[alerizzo]

Summary

• CVE-2026-111497 is an out-of-bounds write in the Brotli decoder bundled with Node.js. The CLI has no Brotli dependency, but fetch (undici) decompresses Content-Encoding: br responses through that decoder, so the runtime is the exposure.
• engines goes from >=20 to ^22.23.4 || ^24.22.1 || >=26.12.1, the first patched release of each line. Node 20 is EOL and was never patched, so it is dropped. The CI matrix moves from [20, 22] to [22, 24].
• Changeset is minor: engines only warns on install and does not block it. Say so if you'd rather ship this as major.
• The lockfile resync also corrects its stale root version (1.9.0 → 1.14.0).

Test plan

• CI passes on Node 22 and 24
• npm install on Node < 24.22.1 (24.x) shows an EBADENGINE warning; on a patched Node it doesn't

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

⚠️ Resolve issues before merging

The runtime requirement is documented but not enforced: npm engine constraints can be ignored, and direct CLI execution remains possible on unsupported Node.js versions. Add an early startup guard before network initialization and test supported and rejected boundaries.

The lockfile synchronization requirement also appears unaddressed, and the specified installation, CI runtime, and lockfile checks are missing. These gaps should be resolved before merging.

Test suggestions

• Verify the package engine constraint accepts only the specified patched Node.js release ranges.
• Verify installation on an unsupported Node.js release emits an EBADENGINE warning, while installation on a patched release does not.
• Run CI build, smoke test, and test suite on Node.js 22 and 24.
• Verify the lockfile root version is synchronized with the package version.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify the package engine constraint accepts only the specified patched Node.js release ranges.
2. Verify installation on an unsupported Node.js release emits an EBADENGINE warning, while installation on a patched release does not.
3. Run CI build, smoke test, and test suite on Node.js 22 and 24.
4. Verify the lockfile root version is synchronized with the package version.

_{TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

Add an early startup check for the supported patched Node.js ranges before network or API initialization. The engines field is advisory and does not prevent execution on a vulnerable runtime; the guard should emit a clear upgrade message and exit nonzero for unsupported versions.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

[alerizzo]

Not adding a guard in this PR, on purpose: a runtime version check was considered and left out. engines is meant to be advisory here. A hard exit would break the CLI for everyone on an unpatched 22/24 point release, and the realistic exposure (a malicious br body from app.codacy.com / cveawg.mitre.org over verified TLS) is low. If we want enforcement later, a warn-only check is the likely shape, in a separate PR.

_{🤖 Generated by /pr-fixup command}

[alerizzo]

Re the Codacy review:

• Runtime guard: deliberately out of scope; see the inline reply.
• Lockfile sync "unaddressed": false positive. package-lock.json now has root version: 1.14.0, matching package.json, and its root engines matches the new range (both are in the diff).
• CI on Node 22 and 24: covered; build-and-test (22) and build-and-test (24) both pass. The suggested engine and EBADENGINE tests would only exercise npm itself, so none were added.

_{🤖 Generated by /pr-fixup command}