[alexander-sei]

What is the purpose of the change?

CI maintenance. No documentation content changes.

Three workflows pinned Node 20, which reached end-of-life on April 30, 2026. Its last release (v20.20.2) bundles Brotli 1.1.0, which is affected by GHSA-9v8h-qqgm-4m35 (CVE-2026-111497), an out-of-bounds write in the Brotli decoder. Node's October 2026 security release fixes it on 22.x, 24.x, and 26.x only.

Describe the changes to the documentation

No pages change. In regenerate-llms.yml, link-check.yml, and sync-skills.yml, the setup-node step now:

• reads the Node version from .nvmrc (22), the same as seo-audit.yml
• sets check-latest: true, so it resolves the newest 22.x release (the patched 22.23.4) instead of the runner image's cached 22.23.3

Notes

• regenerate-llms.yml is the job that actually runs the vulnerable decoder. scripts/generate-llms.mjs fetches every page from docs.sei.io, and Cloudflare serves those pages Brotli-compressed. The job also pushes straight to main.
• The practical risk is low. The affected jobs only decode HTTPS responses from docs.sei.io, npm, Mintlify, and Anthropic.
• seo-audit.yml, validate-docs.yml, and sync-default-configs.yml are unchanged. They already run Node 22, and their scripts only read local files, so they never decode Brotli.
• To verify: the Setup Node.js step of this PR's link check should report v22.23.4 or later. After merging, run Regenerate llms.txt manually to confirm that workflow too.

Made with Cursor

[cursor]

PR Summary

Low Risk
Only CI Node version resolution changes; no application or docs content is modified.

^{Reviewed by Cursor Bugbot for commit f551aa3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
sei-docs	🟢 Ready	View Preview	Oct 23, 2026, 8:53 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[seidroid]

This small CI change moves link-check.yml, regenerate-llms.yml, and sync-skills.yml off Node 20 and onto the .nvmrc version (22) with check-latest: true, matching seo-audit.yml. I verified that .nvmrc exists at the repo root and that the repo-root checkout runs before setup-node in every changed workflow, so I found no correctness or security problems.

Findings: 0 blocking | 3 non-blocking | 0 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• The Cursor second-opinion pass (cursor-review.md) was empty, so this review had no Cursor input. Codex reported no material issues, and I agree with it.
• check-latest: true makes each job ask the Node dist index for the newest release instead of using the runner's cached 22.x. This adds a small network dependency, and builds can pick up new 22.x patches without notice. That is acceptable here because it is how the patched release gets picked up, but you could remove it once runner images ship 22.23.4 or later.
• After merging, follow the PR's own verification step: run Regenerate llms.txt manually and confirm the Node version it reports. That workflow pushes directly to main, and this PR's CI does not exercise it.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
sei-docs	🟡 Building	–	Oct 23, 2026, 8:52 AM

💡 Tip: Enable Automations to automatically generate PRs for you.