build(deps): bump actions/setup-node from 4 to 6

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/lint.yml

@@ -49,7 +49,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm

.github/workflows/tests.yml

@@ -151,7 +151,7 @@ jobs:
         run: cp app/config.sample.yaml app/config.yaml
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [2.2.2] - 2026-09-23
+
+* Vendor assets: marked 18 is found again, so the image build stops failing
+* Iframe: a page without an iframe parameter no longer frames itself
+* Security: the iframe and the new tab only open a URL the validator returned
+* Tests: the inline-script check parses the page instead of matching a regex
+* Tests: a regression spec guards the page that carries no iframe parameter
+* CI: the Node jobs run the version Cypress 16 supports
+
 ## [2.2.1] - 2026-09-23
 
 * Images: releases ship arm64 next to amd64, for ARM servers and Apple Silicon

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "portfolio-ui"
-version = "2.2.1"
+version = "2.2.2"
 description = "A lightweight YAML-driven portfolio and landing-page generator."
 readme = "README.md"
 requires-python = ">=3.12"