From 952ffcbf61d8eec232b94fcc694825ff6049ba9b Mon Sep 17 00:00:00 2001
From: Evan Lynch <elynch@freedomledger.net>
Date: Thu, 22 Oct 2026 12:51:35 -0400
Subject: [PATCH] chore(config-ui): bump Volta Node pin to 24.22.1

24.19.0 predates the October 21, 2026 Node.js security release, which
fixes 4 High CVEs (Brotli decoder RCE, two TLS hostname-check bypasses,
dns.resolve NUL truncation). 24.22.1 is the patched 24.x LTS.

Verified in node:24.22.1-alpine3.23: yarn install --immutable and
yarn build succeed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 config-ui/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config-ui/package.json b/config-ui/package.json
index bd5c33f35ac..481647cfa66 100644
--- a/config-ui/package.json
+++ b/config-ui/package.json
@@ -83,7 +83,7 @@
     "vitest": "5.0.5"
   },
   "volta": {
-    "node": "24.19.0",
+    "node": "24.22.1",
     "yarn": "4.17.0"
   },
   "resolutions": {