[MikeMcC399]

Situation

Inconsistent default Node.js

After merge of PR #1943, the repo is running in mixed Node.js versions and there is a mismatch between the updated workflows and the definition in .node-version and .nvmrc.

These versions are managed by Renovate, which keeps them at the latest LTS version, restricted however by the "minimumReleaseAge": "7 days" setting to guard against supply-chain attacks.

Renovate does not currently interpret the security key in https://nodejs.org/download/release/index.json and is unable to make an exception for security updates.

On Oct 28, 2026, Node.js plans to promote Node.js 26 to LTS (Long Term Support) status and to release Node.js 26.13.0 as a re-tagged version of the security release Node.js 26.12.1 from Oct 21, 2026.

Divergence of LTS from node24

After the Node.js promotion, and expiry of the 7 day minimumReleaseAge period, Renovate will generate PRs to update Node.js versions to 26.x. This will cause the exception in main & check-dist to diverge in its major version. It was originally being maintained manually so that it mirrored exactly the same Node.js version as the GitHub runner for node24. This is no longer practical (due to Renovate) or necessary (ncc is now compatible with Node.js 26).

Change

The above two separate and related issues happen to coincide. Resolve by bumping to use Node.js 26. Apply this also to main and check-dist.

Update the following to Node.js 26.12.1 as the pre-release of the Node.js 26 LTS version expected on Oct 28, 2026:

• .node-version
• .nvmrc.

Migrate the following workflows to use .node-version consistently:

• .github/workflows/main.yml
• .github/workflows/check-dist.yml

This establishes the security release Node.js 26.12.1 from Oct 21, 2026 as the default baseline for the repo.

There is no change to the compiled action caused by the Node.js version upgrade. The dist directory is identical.

Note

Cypress runs in the action using the version of Node.js provided by the GitHub runner. The version in use depends on GitHub's rollout for GitHub-hosted runners or by updates provided to GitHub self-hosted runners, so different repos may be using different Node.js versions.

When Cypress runs in a cypress/browsers Docker image, the version of Node.js is determined by the version bundled into the image.

Examples use the default Node.js version provided by the respective GitHub Actions runner image.

---

Note

Low Risk
Toolchain and CI configuration only; no runtime action code or dist output changes.

Overview
Aligns the repo on Node.js 26.12.1 by updating .node-version and .nvmrc from 24.22.0.

CI workflows (main.yml, check-dist.yml) stop pinning node-version: 24.22.1 and instead use setup-node with node-version-file: '.node-version' plus npm caching. The release job now installs Node the same way before npm ci and semantic-release.

Dev tooling tracks the bump via @types/node 26.6.5 (and lockfile undici-types updates). The PR notes the built dist/ output is unchanged.

^{Reviewed by Cursor Bugbot for commit f8945db. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🎉 This PR is included in version 7.4.8 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