[sec-check] CI workflows and Netlify build still on EOL Node.js 20 (unpatched since 2026-04-30) #7076

Security Finding

Severity: medium
Type: supply-chain / EOL runtime

Multiple parts of the docs build still target Node.js 20, which reached end-of-life on 2026-04-30 (per the Node.js release schedule) and no longer receives security patches. The runtime Docker image was already moved to Node 26 (see #5900/#5902), but CI workflows and the Netlify production build continue to install Node 20.

Where Node 20 is still pinned (HEAD fab16f2)

Netlify build (production docs site):

• netlify.toml:11 — NODE_VERSION = "20.11.1"

GitHub Actions workflows (8 files):

• .github/workflows/check-internal-links.yml:41
• .github/workflows/create-version-branch.yml:153
• .github/workflows/dashboard-lint.yml:25
• .github/workflows/fuzz-mdx.yml:46
• .github/workflows/generate-acmm-history.yml:34
• .github/workflows/generate-leaderboard.yml:30
• .github/workflows/sync-console-release-versions.yml:32
• .github/workflows/typecheck.yml:35

For contrast, .github/workflows/vitest.yml:41 already runs on Node 22, and the runtime Dockerfile uses node:26-alpine. This bug is that the rest was not carried forward.

Impact

CI jobs, docs preview builds, and the Netlify production build execute untrusted content (mdx, dependencies from npm ci, third-party actions) on an unpatched Node runtime. Any post-2026-04-30 Node.js security advisory (V8, HTTP parser, permissions model, TLS) is silently unpatched here. Netlify’s build environment is the most exposed of the three, since it fetches and executes the full node_modules dependency graph on every push.

Recommendation

Bump every node-version: "20"/'20' in the workflows above to "22" (matching vitest.yml), and bump netlify.toml NODE_VERSION to a current LTS ("22.11.0" or newer). Exact one-line replacements:

• netlify.toml:11 — NODE_VERSION = "20.11.1" → NODE_VERSION = "22.11.0"
• Each node-version: "20" / node-version: '20' → node-version: "22" in the 8 workflow files listed above.

No other changes are required — package.json has no engines pin, and the vitest job already proves Node 22 works.

Notes on landing this fix

• The netlify.toml change is pushable by this agent and will be opened as a separate PR (referencing this issue).
• The 8 workflow changes touch .github/workflows/** and cannot be pushed from this agent's contributor-tier App token (workflows scope not granted). They need a human or an ISSUES_PRS_MERGE-tier agent to land the mechanical replacements above.

Filed by sec-check agent (ACMM L6 — full mode)

🐝 Hive Agent: security | Instance: hosted-kubestellar-console-4vkt | SHA: unknown

— hive: agent=sec-check backend=copilot model=claude-opus-4.7 copilot=1.0.88