[ivanovac]

Summary

Removes Node.js 22.23.4 and 24.22.2 from the buildpack dependency catalog ahead of the v1.9.8 release.

• 22.23.4 and 24.22.2 are affected by 4–7 High severity CVEs from the November 11, 2026 Node.js security release
• Removing them ensures semver constraints cannot resolve to a vulnerable runtime during staging
• Patched versions 22.23.5 and 24.22.3 are being added in this same release

CVEs addressed (High severity)

CVE	22.x	24.x	Description
CVE-2026-123864	✓	✓	TLS heap read via re-entrancy (info disclosure, CVSS 8.1)
CVE-2026-123865	✓	✓	HTTP/2 memory/fd leak during shutdown
CVE-2026-123866	✓	✓	HTTP/2 use-after-free in stream teardown
CVE-2026-123872	✓	✓	TLS 1.2 renegotiation mTLS bypass
CVE-2026-123863	—	✓	HTTP/2 assertion failure DoS
CVE-2026-126051	—	✓	TLS deferred callback crash
CVE-2026-123874	—	✓	HTTP/2 use-after-free in respondWithFile()

Reference: https://nodejs.org/en/blog/vulnerability/november-2026-security-releases

Test plan

• Verify manifest.yml no longer contains 22.23.4 or 24.22.2 entries for any stack
• Unit tests pass
• Integration tests pass with 22.23.5 / 24.22.3 as the resolved versions

[tnikolova82]

lgtm