[jphein]

realmwatch-e5 (JP #136, via jp-58) flagged Node 20 EOL and today's Node security release (10 CVEs; worst CVE-2026-111497, a Brotli decoder OOB write).

State before this PR

• Node 20 → 22 was already done in chore: Node 22 (Node 20 is EOL) + shell-quote critical CVE fix #17 (.nvmrc 22, all workflows node-version: 22).
• forage.techempower.org is served by GitHub Pages (server: GitHub.com); it's a static export, so no Node runs in production.
• But the last deploy (run 39687079451) built with the runner's cached v22.23.3, not the patched 22.23.4, because setup-node defaults to check-latest: false.

This PR

• Adds check-latest: true to all six setup-node steps (ci, deploy-web, release ×3, sync-data), so builds take the newest 22.x patch.

Dependency items from the 10-21 audit

• shell-quote: resolved 1.12.0 via the chore: Node 22 (Node 20 is EOL) + shell-quote critical CVE fix #17 override (≥1.8.4 asked). Done.
• tar: stays 6.2.1. Its only dependents are @expo/cli (^6.0.5) and cacache (^6.1.11), both build tools. A tar 7 override broke expo prebuild on 10/21 ("Cannot read properties of undefined (reading 'extract')"), and tar never reaches the static web bundle. Revisit when Expo moves to tar 7.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jphein]

Merge record (vale, 2026-10-21 23:2x): CI green on the head sha. Positive control: before this PR the deploy built with cached v22.23.3 (run 39687079451); with it, CI logs "Resolved as '22.23.4'" → node v22.23.4. Cross-model review (xreview, gpt-6.1-sol-2026-09-29): AGREE; its comment-wording nit is applied. gitleaks found no leaks. Merged under JP's standing yes (CI-workflow change, independent review done).