[Droptops]

PR #26 is merged, but its Node requirement (>=22.23.4) also admits vulnerable early 24.x/26.x releases, and both lockfiles still advertise Node 20. Package engine declarations alone also do not stop an already-installed application from running on an old executable.

This follow-up enforces ^22.23.4 || ^24.22.1 || ^26.12.1 in both packages and lockfiles, enables npm engine enforcement, and checks the running Node version at Next.js startup and before all inspected outbound fetch calls. The checks cover direct Next.js invocation and HTTP clients invoked without npm lifecycle hooks. Unsupported majors and prereleases fail with an actionable error.

CI retains the patched 22.23.4 pin, uses npm ci, and now runs on pushes to the actual default branch (master). The compressed-request guard remains in place; its comments now explain that handler-level rejection cannot protect decoding performed earlier by a framework/proxy or by outbound fetch.

Validation in an isolated workspace using the official Node 22.23.4 Linux binary, verified against its published SHA-256:

• eval/: npm run ci: 40 cases load, ESM check passes, 76/76 tests pass.
• agentic-eval/: npm test: 31/31 tests pass.
• Regression coverage rejects vulnerable patch boundaries on all three supported majors and verifies that transport is never called on an unpatched runtime.
• Startup/config checks reject the workspace's Node 24.19.0 and accept Node 22.23.4.
• JavaScript syntax checks pass; the existing CRLF content in claude.js is preserved.

No model API evaluations or deployment changes were performed. Existing deployments still need the patched Node executable installed, services restarted, and containers rebuilt/recreated. After this change, an old runtime will intentionally fail startup or outbound requests.

Reference: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases