From 81262c808741684d11aa4f475c1662acb4b1ee43 Mon Sep 17 00:00:00 2001
From: maxffarrell <72176209+maxffarrell@users.noreply.github.com>
Date: Wed, 21 Oct 2026 21:30:17 -0500
Subject: [PATCH 1/2] Require patched Node.js releases for CVE-2026-111497

---
 .github/workflows/ci.yml | 2 +-
 .node-version            | 1 +
 .npmrc                   | 1 +
 README.md                | 2 +-
 package.json             | 6 +++++-
 pnpm-workspace.yaml      | 3 +++
 scripts/check-node.mjs   | 6 ++++++
 7 files changed, 18 insertions(+), 3 deletions(-)
 create mode 100644 .node-version
 create mode 100644 .npmrc
 create mode 100644 scripts/check-node.mjs

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f85c77b..bd2c3cb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,7 +8,7 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: '22.23.4'
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm release:verify
diff --git a/.node-version b/.node-version
new file mode 100644
index 0000000..b8b23ca
--- /dev/null
+++ b/.node-version
@@ -0,0 +1 @@
+22.23.4
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..b6f27f1
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1 @@
+engine-strict=true
diff --git a/README.md b/README.md
index 6f37211..b146c9f 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,7 @@ Rebuild the index when your menu changes. You do not need to assemble separate n
 
 ## Try it locally
 
-Use Node.js 22.12+ and pnpm 12.4.1 in this repository:
+Use Node.js 22.23.4+ (22.x), 24.22.1+ (24.x), or 26.12.1+ (26.x) and pnpm 12.4.1 in this repository. These minimums include the CVE-2026-111497 Brotli decoder fix; `.node-version` and CI select 22.23.4:
 
 ```sh
 pnpm install --frozen-lockfile
diff --git a/package.json b/package.json
index 9a35653..156d34e 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,8 @@
     "bench:size:research": "node --import tsx bench/size-research.ts",
     "bench:browser": "node --import tsx bench/browser.ts",
     "release:verify": "pnpm check && pnpm test:contracts && pnpm test:parity && pnpm build && pnpm bench:size",
-    "test:demo": "node --import tsx bench/demo-check.ts"
+    "test:demo": "node --import tsx bench/demo-check.ts",
+    "preinstall": "node scripts/check-node.mjs"
   },
   "devDependencies": {
     "@types/node": "24.10.1",
@@ -23,5 +24,8 @@
     "tsx": "4.21.0",
     "typescript": "5.9.3",
     "vite": "7.3.5"
+  },
+  "engines": {
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
   }
 }
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index a30bb51..e0d0650 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -2,3 +2,6 @@ packages:
   - packages/core
 allowBuilds:
   esbuild: true
+
+# Reject Node runtimes without the CVE-2026-111497 security fix.
+engineStrict: true
diff --git a/scripts/check-node.mjs b/scripts/check-node.mjs
new file mode 100644
index 0000000..04bc1ef
--- /dev/null
+++ b/scripts/check-node.mjs
@@ -0,0 +1,6 @@
+// Node bundles Brotli: CVE-2026-111497 is fixed in these security releases.
+const [major, minor, patch] = process.versions.node.split('.').map(Number);
+const minimum = new Map([[22, [23, 4]], [24, [22, 1]], [26, [12, 1]]]).get(major);
+if (!Number.isInteger(patch) || !minimum || minor < minimum[0] || (minor === minimum[0] && patch < minimum[1])) {
+	throw new Error('CVE-2026-111497: upgrade Node.js to 22.23.4+, 24.22.1+, or 26.12.1+ on the corresponding supported major.');
+}

From 713b906b874f33ef3b46059112542433660134af Mon Sep 17 00:00:00 2001
From: maxffarrell <72176209+maxffarrell@users.noreply.github.com>
Date: Wed, 21 Oct 2026 22:09:08 -0500
Subject: [PATCH 2/2] Use patched Node.js 26 for development and CI

---
 .github/workflows/ci.yml |  4 ++--
 .node-version            |  2 +-
 README.md                |  2 +-
 package.json             |  2 +-
 scripts/check-node.mjs   | 20 +++++++++++++++-----
 5 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bd2c3cb..7b38e04 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,13 +8,13 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v4
         with:
-          node-version: '22.23.4'
+          node-version: "26.12.1"
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm release:verify
       - run: pnpm bench:size:research
       - uses: astral-sh/setup-uv@v6
         with:
-          version: '0.12.10'
+          version: "0.12.10"
       - run: uv sync --frozen
       - run: uv run python -m unittest training.test_export training.test_data_sources training.test_quality training.test_calibration training.test_experiment_objectives training.test_release_candidate training.test_navigation training.test_navigation_augmentation training.test_evaluate_navigation training.test_typo
diff --git a/.node-version b/.node-version
index b8b23ca..63f87c2 100644
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-22.23.4
+26.12.1
diff --git a/README.md b/README.md
index b146c9f..ccbd08b 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,7 @@ Rebuild the index when your menu changes. You do not need to assemble separate n
 
 ## Try it locally
 
-Use Node.js 22.23.4+ (22.x), 24.22.1+ (24.x), or 26.12.1+ (26.x) and pnpm 12.4.1 in this repository. These minimums include the CVE-2026-111497 Brotli decoder fix; `.node-version` and CI select 22.23.4:
+Use Node.js 26.12.1+ on the 26.x line and pnpm 12.4.1. Vercel builds may use patched Node.js 24.22.1+ on the 24.x line until Node 26 is supported there. These minimums include the CVE-2026-111497 Brotli decoder fix; `.node-version` and CI select 26.12.1:
 
 ```sh
 pnpm install --frozen-lockfile
diff --git a/package.json b/package.json
index 156d34e..675816d 100644
--- a/package.json
+++ b/package.json
@@ -26,6 +26,6 @@
     "vite": "7.3.5"
   },
   "engines": {
-    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
+    "node": "^24.22.1 || ^26.12.1"
   }
 }
diff --git a/scripts/check-node.mjs b/scripts/check-node.mjs
index 04bc1ef..ba327fe 100644
--- a/scripts/check-node.mjs
+++ b/scripts/check-node.mjs
@@ -1,6 +1,16 @@
-// Node bundles Brotli: CVE-2026-111497 is fixed in these security releases.
-const [major, minor, patch] = process.versions.node.split('.').map(Number);
-const minimum = new Map([[22, [23, 4]], [24, [22, 1]], [26, [12, 1]]]).get(major);
-if (!Number.isInteger(patch) || !minimum || minor < minimum[0] || (minor === minimum[0] && patch < minimum[1])) {
-	throw new Error('CVE-2026-111497: upgrade Node.js to 22.23.4+, 24.22.1+, or 26.12.1+ on the corresponding supported major.');
+// CVE-2026-111497 is fixed in these Node.js security releases.
+const [major, minor, patch] = process.versions.node.split(".").map(Number);
+const minimum = new Map([
+  [24, [22, 1]],
+  [26, [12, 1]],
+]).get(major);
+if (
+  !Number.isInteger(patch) ||
+  !minimum ||
+  minor < minimum[0] ||
+  (minor === minimum[0] && patch < minimum[1])
+) {
+  throw new Error(
+    "CVE-2026-111497: use Node.js 26.12.1+ on the 26.x line (or patched Node.js 24.22.1+ where Vercel requires 24.x).",
+  );
 }