[joshavant]

What Problem This Solves

Build, CI and release tooling can select Node patches that trust the compromised eMudhra keys.

User Impact

The selected tooling now uses fixed patches within its existing Node release lines. Application installations and Actions’ bundled runtimes require separate remediation.

Why This Change Was Made

Select Node 22.23.4, 24.22.1 at the existing version owners, including cache/provisioning inputs. Exact patch selectors also prevent fallback to an older cached patch.

Evidence

Workflow YAML and git diff --check pass. Actionlint passes. The selected official Linux arm64 Node releases reject all twelve incident chains in eight TLS modes, including explicit old CA inputs, with ordinary HTTPS controls passing. Existing PR CI covers the application/native suites, which were not rerun locally for these selector changes.

Native pnpm has an independent TLS verifier. Update its selected release to 12.15.0 and regenerate only the normal package-manager lock document. Actual native 12.15.0 frozen install, lint, types, build and all 742 tests pass; the workspace dependency lock document remains byte-identical. Independent P0–P2 review is clean. Published artifacts, installed copies and other native platforms remain separate delivery/proof obligations.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T22:16:42.026147Z	058af25	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR pins CI to Node 22.23.4 and 24.22.1 and pins hydration and release tooling to Node 24.22.1.

Example: Crabbox hydration selects its Node runtime.

• Before: The selector "24" permits an older cached Node 24 patch.
• After: The selector "24.22.1" requires the release containing the compromised-key blocklist.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is minimal and supported by official release contents and passing CI, while the reported TLS exercise remains an uninspected assertion.
Proof confidence	🦐 gold shrimp (3/6)	The supplied maintainer-authored classification exempts this PR from the ordinary contributor-proof gate; the body reports incident-chain rejection on both Linux arm64 runtimes, but provides no trace for independent inspection.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Repository build and release commands can run with a cached Node patch that still trusts compromised CA keys.
Reason: The security value is concrete, the change preserves the existing Node release lines, and the supplied maintainer-authored classification establishes direction approval.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: it provides a focused security mitigation absent from main, with no introduced defect found and both pinned CI jobs passing.

Priority: P1
Reviewed head: e0947c0d2bec0d8940b7bd23430ed35dbfb66cd1

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: The claimed Linux arm64 TLS rejection and ordinary HTTPS controls have no attached inspectable output.

Agent review details

How this fits together

GitHub Actions passes the workflow version selectors to setup-node, which provisions the Node executable used by dependency installation, validation, hydration, and npm release commands.

flowchart TD
  A[Workflow version selectors] --> B[setup-node]
  B --> C[Matching cache or official download]
  C --> D[Selected Node runtime]
  D --> E[CI and hydration commands]
  D --> F[npm release commands]

Loading

Technical review

Best possible solution:

Land the focused runtime pins while keeping application installations and Actions’ bundled runtimes within their separately stated remediation scope.

Do we have a high-confidence way to reproduce the issue?

Main's floating selectors permit older cached patches, and the pinned setup-node implementation confirms that selection path; no TLS reproduction was executed during this read-only review.

Is this the best way to solve the issue?

Changing the existing version owners is the smallest complete fix for the stated tooling scope, and both selected official releases contain the required TLS fix.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 85307ff538c0.

Provenance checked

• CI Node matrix keeps the original intent (ebd59bd: Exercise both supported Node majors and the declared Node 22 runtime floor.)
• Hydration runtime selector keeps the original intent (c164945: Provide constrained repository-specific Crabbox hydration.)
• npm release runtime selector keeps the original intent (a6789c5: Support validated preflight artifacts, gated publishing, and beta-to-latest promotion.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Exact introduced change: The pinned base-to-head diff contains only three version-selector replacements; main still uses floating Node major selectors. (.github/workflows/ci.yml:35, e0947c0d2bec)
• Existing consumers: The hydration selector feeds setup-node, and the release selector feeds preflight, publishing, and promotion without adding another version owner. (.github/workflows/lobster-npm-release.yml:43, e0947c0d2bec)
• Official security fix: The official v22.23.4 and v24.22.1 release notes include the blocked-public-key fix from tls: reject chains containing blocked public keys nodejs/node#66871, whose merged description identifies the compromised eMudhra/emSign intermediates and normal TLS verification enforcement. (d9a3f3d150f7)
• Version selection contract: The pinned action passes the requested version to the tool-cache lookup and uses semver matching for downloads, supporting the exact-pin protection against older cached patches. (src/distributions/base-distribution.ts, 820762786026)
• Current-head validation and discussion: Both pinned Node checks and workflow lint passed for the reviewed head; comments and reviews contain no additional TLS trace or linked verification artifact. (e0947c0d2bec)
• Policy and direction: The complete root AGENTS.md applies; no nested policy, matching maintainer notes, or pr-simplify skill exists. The supplied review instructions explicitly classify this PR as maintainer-authored, which governs direction approval despite REST reporting association NONE. (AGENTS.md:1, e0947c0d2bec)

Likely related people:

• Peter Steinberger: Raw commit ebd59bd adds .github/workflows/ci.yml:48 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: ebd59bd2ea69; files: .github/workflows/ci.yml)
• Vincent Koc: Raw commit c164945 adds .github/workflows/crabbox-hydrate.yml:52 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: c1649457ced7; files: .github/workflows/crabbox-hydrate.yml)

Labels

Label changes:

• add P1: Build and release tooling can select Node patches that trust compromised CA keys; the official patched runtimes provide a narrow security mitigation.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P1: Build and release tooling can select Node patches that trust compromised CA keys; the official patched runtimes provide a narrow security mitigation.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach redacted terminal output from the reported compromised-chain rejection and ordinary HTTPS controls to strengthen the evidence.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 21, 2026, 5:23 PM ET / 21:23 UTC.