v2.12.3

Security fix: eMudhra CA compromise

Backport of the v3 fix for the eMudhra certificate authority compromise to the v2 line.

Changes

• Bump Node.js from 22.21.1 to 22.23.4. This removes the compromised eMudhra intermediates from Node.js's bundled CA store.
• Fail the build if ca-certificates is older than 20250419+deb13u1
  (DSA-6572-1). That version distrusts the affected emSign and Comodo AAA roots.

Upgrading

If you pin the block to a version, update the pin:

  image: bh.cr/balenalabs/browser-<arch>/2.12.3

where <arch> is one of aarch64, armv7hf or amd64.