[ThomasK33]

Summary

Upgrades the pinned Node toolchain from 26.3.0 to 26.12.1 to fix Node2Shell (CVE-2026-111497). Fixed Node lines: 22.23.4, 24.22.1, 26.12.1 or newer.

Node is a dev and CI tool in this repo (prettier, the release-please scripts, and reviewfixer's ACP adapter). No plugin code runs on Node, and nothing here decodes attacker uploads with Brotli.

Files changed

• mise.toml: node = "26.3.0" → node = "26.12.1".
• mise.lock: the node entry now points to the v26.12.1 tarballs for linux-x64 and macos-arm64. The checksums match https://nodejs.org/dist/v26.12.1/SHASUMS256.txt.

Other Node references checked

I searched the repo for every other Node pin. None needs a change:

• No .nvmrc, .node-version, .tool-versions, Dockerfile or Containerfile.
• scripts/package.json has no engines or volta field. The engines entries in scripts/package-lock.json are dependency minimums, not pins.
• GitHub Actions use jdx/mise-action (no setup-node or node-version), so CI picks up the mise.toml pin.
• .devcontainer/devcontainer.json installs the toolchain through mise and does not pin Node.

Validation

All runs used Node from mise. node -v printed v26.12.1.

• mise install: passed.
• mise run setup: passed.
• mise run check: 0 warnings / 0 errors in 113 files.
• mise run format-check: 254 files, 0 changed.
• mise run test: 706 successes / 0 failures / 0 errors.
• npm ci --prefix scripts and npm --prefix scripts run test:release-please-runner: passed.

CI runs the integration tests. They do not use Node.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T09:09:00.674432Z	df6c5c6	Manual request
🔒 Security Review	✅ Completed 2026-10-24T09:09:25.461914Z	df6c5c6	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: df6c5c6121

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: df6c5c6121

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.