From 1844e7ddcd455fb9d3d219d518a405fa11e5b864 Mon Sep 17 00:00:00 2001
From: jagdeep sidhu <sidhujag@gmail.com>
Date: Mon, 26 Oct 2026 10:42:58 -0700
Subject: [PATCH] chore: move frontend to patched Node 26

Pin development, CI, and deployment to Node 26.12.1. Keep the existing
build, production audit, deployment-boundary, and browser checks intact.

Update the locked body-parser dependency from 1.20.8 to the supported
1.20.9 security patch for GHSA-27r3-jxmh-p828 without changing Express
major versions or adding an override.
---
 .github/workflows/ci.yml | 13 ++++++-------
 .nvmrc                   |  1 +
 README.md                |  5 +++++
 package-lock.json        |  8 ++++----
 package.json             |  2 +-
 5 files changed, 17 insertions(+), 12 deletions(-)
 create mode 100644 .nvmrc

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5f3a982..99500b5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,9 +20,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # package.json engines is ">=20 <24"; cover both active LTS
-        # lines so a bump in either doesn't silently break CI.
-        node: ['20', '22']
+        # Match the patched runtime used for development and deployment.
+        node: ['26.12.1']
 
     env:
       CI: 'true'
@@ -67,15 +66,15 @@ jobs:
         run: npm run build
 
       - name: Install browser for recovery-alert layout checks
-        if: matrix.node == '22'
+        if: matrix.node == '26.12.1'
         run: npx playwright install --with-deps chromium
 
       - name: Check recovery and dashboard browser flows and small windows
-        if: matrix.node == '22'
+        if: matrix.node == '26.12.1'
         run: npx playwright test --config playwright.config.cjs tests/browser/recovery-alerts.spec.cjs tests/browser/network-availability.spec.cjs
 
       - name: Preserve recovery-alert screenshots and failure traces
-        if: always() && matrix.node == '22'
+        if: always() && matrix.node == '26.12.1'
         uses: actions/upload-artifact@v4
         with:
           name: recovery-alert-browser
@@ -96,7 +95,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: '26.12.1'
       - name: Request exact-commit deployment
         run: node scripts/request-deploy.cjs frontend
         env:
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 0000000..63f87c2
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+26.12.1
diff --git a/README.md b/README.md
index b125d37..0f4f5da 100644
--- a/README.md
+++ b/README.md
@@ -195,3 +195,8 @@ This frontend should not contain private keys, RPC credentials, server secrets,
 
 If you discover a security issue, please avoid opening a public issue with exploit details. Contact the maintainers privately first so it can be reviewed responsibly.
 
+
+## Development runtime
+
+Use Node.js 26.12.1 or a newer patched 26.x release. The exact development and CI version is recorded in `.nvmrc`; run `nvm install && nvm use` before installing dependencies.
+
diff --git a/package-lock.json b/package-lock.json
index 00883c7..3d29f99 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -31,7 +31,7 @@
         "react-scripts": "5.0.1"
       },
       "engines": {
-        "node": ">=20.19.0 <24",
+        "node": ">=26.12.1 <27",
         "npm": ">=10"
       }
     },
@@ -6909,9 +6909,9 @@
       "license": "MIT"
     },
     "node_modules/body-parser": {
-      "version": "1.20.8",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.8.tgz",
-      "integrity": "sha512-JNcyFQ64OiijEkPzUBTCe+hyPXUD/3LEldGQ6iF5LR1w00mx9o7xtDWHXBY2iItjdCFGoilOLNQbH943ut7pHA==",
+      "version": "1.20.9",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.9.tgz",
+      "integrity": "sha512-FISIQxV5u91Y9gvuFq3q/tA/qTqLJn3AhRcEvyozyhJTh5OBFFtv827AdHU7Rbyct4r+Ba1/99oFa1Y3yuFsdw==",
       "license": "MIT",
       "dependencies": {
         "bytes": "~3.1.2",
diff --git a/package.json b/package.json
index 5dfd0e9..44a306f 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
   "version": "0.1.0",
   "private": true,
   "engines": {
-    "node": ">=20.19.0 <24",
+    "node": ">=26.12.1 <27",
     "npm": ">=10"
   },
   "dependencies": {