Raise the Node engines floor to the October 2026 security releases (22.23.4 / 24.22.1 / 26.12.1) #2822

Problem

The root package.json declares "engines": { "node": ">=22.19.0" }. Node.js shipped security releases on October 21, 2026: 22.23.4, 24.22.1 and 26.12.1. They update the bundled CA certificates for the eMudhra intermediate CA compromise and fix several high-severity runtime CVEs, including DNS name truncation, TLS hostname checks on non-canonical IPs, and an out-of-bounds write in the Brotli decoder.

The Inspector ships no CA certificates and doesn't opt into the system trust store, so every HTTPS connection it makes, including OAuth discovery and the token endpoints, is only as safe as the Node.js it runs on. An npx user on Node 22.19–22.23.3 gets no signal that their runtime is unpatched: our floor accepts it, so npm prints no EBADENGINE warning.

The v2.13.0 release notes carry a hand-written warning about this. This issue makes the package itself say it.

Proposal

Raise the floor to the patched release on each supported line:

"engines": { "node": "^22.23.4 || ^24.22.1 || >=26.12.1" }

A plain >=22.23.4 would still accept an unpatched 24.x (24.0–24.22.0) and 26.x (26.0–26.12.0), so the per-line range is what states the requirement.

npm only warns on an engines mismatch unless engine-strict=true, so this tells people without blocking anyone. That's the right strength for a runtime we don't control. It's still a visible change for users on older 22.x, so it ships in a minor release with a note.

Every place that states the current floor

Update them together, since a stale copy reads as the real requirement:

• package.json (engines) and package-lock.json (the root package entry)
• README.md: "Requires Node >=22.19.0"
• AGENTS.md: Development setup
• .claude/skills/local-dev/SKILL.md
• docs/cli-smoke-testing.md: prerequisites
• docs/v1-to-v2-migration.md: the Node row and the paragraph under it (keep the history of why the floor exists, which is undici@^8, and add the security reason for the new value)
• .github/ISSUE_TEMPLATE/1-bug_report.yml: the floor in the version field's description and placeholder
• clients/cli/README.md: "the Inspector's supported floor"

These code comments reason from the 22.19 floor, so re-read each one rather than find-and-replace. The NODE_USE_ENV_PROXY claim in particular should be re-checked against 22.23.4:

• core/mcp/node/proxyFetch.ts
• core/mcp/remote/node/server.ts
• core/auth/node/file-secret-store.ts
• clients/web/src/test/integration/auth/node/file-secret-store.test.ts
• clients/web/src/test/integration/mcp/remote/server-extra-coverage.test.ts

Out of scope

• Enforcing the version at runtime (refusing to start on an old Node). Raise that as a separate issue if it's wanted.
• CI's Node version. It already runs the patched release: setup-node uses 22.x, which resolves to the newest 22.
• The Docker image. It already runs node:22-slim at 22.23.4.

Acceptance

• engines is ^22.23.4 || ^24.22.1 || >=26.12.1 in package.json and the lockfile
• Every doc reference above states the new floor
• The code comments above are re-read and corrected where the floor changes the reasoning
• npm run local:gate passes
• The release notes for the version that ships this mention the new floor