[Aymericr]

What does this PR do?

Follow-up to #1142, addressing its Codex review comment. engines.node: ">=22.23.4" still allowed vulnerable Node 24.x below 24.22.1, vulnerable 26.x below 26.12.1, and the end-of-life 23 and 25 lines.

This PR sets engines.node to ^22.23.4 || ^24.22.1 || >=26.12.1 in the root package.json and in packages/cli/package.json. The top major stays open; the range is not capped at <27.

No other files change. pascal doctor and the docs are left to Tooling. Nothing in the repo parses engines: only the two package.json files declare it. The CLI's pascal doctor uses its own hardcoded check and never reads engines, and publishing just passes the field through to npm.

Range check (semver 7.8.5, reading engines.node from each file)

package.json: "^22.23.4 || ^24.22.1 || >=26.12.1"  validRange -> >=22.23.4 <23.0.0-0||>=24.22.1 <25.0.0-0||>=26.12.1
  22.23.4  expected pass -> pass
  24.22.1  expected pass -> pass
  26.12.1  expected pass -> pass
  27.0.0   expected pass -> pass
  22.23.3  expected fail -> fail
  23.11.0  expected fail -> fail
  24.22.0  expected fail -> fail
  25.0.0   expected fail -> fail
  26.12.0  expected fail -> fail
  all expectations met: true
packages/cli/package.json: "^22.23.4 || ^24.22.1 || >=26.12.1"  validRange -> >=22.23.4 <23.0.0-0||>=24.22.1 <25.0.0-0||>=26.12.1
  (identical results, all expectations met: true)

Versions that must fit the range

Where	Node	Fits
ci.yml and mcp-ci.yml, pinned node-version: '22.23.4'	22.23.4	yes
ci.yml and release.yml, node-version: 22 with check-latest (latest 22.x on nodejs.org/dist is v22.23.4)	22.23.4	yes
Docker runtime stage node:22.23.4-alpine	22.23.4	yes
Docker build stage nodejs>=24.22.1-r0 (Alpine 3.24 main APKINDEX currently has 24.22.1-r0)	24.22.1	yes

How to test

1. Run npx -p semver@7 semver -r '^22.23.4 || ^24.22.1 || >=26.12.1' 22.23.4 24.22.1 26.12.1 27.0.0 22.23.3 23.11.0 24.22.0 25.0.0 26.12.0. Only 22.23.4, 24.22.1, 26.12.1 and 27.0.0 are printed.
2. Run bun install --frozen-lockfile. It succeeds, and the lockfile is unchanged (I ran this locally).
3. Run cd packages/cli && npm pack --dry-run. It packs normally (I ran this locally).

Screenshots / screen recording

N/A — non-visual change

Checklist

• I've tested this locally with bun dev
• My code follows the existing code style (run bun check to verify)
• I've updated relevant documentation (if applicable)
• This PR targets the main branch

  

---

Note

Low Risk
Metadata-only engines updates with no application logic changes; CI and Docker pins already satisfy the new range.

^{Reviewed by Cursor Bugbot for commit eeec45d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T13:53:37.951244Z	eeec45d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: eeec45d056

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Align pascal doctor with the secured Node range

When the CLI runs on a newly excluded runtime such as Node 23.x, 24.15.0, 25.x, or 26.12.0, packages/cli/src/diagnostics.ts:23-27 still treats every major above 22 as supported and reports a passing Node check. Because the CLI can remain installed or be installed despite an engine warning, pascal doctor can falsely approve the vulnerable runtime this change is intended to reject; update the diagnostic predicate and message from the same version policy as this range.

Useful? React with 👍 / 👎.