[ValentaTomas]

Moves CI off EOL Node 20 (which got no patched release) to 22.23.4 in .tool-versions, pins the npm-publish job's floating 24.x to 24.22.1 so a runner's cached older 24.x can't be used, and bumps certifi in tests/uv.lock from 2026.7.22 to 2026.10.19 — the versions the eMudhra intermediate CA key-compromise disclosure lists as patched. Node 20 was not a compatibility floor here (.tool-versions notes it only runs Changesets; the SDKs live in the E2B monorepo), and the template already pins certifi==2026.10.19. The lock diff is certifi plus uv 0.13.4's lockfile revision header (3 → 5); no other package re-resolved. Reviewers: watch Lint (pnpm install under Node 22); the publish job only runs on a manual release, so 24.22.1 is first exercised then.

[cursor]

PR Summary

Low Risk
Toolchain and test lockfile bumps only; main validation surface is lint under Node 22 and release publish on the next manual dispatch.

Overview
Moves CI off EOL Node 20 by setting node 22.23.4 in .tool-versions, which drives lint and most release jobs via parse-tool-versions. The lint workflow only renames the setup step to match the version-agnostic pin.

The manual release npm publish step keeps Node 24 for OIDC/npm 11 but replaces floating 24.x with 24.22.1 so runners cannot pick an older cached 24.x.

tests/uv.lock bumps certifi to 2026.10.19 (aligned with the template pin) plus the uv lockfile revision header; no other packages re-resolved.

^{Reviewed by Cursor Bugbot for commit 8f99fb8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T08:19:54.546659Z	8f99fb8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

I reviewed this PR and didn't find any bugs. All paths here have a CODEOWNER, and the change swaps lockfile hashes for a security fix, so a human look is still worthwhile.

What was reviewed:

• .tool-versions Node 20 → 22.23.4: lint.yml and the release.yml setup step at line 56 both read it through env.TOOL_VERSION_NODE, so the version is still set in one place.
• The publish job pins 24.22.1 instead of 24.x. Running ahead of the 22 baseline is intentional, per the existing comment about npm 11 and OIDC.
• tests/uv.lock changes only certifi and the revision header, and the new version matches certifi==2026.10.19 in both template requirements files. I couldn't check the new sdist and wheel sha256 values against PyPI from here, so someone should confirm them.

Extended reasoning...

The change touches CI tooling only. It bumps Node in .tool-versions, pins the Node version in the npm-publish step, renames one step in lint.yml, and updates the certifi entry in tests/uv.lock. It touches no application code. The supply-chain-sensitive part is the lockfile hash swap for certifi, which this review could not check against PyPI, and the PR's motivation is a CA key-compromise fix. A CODEOWNERS rule (*) covers every changed file, which rules out auto-approval.