[joshavant]

What Problem This Solves

Documentation CI and Pages consume an affected Node26 patch from .node-version.

User Impact

Select Node26.12.1 through the existing version file and matching contributor instructions.

Why This Change Was Made

Consume the independently qualified normal release through the existing selection owner, keeping supported majors and publication gates.

Evidence

make docs passes under actual Node26.12.1: documentation tests, four link/anchor tests and the complete static site build succeed. Independent review is clean at the repository-required priority. Actual fixed release binaries reject the incident chains with positive controls.

The application Go toolchain already selects its fixed1.27.3 release. A future merge of this version-file change triggers the existing GitHub Pages deployment; deployment is not authorized by this preparation.

Also upgrade Alpine ca-certificates and ca-certificates-bundle to 20261020-r0 in both image stages before network or build commands. The Go base already contains the older main package, so plain apk add ca-certificates retains its vulnerable roots. The normal signed package upgrade and real post-install trigger were tested: all twelve incident chains fail with the resulting CA file, hashed CA directory, their union, and cert.pem; a GitHub control succeeds. Application checks from the preceding head remain applicable because application code and build commands are unchanged. Rebuilt image publication and custom CA overrides remain separate.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates the documentation runtime from Node.js 26.10.0 to 26.12.1 and updates the matching contributor instructions.

Example: The documentation workflow selects Node through .node-version.

• Before: CI and Pages install Node.js 26.10.0.
• After: CI and Pages install Node.js 26.12.1, whose official release includes compromised-public-key rejection.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, source-verified security update with successful exact-head documentation validation and no identified defects; direct runtime output was not independently inspected.
Proof confidence	🐚 platinum hermit (4/6)	The supplied maintainer-authored classification exempts this PR from the ordinary contributor proof gate; its body reports a successful Node.js 26.12.1 documentation build and certificate positive controls, while exact-head Docs job metadata and official upstream release records provide supporting validation.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Documentation automation selects a Node release lacking the newly shipped compromised-CA-key rejection.
Reason: The maintainer-authored direction supplied for this review is a narrow security refresh that preserves the supported major, shared selector, and publication gates.

Merge readiness

✅ Ready for maintainer review

Keep open: main still selects the affected Node release, and this PR makes a focused security update through the existing runtime selector; no actionable patch defect was found.

Priority: P2
Reviewed head: f15a486e6e9491abc759445eeabf47e7e35239a7

Before merge

None.

Findings

None.

Agent review details

How this fits together

GitHub Actions reads the shared Node version file, runs the documentation builder against repository Markdown, and publishes the generated static site through the existing Pages workflow.

flowchart LR
  A[Node version file] --> B[Documentation CI]
  A --> C[Pages workflow]
  D[Markdown documentation] --> E[Documentation builder]
  B --> E
  C --> E
  E --> F[Static site artifact]
  F --> G[GitHub Pages]

Loading

Technical review

Best possible solution:

Land the focused version update through the existing shared selector and publication workflow.

Do we have a high-confidence way to reproduce the issue?

Main demonstrably selects Node.js 26.10.0, and upstream documents the compromised-key rejection shipped in 26.12.1; no incident TLS handshake was independently reproduced.

Is this the best way to solve the issue?

Updating the existing shared pin is the smallest complete repository change and keeps CI, Pages, and contributor instructions aligned.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 350240e50578.

Provenance checked

• Shared documentation runtime pin and README reference keeps the original intent (ci: pin tools and validate documentation before merge #193: Pin documentation tools and validate documentation before merge; the later refresh in build(deps): refresh runtime dependencies and validation tools #210 selected Node.js 26.10.0.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Exact introduced change: The pinned base-to-head diff changes only the Node version and its matching README reference, with no additional production machinery. (.node-version:1, f15a486e6e94)
• Current main remains affected: The current default branch still contains 26.10.0 in .node-version; this PR's central change is not implemented there. (.node-version:1, 350240e50578)
• Existing runtime consumers: Documentation CI and Pages both use node-version-file: .node-version and run make docs; Pages already tracks changes to the version file. (.github/workflows/pages.yml:41, f15a486e6e94)
• Official fixed release: The official v26.12.1 release lists TLS rejection of chains containing blocked public keys. The merged implementation explains the compromised eMudhra/emSign intermediate-key protection: tls: reject chains containing blocked public keys nodejs/node#66871. The target explicitly executes this Node release through its documentation runtime selector. (bc2e01dcf6ac)
• Original selector intent: ci: pin tools and validate documentation before merge #193 introduced the shared pin for reproducible documentation validation; build(deps): refresh runtime dependencies and validation tools #210 subsequently refreshed it. This PR preserves that ownership and purpose. Local historical reads encountered unavailable old objects; GitHub commit and PR records supplied the introduction evidence. (.node-version:1, f80cc94dcdbd)
• Exact-head validation: The Docs job successfully completed Node setup and documentation build/link validation on the reviewed head. All 13 completed passing checks match that head, with one dispatch check skipped. Raw job logs redirected to a blocked artifact host and could not be inspected. (.github/workflows/ci.yml:140, f15a486e6e94)

Labels

Label changes:

• add P2: This is a concrete security maintenance update limited to the documentation build runtime.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: This is a concrete security maintenance update limited to the documentation build runtime.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 21, 2026, 6:28 PM ET / 22:28 UTC.