Update Node to 22.23.4

Pin Node 22.23.4 in .nvmrc, package engines, the lockfile, the AMO source build checks and the build docs. Load the AAA Certificate Services root from a fixture in the trusted-node tests because patched Node releases no longer bundle it.

.nvmrc

@@ -1 +1 @@
-v22.17.0
+v22.23.4

Extensions/e2e/discussion/README.md

@@ -12,7 +12,7 @@ node node_modules/webpack-cli/bin/cli.js --mode=production --env liveTest=true -
 node Extensions/e2e/discussion/hermetic-discussion-smoke.js
 ```
 
-Use Node 22.17.0. `RYD_DISCUSSION_ARTIFACT` can select another generated local-test
+Use Node 22.23.4. `RYD_DISCUSSION_ARTIFACT` can select another generated local-test
 Chrome artifact; `RYD_DISCUSSION_OUTPUT` can select a fresh evidence directory.
 The default output creates a new timestamped directory under `test-results/discussion`.
 Set `RYD_DISCUSSION_NOTIFICATIONS_ONLY=true` for a focused notification/reconnect

README_AMO_SOURCE.md

@@ -7,7 +7,7 @@ This source package is provided for Mozilla Add-ons review. The extension is bui
 Build the 4.1.0 release with this exact toolchain:
 
 - Windows 11 (PowerShell); the build script also supports Linux and macOS
-- Node.js 22.17.0
+- Node.js 22.23.4
 - npm 10.8.2
 
 These versions are intentionally pinned instead of relying on the default AMO reviewer environment. The build script checks both versions before installing dependencies and stops if either differs. The release's accompanying reproducibility report records the environment actually used for its independent source rebuild.
@@ -17,8 +17,8 @@ These versions are intentionally pinned instead of relying on the default AMO re
 Using `nvm`:
 
 ```sh
-nvm install 22.17.0
-nvm use 22.17.0
+nvm install 22.23.4
+nvm use 22.23.4
 npm install --global npm@10.8.2
 ```
 
@@ -32,7 +32,7 @@ npm --version
 Expected versions:
 
 ```text
-v22.17.0
+v22.23.4
 10.8.2
 ```
 
@@ -46,7 +46,7 @@ node scripts/build-firefox-source.mjs
 
 The script performs all required technical build steps:
 
-1. Confirms Node.js 22.17.0 and npm 10.8.2 are in use.
+1. Confirms Node.js 22.23.4 and npm 10.8.2 are in use.
 2. Installs the locked dependencies with `npm ci`.
 3. Builds the extension with the release-specific `npm run build-for-amo` hook.
 4. Verifies the generated Firefox manifest is version 4.1.0, retains the published AMO add-on ID, and declares the expected desktop data-collection permissions and minimum Firefox version.

package-lock.json

@@ -33,7 +33,7 @@
         "webpack-cli": "^6.0.1"
       },
       "engines": {
-        "node": "22.17.0",
+        "node": "22.23.4",
         "npm": "10.8.2"
       }
     },

package.json

@@ -5,7 +5,7 @@
   "main": "ryd.content-script.js",
   "packageManager": "npm@10.8.2",
   "engines": {
-    "node": "22.17.0",
+    "node": "22.23.4",
     "npm": "10.8.2"
   },
   "scripts": {

scripts/build-firefox-source.mjs

@@ -10,7 +10,7 @@ const firefoxManifestPath = join(firefoxOutputDirectory, "manifest.json");
 const contentScriptPath = join(firefoxOutputDirectory, "ryd.content-script.js");
 const menuFixerPath = join(firefoxOutputDirectory, "menu-fixer.js");
 const maxContentScriptBytes = 5 * 1024 * 1024;
-const expectedNodeVersion = "v22.17.0";
+const expectedNodeVersion = "v22.23.4";
 const expectedNpmVersion = "10.8.2";
 const expectedExtensionVersion = "4.1.0";
 const expectedFirefoxExtensionId = "{762f9885-5a13-4abd-9c77-433dcd38b8fd}";

scripts/fixtures/aaa-certificate-services.pem

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
+MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow
+GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj
+YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL
+MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE
+BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM
+GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua
+BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe
+3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4
+YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR
+rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm
+ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU
+oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF
+MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v
+QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t
+b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF
+AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q
+GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz
+Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2
+G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi
+l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3
+smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
+-----END CERTIFICATE-----

scripts/package-amo-release.cjs

@@ -9,7 +9,7 @@ const { collectExtensionBuildInputs, createExtensionBuildReceipt } = require("..
 const { verifyBuildReceipt, verifyExtensionArtifacts } = require("../Extensions/e2e/verify-extension-artifact");
 
 const REPOSITORY_ROOT = path.resolve(__dirname, "..");
-const EXPECTED_NODE = "v22.17.0";
+const EXPECTED_NODE = "v22.23.4";
 const EXPECTED_NPM = "10.8.2";
 const ARTIFACT_VERIFIER_PATH = "Extensions/e2e/verify-extension-artifact.js";
 const EXTRA_SOURCE_FILES = Object.freeze([

scripts/with-trusted-node.spec.js

@@ -7,11 +7,11 @@ const { spawnSync } = require("node:child_process");
 const { filterCertificates, readCertificates, prepareEnvironment, main } = require("./with-trusted-node.cjs");
 
 const root = path.resolve(__dirname, "../.private/node-trust-tests");
-const blocked = tls.rootCertificates.find((pem) =>
-  new X509Certificate(pem).subject.includes("CN=AAA Certificate Services"),
-);
+// Public root certificate from https://emudhra.we-have-a-problem.com/roots.json.
+// Patched Node versions no longer include it in their bundled trust store.
+const blocked = fs.readFileSync(path.join(__dirname, "fixtures/aaa-certificate-services.pem"), "utf8");
 const allowed = tls.rootCertificates.filter(
-  (pem) => !new X509Certificate(pem).subject.includes("emSign") && pem !== blocked,
+  (pem) => !/emSign|CN=AAA Certificate Services/.test(new X509Certificate(pem).subject),
 );
 const npmConfig = { ca: null, cafile: null, strictSsl: true, nodeOptions: null };
 let temporary;