fix(tooling): require patched Node.js security releases (#415)

* fix(tooling): require patched Node.js security releases

Pin development and CI/build tooling to the October 2026 security releases.
Cloudflare Workers runtime and dependency versions are unchanged.

Signed-off-by: Codex <codex@openai.com>

* fix(deps): patch security scan findings and align Wrangler types

---------

Signed-off-by: Codex <codex@openai.com>

.github/workflows/security-extra.yml

@@ -64,7 +64,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
-          node-version: 22
+          node-version: "22.23.4"
 
       - name: Run pnpm audit
         shell: bash

.github/workflows/sync-global-domains.yml

@@ -23,7 +23,7 @@ jobs:
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
-          node-version: 22
+          node-version: "22.23.4"
 
       - name: Sync generated Bitwarden domains
         env:

.node-version

@@ -1 +1 @@
-24.18.0
+24.22.1

package.json

@@ -7,7 +7,7 @@
   "main": "src/index.ts",
   "type": "module",
   "engines": {
-    "node": "^22.19.0 || >=24.11.0"
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
   },
   "scripts": {
     "dev": "wrangler dev -c wrangler.toml",
@@ -58,32 +58,32 @@
     "@babel/core": ">=7.29.6",
     "esbuild": ">=0.28.1",
     "ws": "8.21.0",
-    "sharp": "0.35.4",
+    "sharp": "0.35.5",
     "browserslist": "4.28.7",
     "baseline-browser-mapping": "2.11.0"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^4.20260630.1",
+    "@cloudflare/workers-types": "^5.20261001.1",
-    "@preact/preset-vite": "^2.10.5",
+    "@preact/preset-vite": "^2.10.6",
     "@tailwindcss/vite": "^4.3.3",
-    "@types/node": "^26.0.1",
+    "@types/node": "^26.6.4",
-    "opencc-js": "^1.3.2",
+    "opencc-js": "^1.4.2",
     "tailwindcss": "^4.3.3",
-    "tsx": "^4.22.4",
+    "tsx": "^4.23.15",
     "typescript": "^6.0.3",
-    "vite": "^8.1.3",
+    "vite": "^8.3.3",
-    "wrangler": "^4.105.0"
+    "wrangler": "^4.146.0"
   },
   "dependencies": {
-    "@noble/hashes": "^2.2.0",
+    "@noble/hashes": "^2.4.0",
     "@simplewebauthn/server": "^13.3.2",
-    "@tanstack/react-query": "^5.101.2",
+    "@tanstack/react-query": "^5.104.0",
-    "@zip.js/zip.js": "^2.8.26",
+    "@zip.js/zip.js": "^2.22.0",
     "fflate": "^0.8.3",
     "jsqr": "1.4.0",
-    "lucide-preact": "^1.22.0",
+    "lucide-preact": "^1.49.0",
     "preact": "^10.29.3",
     "qrcode-generator": "^2.0.4",
-    "wouter": "^3.10.0"
+    "wouter": "^3.13.0"
   }
 }

