[Darkdragon14]

Summary

• Address the October 2026 Node.js security advisory by pinning development/CI to Node 24.22.1 and enforcing patched Node 24.x through npm engines.
• Select Node.js 24 in the plugin manifest and require Stream Deck 7.1, which introduced Node 24 support. Keep the existing SDK and dependency resolutions unchanged.
• Use reproducible npm ci in CI and document setup and the distinction between system Node and Stream Deck's bundled runtime.
• Runtime limitation: the manifest selects only a major version. Users must update Stream Deck and verify its bundled Node 24 runtime is at least 24.22.1; Stream Deck 7.1 alone does not guarantee that patch.

Testing

• Node 24.22.1: npm ci, npm run build, npx tsc --noEmit, npx prettier --check ., git diff --check all passed.
• Inline assertions verified manifest/engine/lock consistency and unchanged dependency resolutions.
• Built plugin successfully registered against a mock local Stream Deck WebSocket server using the existing SDK on Node 24.22.1.
• npm ci dry-run correctly rejected unpatched Node 24.19.0 with EBADENGINE.
• Actual Windows/macOS Stream Deck hardware and bundled patch verification were not available on this Linux host.
• Exploratory npm audit reports four pre-existing dependency vulnerabilities (three high, one critical: brace-expansion, fast-uri, tar, ws); dependency fixes are outside this Node-core advisory scope.

Review

• JEV verdict: PASS, confidence 0.91.
• Cumulative independent review cycles: 2, in 1 batch (budget: 2).
• Both fresh independent reviewers returned CLEAN. The first JEV verdict requested RETRY; acceptance criteria and validation were rechecked without unnecessary code changes before the final PASS.
• Committed content matches the exact reviewed tree; no hook-induced changes.