[JJLiebig]

Context

The October 2026 Node security release fixes high severity issues in the runtime used by development and live workers.

TL;DR

Pin the development toolchain and live worker image to Node 26.12.1.

Summary

• Update the mise Node pin from 26.3.0 to 26.12.1.
• Update the live worker base to node:26.12.1-bookworm-slim, preserving its Debian flavor.
• Preserve package engines, JavaScript output targets, dependencies and all other toolchain pins.

Alternatives

• Retaining older major runtime pins would leave owned tooling below the requested latest security release.

Test Plan

• Hosted make-all required gate passed on 076f0b9; local validation prohibited by repository guidance.
• Hosted static, retained ExUnit, Dialyzer, native/browser acceptance and Windows runtime jobs passed.
• Source diff and whitespace inspection; exact runtime selectors found and updated.
• Official Docker registry confirms node:26.12.1-bookworm-slim is published (HTTP 200).
• Image digest: sha256:b3dbaf0531ffedead011f14afc779688202fc975f89d2cebf2a63e8beed89e8a.
• Review Suite fast rvw_a7212de7: dual clean signoff on 076f0b9.
  Separate runtime-artifact workflow: Linux and Windows builds passed; optional macOS build remains queued awaiting a runner. This is pending, not passed or waived. The required make-all aggregator passed.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 539d5bb2-f651-48f6-bb5a-f5342b7fdc21

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}