src/static/global_domains.bitwarden.json

@@ -1,93 +1,24 @@
 [
-  {"type":2,"domains":["ameritrade.com","tdameritrade.com"],"excluded":false},
-  {"type":3,"domains":["bankofamerica.com","bofa.com","mbna.com","usecfo.com"],"excluded":false},
-  {"type":4,"domains":["sprint.com","sprintpcs.com","nextel.com"],"excluded":false},
   {"type":0,"domains":["youtube.com","google.com","gmail.com"],"excluded":false},
   {"type":1,"domains":["apple.com","icloud.com"],"excluded":false},
-  {"type":5,"domains":["wellsfargo.com","wf.com","wellsfargoadvisors.com"],"excluded":false},
   {"type":6,"domains":["mymerrill.com","ml.com","merrilledge.com"],"excluded":false},
-  {"type":7,"domains":["accountonline.com","citi.com","citibank.com","citicards.com","citibankonline.com"],"excluded":false},
-  {"type":8,"domains":["cnet.com","cnettv.com","com.com","download.com","news.com","search.com","upload.com"],"excluded":false},
-  {"type":9,"domains":["bananarepublic.com","gap.com","oldnavy.com","piperlime.com"],"excluded":false},
   {"type":10,"domains":["bing.com","hotmail.com","live.com","microsoft.com","msn.com","passport.net","windows.com","microsoftonline.com","office.com","office365.com","microsoftstore.com","xbox.com","azure.com","windowsazure.com","cloud.microsoft"],"excluded":false},
-  {"type":11,"domains":["ua2go.com","ual.com","united.com","unitedwifi.com"],"excluded":false},
-  {"type":12,"domains":["overture.com","yahoo.com"],"excluded":false},
-  {"type":13,"domains":["zonealarm.com","zonelabs.com"],"excluded":false},
   {"type":14,"domains":["paypal.com","paypal-search.com"],"excluded":false},
-  {"type":15,"domains":["avon.com","youravon.com"],"excluded":false},
-  {"type":16,"domains":["diapers.com","soap.com","wag.com","yoyo.com","beautybar.com","casa.com","afterschool.com","vine.com","bookworm.com","look.com","vinemarket.com"],"excluded":false},
-  {"type":17,"domains":["1800contacts.com","800contacts.com"],"excluded":false},
   {"type":18,"domains":["amazon.com","amazon.com.be","amazon.ae","amazon.ca","amazon.co.uk","amazon.com.au","amazon.com.br","amazon.com.mx","amazon.com.tr","amazon.de","amazon.es","amazon.fr","amazon.in","amazon.it","amazon.nl","amazon.pl","amazon.sa","amazon.se","amazon.sg"],"excluded":false},
-  {"type":19,"domains":["cox.com","cox.net","coxbusiness.com"],"excluded":false},
-  {"type":20,"domains":["mynortonaccount.com","norton.com"],"excluded":false},
-  {"type":21,"domains":["verizon.com","verizon.net"],"excluded":false},
-  {"type":22,"domains":["rakuten.com","buy.com"],"excluded":false},
-  {"type":23,"domains":["siriusxm.com","sirius.com"],"excluded":false},
-  {"type":24,"domains":["ea.com","origin.com","play4free.com","tiberiumalliance.com"],"excluded":false},
-  {"type":25,"domains":["37signals.com","basecamp.com","basecamphq.com","highrisehq.com"],"excluded":false},
-  {"type":26,"domains":["steampowered.com","steamcommunity.com","steamgames.com"],"excluded":false},
-  {"type":27,"domains":["chart.io","chartio.com"],"excluded":false},
-  {"type":28,"domains":["gotomeeting.com","citrixonline.com"],"excluded":false},
-  {"type":29,"domains":["gogoair.com","gogoinflight.com"],"excluded":false},
-  {"type":30,"domains":["mysql.com","oracle.com"],"excluded":false},
-  {"type":31,"domains":["discover.com","discovercard.com"],"excluded":false},
-  {"type":32,"domains":["dcu.org","dcu-online.org"],"excluded":false},
-  {"type":33,"domains":["healthcare.gov","cuidadodesalud.gov","cms.gov"],"excluded":false},
-  {"type":34,"domains":["pepco.com","pepcoholdings.com"],"excluded":false},
-  {"type":35,"domains":["century21.com","21online.com"],"excluded":false},
   {"type":36,"domains":["comcast.com","comcast.net","xfinity.com"],"excluded":false},
