security: refresh Node minimum versions after October 2026 patches #183

Goal

Refresh the supported Node security baseline and minimum-version CI after the October 2026 security release, without changing lock ownership or recovery policy.

Verified baseline (2026-10-28)

At bf52923, package.json allows ^22.13.0 || ^24.0.0. Several jobs in ci.yml explicitly pin 22.13.0, alongside floating 22/24 coverage. This allows/testing baseline predates the current security fixes; it does not prove an installed user's runtime version.

The October 21 Node.js security release provides patched baselines 22.23.4 / 24.22.1 / 26.12.1, including Brotli CVE-2026-111497 and DNS/TLS fixes. Applicability depends on the API and attacker-controlled input; this review did not establish exploitability or inspect installed user runtimes.

The inspected package-lock already resolves brace-expansion 5.0.12, which fixes CVE-2026-102276/102277/102278. No duplicate brace-expansion fix is requested. Open dependency PRs #181 and #182 do not replace the Node baseline decision. #42 concerns future Homebrew distribution, not this core runtime/CI baseline.

Acceptance criteria

• Choose patched minimums for the existing supported Node 22/24 lines (at least 22.23.4/24.22.1 for this advisory set), and align engines, CI, release workflow and installation/platform documentation.
• Retain intentional minimum-version testing using patched versions; record any compatibility or release-policy change. Do not silently add Node 26 support.
• Validate native addon loading and real synthetic advisory-lock behavior on the supported macOS/Linux and architecture matrix. Preserve fail-closed outcomes and all signal/identity/ownership checks.
• Run lint, type checking, tests, package smoke and relevant platform smoke checks; report skipped/unverified cases separately.
• Keep advisory applicability conditional on actual API/input paths; no claim of demonstrated remote exploitation or runtime remediation from editing the manifest alone.

No installed runtimes, code, releases, repository settings or live sessions were changed while filing this issue.