[ThomasK33]

Upgrades the repo's Node toolchain from 25.9 (25.9.0) to 26.12.1 to fix CVE-2026-111497 (Node2Shell).

Node 25.x is end of life and gets no fix for this CVE, so this moves to the supported 26.x line. The fix is the Node upgrade itself. This package does not decode attacker uploads with Brotli, so this is not an emergency fix.

Files changed

• mise.toml: node = "25.9" → node = "26.12.1" (exact pin). CI, publish, release-prebuilds and release-changelog workflows all get Node from this file through jdx/mise-action.
• mise.lock: regenerated the tools.node entries with mise lock node. All 7 platform checksums match the official SHASUMS256.txt from nodejs.org (and unofficial-builds.nodejs.org for the two musl entries, which newer mise resolves to the real musl tarballs instead of the glibc ones).

Node references I checked and left unchanged

• package.json engines.node is >=20.19. This is the consumer support range of the published Node-API package, not the runtime pin. Raising it would drop support for consumers, so it stays.
• @types/node ^25.0.0: type definitions only, not a runtime.
• dogfood/bootstrap/*: recorded logs from an earlier session (they mention 25.9.0). They are historical evidence, not configuration.
• No .nvmrc, .node-version, volta, Dockerfile/Containerfile, devcontainer, or setup-node/node-version entries exist in the repo.

Validation (local, linux-x64, Node v26.12.1, zig 0.15.2)

• mise install, then node -v → v26.12.1
• mise run ci steps: npm ci, npm run build:libghostty, npm run build:native, npm run build, npm run typecheck, npm test (6/6 passed), npm run smoke: all exit 0
• mise run release-prebuilds steps: npm run build:prebuild, npm run verify:prebuilds, npm pack --dry-run: all exit 0
• The repo has no lint script.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T15:59:20.933364Z	cef277a	Manual request
🔒 Security Review	✅ Completed 2026-10-23T16:00:01.612254Z	cef277a	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: cef277aa80

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: cef277aa80

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.