-  {"type":37,"domains":["cricketwireless.com","aiowireless.com"],"excluded":false},
-  {"type":38,"domains":["mandtbank.com","mtb.com"],"excluded":false},
-  {"type":39,"domains":["dropbox.com","getdropbox.com"],"excluded":false},
-  {"type":40,"domains":["snapfish.com","snapfish.ca"],"excluded":false},
   {"type":41,"domains":["alibaba.com","aliexpress.com","aliyun.com","net.cn"],"excluded":false},
-  {"type":42,"domains":["playstation.com","sonyentertainmentnetwork.com"],"excluded":false},
-  {"type":43,"domains":["mercadolivre.com","mercadolivre.com.br","mercadolibre.com","mercadolibre.com.ar","mercadolibre.com.mx"],"excluded":false},
-  {"type":44,"domains":["zendesk.com","zopim.com"],"excluded":false},
   {"type":45,"domains":["autodesk.com","tinkercad.com"],"excluded":false},
-  {"type":46,"domains":["railnation.ru","railnation.de","rail-nation.com","railnation.gr","railnation.us","trucknation.de","traviangames.com"],"excluded":false},
-  {"type":47,"domains":["wpcu.coop","wpcuonline.com"],"excluded":false},
-  {"type":48,"domains":["mathletics.com","mathletics.com.au","mathletics.co.uk"],"excluded":false},
-  {"type":49,"domains":["discountbank.co.il","telebank.co.il"],"excluded":false},
-  {"type":50,"domains":["mi.com","xiaomi.com"],"excluded":false},
-  {"type":52,"domains":["postepay.it","poste.it"],"excluded":false},
   {"type":51,"domains":["facebook.com","messenger.com"],"excluded":false},
-  {"type":53,"domains":["skysports.com","skybet.com","skyvegas.com"],"excluded":false},
   {"type":54,"domains":["disneymoviesanywhere.com","go.com","disney.com","dadt.com","disneyplus.com"],"excluded":false},
-  {"type":55,"domains":["pokemon-gl.com","pokemon.com"],"excluded":false},
-  {"type":56,"domains":["myuv.com","uvvu.com"],"excluded":false},
-  {"type":58,"domains":["mdsol.com","imedidata.com"],"excluded":false},
-  {"type":57,"domains":["bank-yahav.co.il","bankhapoalim.co.il"],"excluded":false},
-  {"type":59,"domains":["sears.com","shld.net"],"excluded":false},
-  {"type":60,"domains":["xiami.com","alipay.com"],"excluded":false},
-  {"type":61,"domains":["belkin.com","seedonk.com"],"excluded":false},
   {"type":62,"domains":["turbotax.com","intuit.com"],"excluded":false},
-  {"type":63,"domains":["shopify.com","myshopify.com"],"excluded":false},
   {"type":64,"domains":["ebay.com","ebay.at","ebay.be","ebay.ca","ebay.ch","ebay.cn","ebay.co.jp","ebay.co.th","ebay.co.uk","ebay.com.au","ebay.com.hk","ebay.com.my","ebay.com.sg","ebay.com.tw","ebay.de","ebay.es","ebay.fr","ebay.ie","ebay.in","ebay.it","ebay.nl","ebay.ph","ebay.pl"],"excluded":false},
-  {"type":65,"domains":["techdata.com","techdata.ch"],"excluded":false},
-  {"type":66,"domains":["schwab.com","schwabplan.com"],"excluded":false},
-  {"type":68,"domains":["tesla.com","teslamotors.com"],"excluded":false},
   {"type":69,"domains":["morganstanley.com","morganstanleyclientserv.com","stockplanconnect.com","ms.com"],"excluded":false},
-  {"type":70,"domains":["taxact.com","taxactonline.com"],"excluded":false},
-  {"type":71,"domains":["mediawiki.org","wikibooks.org","wikidata.org","wikimedia.org","wikinews.org","wikipedia.org","wikiquote.org","wikisource.org","wikiversity.org","wikivoyage.org","wiktionary.org"],"excluded":false},
   {"type":72,"domains":["airbnb.at","airbnb.be","airbnb.ca","airbnb.ch","airbnb.cl","airbnb.co.cr","airbnb.co.id","airbnb.co.in","airbnb.co.kr","airbnb.co.nz","airbnb.co.uk","airbnb.co.ve","airbnb.com","airbnb.com.ar","airbnb.com.au","airbnb.com.bo","airbnb.com.br","airbnb.com.bz","airbnb.com.co","airbnb.com.ec","airbnb.com.gt","airbnb.com.hk","airbnb.com.hn","airbnb.com.mt","airbnb.com.my","airbnb.com.ni","airbnb.com.pa","airbnb.com.pe","airbnb.com.py","airbnb.com.sg","airbnb.com.sv","airbnb.com.tr","airbnb.com.tw","airbnb.cz","airbnb.de","airbnb.dk","airbnb.es","airbnb.fi","airbnb.fr","airbnb.gr","airbnb.gy","airbnb.hu","airbnb.ie","airbnb.is","airbnb.it","airbnb.jp","airbnb.mx","airbnb.nl","airbnb.no","airbnb.pl","airbnb.pt","airbnb.ru","airbnb.se"],"excluded":false},
