[Mister-Hope]

Summary

Harden the CI/dev Node.js runtime and unify CI Node setup:

• Pin the development/CI Node.js runtime to releases containing the fixes from the October 2026 Node.js security releases: Node.js 22 → 22.23.4, 24 → 24.22.1, 26 → 26.12.1.
• Replace the pnpm/action-setup + actions/setup-node pair with a single pnpm/setup@v3 step in every job. actions/setup-node may install a stale cached patch of a major line (e.g. 24.22.0), which then trips pnpm ci against the devEngines.runtime range; pnpm/setup downloads the runtime from the Node dist index.

Changes

• .node-version
  • v24.14.0 → v24.22.1
• .github/workflows/check.yml
  • pnpm/action-setup@v6 + actions/setup-node@v6 (node-version-file: '.node-version') → pnpm/setup@v3 with runtime: node@^24.22.1
• .github/workflows/coverage.yml
  • pnpm/action-setup@v6 + actions/setup-node@v6 (node-version: lts/*) → pnpm/setup@v3 with runtime: node@^24.22.1
• .github/workflows/e2e.yml
  • pnpm/action-setup@v6 + actions/setup-node@v6 (node-version: ${{ matrix.node }}) → pnpm/setup@v3 with runtime: node@${{ matrix.node }}; the matrix entries stay majors ('22', '24'), which pnpm/setup resolves to the latest (fixed) patch
• .github/workflows/release.yml
  • pnpm/action-setup@v6 + actions/setup-node@v6 (node-version: lts/*, registry-url) → pnpm/setup@v3 with runtime: node@^24.22.1

Notes

• Only the development/CI environment is pinned to the fixed releases. Package runtime requirements are unchanged — packages/vuepress/package.json still declares engines.node: ">=22.18.0".
• lts/* and floating major versions in CI are replaced by deterministic, secured runtimes (24.22.1) so a stale runner cache can no longer supply a vulnerable patch.
• pnpm/setup has no cache: pnpm / registry-url inputs, so those actions/setup-node options are dropped. The store cache is an optimization only; publishing still targets the default npm registry.
• CI will validate the change when this PR runs.

Verification

• Every changed workflow file parsed successfully with yaml; git diff shows only the Node version pins and the setup-action conversion — no lockfile changes, no formatting churn.

[coveralls]

Coverage Report for CI Build 39707955701

Coverage remained the same at 73.948%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	1087
Covered Lines:	800
Line Coverage:	73.6%
Relevant Branches:	552
Covered Branches:	412
Branch Coverage:	74.64%
Branches in Coverage %:	Yes
Coverage Strength:	48.34 hits per line

---

💛 - Coveralls