Use patched Node 26 for Brotli CVE-2026-111497

.github/workflows/ci.yml

@@ -8,13 +8,13 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: "26.12.1"
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm release:verify
       - run: pnpm bench:size:research
       - uses: astral-sh/setup-uv@v6
         with:
-          version: '0.12.10'
+          version: "0.12.10"
       - run: uv sync --frozen
       - run: uv run python -m unittest training.test_export training.test_data_sources training.test_quality training.test_calibration training.test_experiment_objectives training.test_release_candidate training.test_navigation training.test_navigation_augmentation training.test_evaluate_navigation training.test_typo

.node-version

@@ -0,0 +1 @@
+26.12.1

.npmrc

@@ -0,0 +1 @@
+engine-strict=true

README.md

@@ -42,7 +42,7 @@ Rebuild the index when your menu changes. You do not need to assemble separate n
 
 ## Try it locally
 
-Use Node.js 22.12+ and pnpm 12.4.1 in this repository:
+Use Node.js 26.12.1+ on the 26.x line and pnpm 12.4.1. Vercel builds may use patched Node.js 24.22.1+ on the 24.x line until Node 26 is supported there. These minimums include the CVE-2026-111497 Brotli decoder fix; `.node-version` and CI select 26.12.1:
 
 ```sh
 pnpm install --frozen-lockfile

package.json

@@ -14,7 +14,8 @@
     "bench:size:research": "node --import tsx bench/size-research.ts",
     "bench:browser": "node --import tsx bench/browser.ts",
     "release:verify": "pnpm check && pnpm test:contracts && pnpm test:parity && pnpm build && pnpm bench:size",
-    "test:demo": "node --import tsx bench/demo-check.ts"
+    "test:demo": "node --import tsx bench/demo-check.ts",
+    "preinstall": "node scripts/check-node.mjs"
   },
   "devDependencies": {
     "@types/node": "24.10.1",
@@ -23,5 +24,8 @@
     "tsx": "4.21.0",
     "typescript": "5.9.3",
     "vite": "7.3.5"
+  },
+  "engines": {
+    "node": "^24.22.1 || ^26.12.1"
   }
 }

pnpm-workspace.yaml

@@ -2,3 +2,6 @@ packages:
   - packages/core
 allowBuilds:
   esbuild: true
+
+# Reject Node runtimes without the CVE-2026-111497 security fix.
+engineStrict: true

scripts/check-node.mjs

@@ -0,0 +1,16 @@
+// CVE-2026-111497 is fixed in these Node.js security releases.
+const [major, minor, patch] = process.versions.node.split(".").map(Number);
+const minimum = new Map([
+  [24, [22, 1]],
+  [26, [12, 1]],
+]).get(major);
+if (
+  !Number.isInteger(patch) ||
+  !minimum ||
+  minor < minimum[0] ||
+  (minor === minimum[0] && patch < minimum[1])
+) {
+  throw new Error(
+    "CVE-2026-111497: use Node.js 26.12.1+ on the 26.x line (or patched Node.js 24.22.1+ where Vercel requires 24.x).",
+  );
+}