[deloreyj]

Description

Require Node.js ^22.23.4 in the shared GitHub Actions setup and the standalone Dependabot dependency workflow.

Node.js 22.23.4 is a security release. The existing 22.x selector allows actions/setup-node to reuse an older matching version from a runner's tool cache because check-latest defaults to false.

Setting a minimum patched version prevents selection of cached older releases while continuing to allow future Node 22 updates. This changes only the CI Node selectors; it does not change template application code or container images.

Validation

• Prettier check passed for both changed YAML files.
• git diff --check passed.
• Both files parsed successfully as YAML; semantic comparison confirmed only the Node selectors changed.
• Semver checks confirmed that 22.23.3 is rejected, 22.23.4 and 22.24.0 are accepted, and Node 23/24 are excluded.
• The repository's pre-push hook (pnpm run fix) completed with no tracked changes.
• The full test suite was not run locally for this workflow-only change; GitHub Actions will provide integration validation.

Checklist

Template metadata items are not applicable: this PR changes only CI configuration.

• Template Metadata
  • template directory ends with -template
  • "cloudflare" section of package.json is populated
  • template preview image uploaded to Images
  • README is populated and uses <!-- dash-content-start --> and <!-- dash-content-end --> to designate the Dash readme preview
  • .gitignore file exists
  • package.json contains a deploy command
  • package.json contains private: true and no version field

[github-actions]

Dashboard preview link