gettyimages / gettyimages-api_nodejs / 39831239465

98%

push

github

Require Node.js releases patched for CVE-2026-111497 (#89)

CVE-2026-111497 is an out-of-bounds write in the Node.js Brotli decoder.
The SDK cannot patch it in code.  Only a runtime upgrade fixes it.

- Set engines.node to "^22.23.4 || ^24.22.1 || >=26.12.1".  This drops
  Node.js 14 to 21 and the unpatched releases of 22, 24 and 26.
- Test on Node.js 22.x, 24.x and 26.x in build.yml.
- Run lint.yml and the publish.yml build on Node.js 24.
- Show the new range in the README prerequisites.

94 of 115 branches covered (81.74%)

1029 of 1049 relevant lines covered (98.09%)

114.41 hits per line