[coder9io]

Refs #8. This is the first part: no Node.js release contains the fix yet.

What

• 7cafb89 build: engines.node: ">=22" in package.json and the lockfile (npm also fixed the lockfile's stale root license from Apache-2.0 to MIT). README now states the Node requirement and notes that the OTLP/HTTPS exporters validate TLS with the consumer's Node.
• a44c7d8 ci: CI matrix [18, 20, 22] → [22, 24, 26], release job 20 → 24, and check-latest: true on both setup-node steps so they resolve the newest patch from nodejs.org, not the runner's cached toolchain.

Why

Node 18 (EOL 2025-04-30) and 20 (EOL 2026-04-30) will never get the SPKI blocklist backport (nodejs/node#66871, commit d9a3f3d). Every supported line (22, 24, 26) is still waiting for a release:

Line	Latest release	Date	Contains fix
26	v26.12.0	2026-10-14	no (predates the 2026-10-20 merge)
24	v24.22.0	2026-10-14	no
22	v22.23.3	2026-09-23	no

Source: https://nodejs.org/dist/index.json and the upstream PR's merged_at (2026-10-20T16:43Z), checked 2026-10-21.

Node execution surfaces

• CI (.github/workflows/ci.yml): build, lint, test. Updated.
• Release (.github/workflows/release.yml): test, build, GitHub release. No npm publish and no shipped artifact. Updated.
• Consumer runtime: the library runs in the user's process; engines.node and the README state the requirement.
• None of these exist here: .nvmrc, .node-version, Dockerfiles, a deployed service.

TLS evidence (current, unpatched)

process.version v24.22.0
https://dv-g3b-emudhra.we-have-a-problem.com/ -> HTTP 200
https://registry.npmjs.org/ -> HTTP 200

This confirms that v24.22.0 still accepts the compromised chain. The rejection criterion can only pass on a fixed release.

Tests

This is a config/docs change, so there is no unit test to write. Ran locally on Node v24.22.0: npm run lint, npm test (12/12), npm run build. CI covers 22/24/26. Both commits were checked on their own; the second changes only workflow YAML.

Remaining (follow-up)

Once Node publishes releases with the fix, raise engines.node to those exact patch versions, rerun the TLS probe on each line, and record process.version plus the release notes.

Refs #8 (one part; the issue stays open)

Agent usage

• Est. cost at Anthropic list price: $0.78
• Models:
  • claude-opus-5-5 · $0.66 · 36 input · 10,503 output · 720,839 cache-read · 38,674 cache-write-1h
  • claude-sonnet-5-5 · $0.11 · 10 input · 1,418 output · 131,480 cache-read · 21,311 cache-write-1h
• Agent runs: 2 · elapsed: 2m
• Pricing snapshot: 2026-10-14.2 (https://claude.com/pricing + https://platform.claude.com/docs/en/build-with-claude/prompt-caching (1h cache writes), checked 2026-10-14)

---

Opened by coder9io. Review comments and CI results on this PR are picked up automatically.

[reviewer9io]

Reviewed the complete change at a44c7d8e681819ba4d1320da26461bc584b8441b, including workflow/release behavior, engine and lock metadata, documented consumer contract and runtime entry points. No actionable blockers found.

On Node 24.22.0, a fresh locked install, typecheck, build and all 12 existing tests passed. Three additional deterministic Jest probes passed for zero-timeout success, timeout followed by late rejection and reuse, error identity/timer cleanup, and the compiled entry point. Exact-head CI independently passed on Node 22/24/26; I did not rerun 22/26 locally.

This approves the supported-runtime migration. Live OTLP/TLS and CA-blocklist rejection were not exercised; the documented patched-release follow-up remains separate.