-  {"type":73,"domains":["eventbrite.at","eventbrite.be","eventbrite.ca","eventbrite.ch","eventbrite.cl","eventbrite.co","eventbrite.co.nz","eventbrite.co.uk","eventbrite.com","eventbrite.com.ar","eventbrite.com.au","eventbrite.com.br","eventbrite.com.mx","eventbrite.com.pe","eventbrite.de","eventbrite.dk","eventbrite.es","eventbrite.fi","eventbrite.fr","eventbrite.hk","eventbrite.ie","eventbrite.it","eventbrite.nl","eventbrite.pt","eventbrite.se","eventbrite.sg"],"excluded":false},
   {"type":74,"domains":["stackexchange.com","superuser.com","stackoverflow.com","serverfault.com","mathoverflow.net","askubuntu.com","stackapps.com"],"excluded":false},
   {"type":75,"domains":["docusign.com","docusign.net"],"excluded":false},
-  {"type":76,"domains":["envato.com","themeforest.net","codecanyon.net","videohive.net","audiojungle.net","graphicriver.net","photodune.net","3docean.net"],"excluded":false},
-  {"type":77,"domains":["x10hosting.com","x10premium.com"],"excluded":false},
-  {"type":78,"domains":["dnsomatic.com","opendns.com","umbrella.com"],"excluded":false},
-  {"type":79,"domains":["cagreatamerica.com","canadaswonderland.com","carowinds.com","cedarfair.com","cedarpoint.com","dorneypark.com","kingsdominion.com","knotts.com","miadventure.com","schlitterbahn.com","valleyfair.com","visitkingsisland.com","worldsoffun.com"],"excluded":false},
   {"type":80,"domains":["ubnt.com","ui.com"],"excluded":false},
-  {"type":81,"domains":["discordapp.com","discord.com"],"excluded":false},
-  {"type":82,"domains":["netcup.de","netcup.eu","customercontrolpanel.de"],"excluded":false},
   {"type":83,"domains":["yandex.com","ya.ru","yandex.az","yandex.by","yandex.co.il","yandex.com.am","yandex.com.ge","yandex.com.tr","yandex.ee","yandex.fi","yandex.fr","yandex.kg","yandex.kz","yandex.lt","yandex.lv","yandex.md","yandex.pl","yandex.ru","yandex.tj","yandex.tm","yandex.ua","yandex.uz"],"excluded":false},
-  {"type":84,"domains":["sonyentertainmentnetwork.com","sony.com"],"excluded":false},
   {"type":85,"domains":["proton.me","protonmail.com","protonvpn.com"],"excluded":false},
-  {"type":86,"domains":["ubisoft.com","ubi.com"],"excluded":false},
-  {"type":87,"domains":["transferwise.com","wise.com"],"excluded":false},
-  {"type":88,"domains":["takeaway.com","just-eat.dk","just-eat.no","just-eat.fr","just-eat.ch","lieferando.de","lieferando.at","thuisbezorgd.nl","pyszne.pl"],"excluded":false},
   {"type":89,"domains":["atlassian.com","bitbucket.org","trello.com","statuspage.io","atlassian.net","jira.com"],"excluded":false},
-  {"type":90,"domains":["pinterest.com","pinterest.com.au","pinterest.cl","pinterest.de","pinterest.dk","pinterest.es","pinterest.fr","pinterest.co.uk","pinterest.jp","pinterest.co.kr","pinterest.nz","pinterest.pt","pinterest.se"],"excluded":false},
   {"type":91,"domains":["twitter.com","x.com"],"excluded":false}
 ]

src/static/global_domains.bitwarden.meta.json

@@ -1,9 +1,9 @@
 {
   "source": "https://github.com/bitwarden/server",
   "ref": "main",
-  "generatedAt": "2026-05-05T00:00:00.000Z",
+  "generatedAt": "2026-10-05T11:35:36.755Z",
-  "rulesCount": 91,
+  "rulesCount": 22,
-  "domainsCount": 436,
+  "domainsCount": 186,
   "sourceFiles": [
     "src/Core/Enums/GlobalEquivalentDomainsType.cs",
     "src/Core/Utilities/StaticStore.cs"