[davidmreed]

What changes

• .github/workflows/ci-build.yml: adds "22.23.4" to the node-version matrix, next to the existing 20.x, 22.x, 24.x and 26.x rows. It runs on both ubuntu-latest and windows-latest and with both undici@^7 and undici@^8. 22.23.4 is the Node 22 release that ships the eMudhra distrust in its bundled root store.
• The exclude entry (20.x + undici@^8) is unchanged and still applies only to 20.x. LATEST_SUPPORTED_NODE stays 24.x, so the new row runs npm test, not coverage or docs.
• No rows are removed. engines in packages/*/package.json are not changed.

Where it ships

• These are npm packages, and their engines fields are consumer ranges (e.g. packages/web-api/package.json:24 >= 20, packages/rtm-api/package.json:25 >=18). Node uses its own bundled roots, so the fix for consumers is the Node runtime they run. This PR adds CI coverage on a fixed Node 22 release.
• The 20.x row (ci-build.yml:22) is kept. Node 20 is EOL and will never get a release with the fix. Whether to raise the supported floor and drop 20.x is a maintainer decision and is outside this PR.
• Already covered without changes: release.yml:30,105 (node-version: 24) and the 22.x/24.x/26.x rows.

Not covered by this PR

• Dropping Node 20 or raising package engines. Maintainer decision.

Verification

• CI: awaiting maintainer approval. This is a fork PR, and its workflow runs show action_required. The results below are from local runs.
  In node:22.23.4 (Linux), I ran the same steps as the matrix job for each undici variant: npm ci, npm install undici@^N --workspace=packages/socket-mode --no-save, npm run build, npm run lint, npm test.
• undici@^7: build, lint and test all exit 0.
• undici@^8: build, lint and test all exit 0.
• The Windows rows were not run locally. They run in CI on this PR once a maintainer approves the workflow runs.

🤖 Generated with Claude Code
Part of the eMudhra 53119 CA-distrust remediation (CVE-2026-111943).

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7a00759

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR