From f15a486e6e9491abc759445eeabf47e7e35239a7 Mon Sep 17 00:00:00 2001
From: joshavant <830519+joshavant@users.noreply.github.com>
Date: Wed, 21 Oct 2026 17:06:46 -0500
Subject: [PATCH 1/2] fix(docs): use Node release that rejects compromised CA
 keys

---
 .node-version | 2 +-
 README.md     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.node-version b/.node-version
index 8a94b991..63f87c20 100644
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-26.10.0
+26.12.1
diff --git a/README.md b/README.md
index 1b58487c..1edda515 100644
--- a/README.md
+++ b/README.md
@@ -83,7 +83,7 @@ make test
 make check
 ```
 
-`make check` runs the formatting, vet, vulnerability, dead-code, coverage, smoke, release-script, documentation, and snapshot gates used by CI. The documentation build uses Node.js 26.10.0 (pinned in `.node-version`); `make docs` runs that gate alone. CI pins GoReleaser v2.18.2 for snapshot builds.
+`make check` runs the formatting, vet, vulnerability, dead-code, coverage, smoke, release-script, documentation, and snapshot gates used by CI. The documentation build uses Node.js 26.12.1 (pinned in `.node-version`); `make docs` runs that gate alone. CI pins GoReleaser v2.18.2 for snapshot builds.
 
 macOS CI runs on the Apple Silicon `xcode-27` image with an explicit macOS 13.0 deployment target. Release verification executes Intel binaries under Rosetta, installing it if needed, and rejects binaries that raise the macOS 13 minimum.
 

From 03af4686543fc3071b8ee0e64ece3f783856d822 Mon Sep 17 00:00:00 2001
From: joshavant <830519+joshavant@users.noreply.github.com>
Date: Wed, 21 Oct 2026 17:59:44 -0500
Subject: [PATCH 2/2] fix(images): upgrade Alpine certificate packages

---
 Dockerfile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 16d029c8..774456df 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,6 +4,7 @@ ARG GO_VERSION=1.27.3
 ARG ALPINE_VERSION=3.24
 
 FROM golang:${GO_VERSION}-alpine AS build
+RUN apk add --no-cache --upgrade ca-certificates=20261020-r0 ca-certificates-bundle=20261020-r0
 RUN apk add --no-cache ca-certificates git
 WORKDIR /src
 COPY go.mod go.sum ./
@@ -15,6 +16,7 @@ RUN CGO_ENABLED=0 GOEXPERIMENT=simd GOOS=linux go build -trimpath \
     -o /out/gitcrawl ./cmd/gitcrawl
 
 FROM alpine:${ALPINE_VERSION}
+RUN apk add --no-cache --upgrade ca-certificates=20261020-r0 ca-certificates-bundle=20261020-r0
 RUN apk add --no-cache ca-certificates git openssh-client tzdata \
     && adduser -D -u 10001 -h /home/gitcrawl gitcrawl \
     && mkdir -p /data/config /data/data /data/cache /data/state \