Release Aiden Agent 0.61.0: security updates (Electron 43.8.3, MCP SDK 1.32.1, CI Node 22.23.4)

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
       - name: Detect shared and platform changes
         id: filter
         env:
@@ -59,7 +59,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
       - name: Install locked dependencies
         run: npm ci
@@ -83,7 +83,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
       - name: Install locked dependencies
         run: npm ci
@@ -120,7 +120,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
       - name: Install locked dependencies
         run: npm ci
@@ -158,7 +158,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
       - name: Install locked dependencies
         run: npm ci
@@ -179,7 +179,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
       - name: Install locked dependencies
         run: npm ci
@@ -213,7 +213,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
       - name: Install locked dependencies
         run: npm ci
@@ -242,7 +242,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
       - name: Install locked dependencies
         run: npm ci
@@ -266,7 +266,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
       - name: Run Apple Foundation Models tests
         env:
           DEVELOPER_DIR: /Applications/Xcode_26.6.app/Contents/Developer
@@ -291,7 +291,7 @@ jobs:
         if: ${{ needs.changes.outputs.desktop == 'false' }}
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
       - name: Install iOS policy dependencies
         if: ${{ needs.changes.outputs.desktop == 'false' }}
@@ -489,7 +489,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
           cache-dependency-path: packages/cli-playground/package-lock.json
       - name: Install playground dependencies
@@ -514,7 +514,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
       - name: Require every selected check to pass
         env:
           CI_NEEDS_JSON: ${{ toJSON(needs) }}
@@ -537,7 +537,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
       - name: Summarize this CI attempt
         env:
           GH_TOKEN: ${{ github.token }}
@@ -598,7 +598,7 @@ jobs:
         if: ${{ needs.changes.outputs.linux == 'true' }}
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
 
       - name: Install Linux test dependencies
@@ -742,7 +742,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
 
       - name: Install locked dependencies

.github/workflows/linux-installers.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
 
       - name: Install Linux package dependencies

.github/workflows/model-catalog-refresh.yml

@@ -54,7 +54,7 @@ jobs:
         if: steps.gate.outputs.skip != 'true'
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
 
       - name: Install locked dependencies

.github/workflows/release-consumers.yml

@@ -47,7 +47,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
 
       - name: Verify contract logic
         run: node --test scripts/check-release-consumers.test.mjs

.github/workflows/release.yml

@@ -35,7 +35,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
 
       - name: Resolve the declared release version
@@ -204,7 +204,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
           cache: npm
 
       - name: Resolve the declared release version
@@ -324,7 +324,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: 22.22.3
+          node-version: 22.23.4
 
       - name: Resolve release identity
         id: version

.memory/security-updates-2026-10.md

@@ -0,0 +1,12 @@
+# Security updates, October 2026
+
+2026-10-22 check against the October 21 disclosures (PHP2Shell, Linux PwnEscape, Node.js security release).
+
+- PHP and the Linux kernel bugs do not apply: no PHP anywhere, and Aiden runs no VM hosts.
+- The shipped app had drifted: Electron 43.1.1 (July 14, Chromium 150.0.7871.114) was 23 releases behind. Moved to `^43.8.3` (Chromium 150.0.7871.250), which also clears five Electron GHSAs fixed after 43.6.0.
+- `@modelcontextprotocol/sdk` 1.30.0 -> 1.32.1 (OAuth credential steering, cross-origin redirect header leaks) and `yauzl` 3.2.0 -> 3.4.0. In-range transitive fixes from `npm audit fix` (undici, hono, fast-uri, proxy-addr, qs, ip-address, seroval, shell-quote, vite and others).
+- electron-builder must stay at 26.15.3: `scripts/patch-electron-builder-keychain.mjs` refuses any other app-builder-lib version, and a plain `npm audit fix` bumps it to 26.18.0. Re-pin it after any audit fix.
+- CI `node-version` moved from 22.22.3 to 22.23.4 (the Node 22 line's October 21 security release).
+- Open: no Electron release carries Node 24.22.1 yet (43.8.3, 44.9.3 and 45.0.0 all ship 24.22.0). Bump Electron again when one does; that closes the Brotli decoder flaw (CVE-2026-111497) and the TLS hostname-check bypasses in the app's main process.
+- `main/services/gemini-live/sdk-contract.test.ts` checks the Electron major (43) plus the display-media declarations; it no longer pins the exact patch.
+- Electron 43.8.3 bundles Node 24.22.0, whose `fs.glob` no longer steps into a symlink after `**` (Node 22.23.4 and 24.18.0 still do). The foreground glob worker (`main/services/coding-tool-glob-worker.ts`) now follows the newer rule on every runtime, because the Electron smoke compares it with Electron's native glob. `coding-tools.test.ts` gives the five affected patterns fixed answers instead of the native oracle, so the unit test passes on any local Node. Run the Electron smoke as root with `--no-sandbox` appended after the script arguments.

README.md

@@ -99,7 +99,7 @@ Core technologies include Electron 43, React 19, TypeScript, Vite, Tailwind CSS,
 ### Requirements
 
 - macOS or a glibc 2.34+ x64/arm64 Linux desktop
-- Node.js 22.19 or newer and npm
+- Node.js 22.19 or newer and npm (CI pins 22.23.4; use the newest release of your Node line)
 - Rust and Cargo only for macOS Computer Use helper tests
 - A full Xcode 26 or newer only for macOS Apple Foundation Models builds
 - An Apple signing identity only for packaged macOS distribution builds

THIRD_PARTY_NOTICES.md

@@ -517,8 +517,9 @@ FluidAudio source: https://github.com/FluidInference/FluidAudio/tree/87a39dfe406
 ## Node.js glob traversal rules
 
 The segment traversal rules in `main/services/coding-tool-glob-worker.ts` are
-adapted from Node.js `lib/internal/fs/glob.js` (Node 22.22.3), with host-owned
-bounded filesystem access. Node.js is licensed under the MIT license:
+adapted from Node.js `lib/internal/fs/glob.js` (Node 22.22.3, plus the Node
+24.22 rule that never follows a symlink after `**`), with host-owned bounded
+filesystem access. Node.js is licensed under the MIT license:
 
 Copyright Node.js contributors. All rights reserved.
 Copyright Joyent, Inc. and other Node contributors. All rights reserved.