[skyfriends]

The publishing workflow runs Node 12 with an older bundled trust store. Both jobs now remove the affected emSign and AAA trust paths before checkout, runtime setup, or npm publishing, and Node uses the filtered Ubuntu bundle. The guard rejects an affected or empty bundle. Checkout/setup-node move from retired v1 action runtimes to supported v4 actions; the application Node 12 selection remains unchanged.

Validation: actionlint passed. Official Node 12.22.12 with the filtered CA bundle rejected all 12 disclosed chains and succeeded for three healthy HTTPS controls. Positive/negative bundle guard checks and git diff --check passed. The workflow and npm publishing were not executed.

This is a temporary trust-root mitigation pending a compatible Node release containing the upstream intermediate-key blocklist. Certificates whose only trust path uses the removed roots are also rejected. Explicit application CA overrides and already-running processes require separate verification.

Reference: nodejs/node#66871

Desktop/manual application testing was not performed.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f0bea42e-854c-4f53-b137-6cd0542c88da

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}