@jennifer-shehane, I just wanted to say thank you so much for the super quick turnaround on this.

I really appreciate it! 🙇🏼

[github-actions]

🎉 This PR is included in version 7.4.7 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[jennifer-shehane]

@matthewbraddock We've had our eye on this one in a few other threads. Thanks for the PR!

[MikeMcC399]

The version of Node.js that Cypress runs under is determined by the GitHub Actions runner. The changes in this PR don't affect that version.

Note: Actions Runner follows a progressive release policy, so the latest release might not be available to your enterprise, organization, or repository yet. To confirm which version of the Actions Runner you should expect, please view the download instructions for your enterprise, organization, or repository.
See https://docs.github.com/en/enterprise-cloud@latest/actions/hosting-your-own-runners/adding-self-hosted-runners

This repo is currently being served with runner v2.338.0 which provides Node.js 24.22.0. https://github.com/actions/runner/releases/tag/v2.338.1 was released on Oct 22, 2026 and updates the runner version to NODE24_VERSION="24.22.1".

The repo has no influence on the rollout of this version.

---

The PR did not warrant the commit message fix as there was no change to the action itself, only to CI. That's why previous similar PRs used the chore commit message.

[MikeMcC399]

Logs show that Cypress uses the version of Node.js provided by the runner in
/home/runner/actions-runner/cached/2.338.0/externals/node24/bin/node for example in Ubuntu

This is unrelated to whatever version is set up in workflows.

====================================================================================================

  (Run Starting)

  ┌────────────────────────────────────────────────────────────────────────────────────────────────┐
  │ Cypress:        16.2.0                                                                         │
  │ Browser:        Chrome 155 (headless)                                                          │
  │ Node Version:   v24.21.0 (/home/runner/actions-runner/cached/2.338.0/externals/node24/bin/node │
  │                 )                                                                              │
  │ Specs:          1 found (spec.cy.js)                                                           │
  │ Searched:       cypress/e2e/**/*.cy.{js,jsx,ts,tsx}                                            │
  └────────────────────────────────────────────────────────────────────────────────────────────────┘


────────────────────────────────────────────────────────────────────────────────────────────────────