[morgankrey]

Result

Node-based CI now uses the supported Node.js 22 line. Every actions/setup-node step asks GitHub Actions for the newest available 22.x patch.

This removes Node.js 20 from these CI jobs. Node.js 20 is end of life and receives no security fixes. Node.js 22.23.4 fixes the October 21, 2026 security release issues, including CVE-2026-111497.

Files changed

• .github/workflows/framework-smoke.yml: Node 20 → 22; added check-latest: true.
• .github/workflows/cross-sdk.yml: both Node 20 steps → 22; added check-latest: true to both steps.
• .github/workflows/cross-sdk-smoke.yml: kept Node 22; added check-latest: true.

No application code changed. There are no Node Docker images or repository Node version files.

What these jobs run

• framework-smoke.yml and cross-sdk.yml install, build, and run the TypeScript ACP SDK from its configured peer commit.
• cross-sdk-smoke.yml installs the pinned Gemini, Claude, and Codex ACP npm agents.
• The current TypeScript SDK lock file already includes packages that require Node 22. It has no source-built binding.gyp addon. It uses platform packages for tools such as esbuild and Rolldown.
• The pinned npm agents accept Node 22. @agentclientprotocol/claude-agent-acp@0.85.0 requires Node 22 or later.

Major-upgrade checks

No checked Node 22 breaking change applies to this code.

Node 22 removes JSON import assertions such as assert { type: 'json' }. The checked TypeScript SDK and Java integration code do not use that syntax. They also do not use the checked internal API process.binding.

A local check used exact Node.js v22.23.4 and npm 10.9.9 against the current TypeScript SDK peer:

• npm ci --no-audit --no-fund: passed.
• npm rebuild: passed.
• NODE_OPTIONS=--pending-deprecation npm run build: passed.
• NODE_OPTIONS=--pending-deprecation npm test: passed, with 20 files and 490 tests.
• No new Node deprecation warning appeared. npm kept one existing dependency warning for whatwg-encoding@2.0.0.

Baseline and after CI results

Baseline on main:

• Framework smoke matrix run 39751258183: failed. setup-node acquired Node 20.20.2. The TypeScript peer install reported EBADENGINE because current packages require Node 22. The run ended with 14 failed scenarios.
• Cross-SDK and load scenarios run 39755231642: failed. The TypeScript jobs used Node 20.20.2 and reported the same EBADENGINE warnings. The TypeScript prepare job and its three scenario jobs failed. Other Rust and Python jobs also failed.
• Real-agent smoke had no recent main run. It runs only when started manually.

After this change:

• All six automatic pull-request checks passed: build, contention, errorprone, java-java, lincheck (acp-core), and lincheck (acp-http-core).
• Framework smoke matrix run 39898264976: Resolved as '22.23.4'. It still ended with the same 14 failed scenarios as the baseline. The existing failure is that the current TypeScript peer no longer creates the expected dist/acp.js file.
• Cross-SDK and load scenarios run 39898267280: every changed Node step logged Resolved as '22.23.4'. The TypeScript peer install no longer reported EBADENGINE. The prepare job and three TypeScript scenario jobs still failed because the current TypeScript peer no longer creates the expected dist/acp.js file. This is the same failure as the baseline.
• Real-agent smoke run 39898269487: Resolved as '22.23.4' and passed for the selected Claude agent in keyless mode.
• The branch runs showed a new DEP0169 warning from pinned GitHub actions. A same-time unchanged-main control run 39899696888 showed the same warning before setup-node ran. It is not caused by the Node 22 job runtime.

The three affected workflows do not start automatically for pull requests. They were started manually on this branch. After merge, confirm the next scheduled Framework smoke matrix and Cross-SDK and load scenarios runs. Start Real-agent smoke manually because it has no schedule.

Risk and rollback

Risk is high compared with a patch-only update because this changes Node.js 20 to Node.js 22. The effect is limited to CI and integration-test tools. It does not change the Java SDK runtime or published application code.

To roll back, revert this pull request. Node.js 20 is vulnerable and end of life, so use that rollback only for a short investigation.