[RossHartmann]

Summary

Fixes for the October 2026 security advisories in this repo.

Item	Change
Managed Node for agent adapters	v24.18.0 → v24.22.1 (Brotli decoder RCE CVE-2026-111497, TLS hostname bypasses, randomUUID snapshot entropy, eMudhra CA removal). All six SHA-256 pins replaced.
One version constant	managed_node.rs imports BUZZ_MANAGED_NODE_VERSION from managed_node_paths.rs, so the install path, download URL and readiness probe can't drift. A new test ties each artifact filename to that constant.
CI / dev Node	setup-node 24.14.1 → 24.22.1 in release.yml, windows-canary.yml and upstream-sync-rehearsal.yml. _ci-desktop.yml gets the same pin in a follow-up PR, because Windows runner admission refuses a PR whose reusable workflow differs from main (public_reusable_workflow_not_current, see #204), and that would skip the Windows build for this change. Hermit bin/.node-24.15.0.pkg → bin/.node-24.22.1.pkg, with node/npm/npx/corepack relinked.
rustls-webpki straggler	crates/buzz-feature-flags/tests/fixtures/relay-feature-selection/Cargo.lock was still on 0.103.15 (RUSTSEC-2026-0382). It now resolves 0.103.16. The resolve also adds the ed25519-dalek graph that the path dependency already needs, at the same versions as the root Cargo.lock. The lock was stale before this change.
macOS minimum	tauri.conf.json now sets bundle.macOS.minimumSystemVersion: "10.15". That is the value build-release-config.mjs and MACOSX_DEPLOYMENT_TARGET already ship, so the effective minimum does not change.

Hash verification

gpg isn't installed on this Mac, so the signature on SHASUMS256.txt was not checked. Instead the six hashes were checked against three sources:

• https://nodejs.org/dist/v24.22.1/SHASUMS256.txt. The body of the clear-signed SHASUMS256.txt.asc is byte-identical to it.
• The v24.22.1 release post in nodejs/nodejs.org on GitHub (apps/site/pages/en/blog/release/v24.22.1.md). All six match.
• Hermit's cashapp/hermit-packages node.hcl. The linux-x64 hash matches.

Existing installs

When the pinned version changes, buzz_managed_node_bin_dir() points at a version directory that doesn't exist yet. managed_node_runtime_ready() then returns false. managed_node_orphaned() invalidates any Buzz-managed adapter shims, and the next install calls ensure_managed_node_runtime_blocking(), which downloads and verifies v24.22.1. Nothing resolves node from the old v24.18.0 directory.

Checks run here (no tests on this Mac)

• cargo metadata --locked passes for the root, desktop and fixture manifests.
• cargo fmt --check passes for the desktop crate.
• cargo clippy --lib --tests -D warnings passes for the desktop crate.
• check-kiingo-fork-boundary.mjs passes: 807/807 classified, contamination 0. The new files are covered by a new retain-generic delta.
• The desktop and web file-size gates pass.
• Pushed with --no-verify, so the full pre-push clippy and mesh-llm lanes did not run locally. CI is the gate.
• The new test managed_node_artifact_matches_pinned_version was written but not run (Spot only).

Not in this PR

• The macOS release itself is repointed and released from Kiingo/kiingo.
• System git and /etc/ssl/cert.pem: no code change; see the handoff report.

🤖 Generated with Claude Code