fix(deps): clear 8 advisories, and pin the Node that writes the lockfile

.github/workflows/ci-cli.yml

@@ -50,6 +50,10 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # Deliberately NOT the repo's pinned Node: this job exists to prove the
+      # published launcher still runs on the oldest Node tools/cli claims to
+      # support (`engines: >=20`). It installs nothing from the root lockfile,
+      # so the pin does not apply to it.
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
@@ -74,7 +78,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "20"
+          node-version-file: ".nvmrc"
           cache: npm
           cache-dependency-path: package-lock.json
 
@@ -86,11 +90,7 @@ jobs:
       # matched only the CLI's own suite. They cover the staging modules this job
       # then packs, so this is their natural home.
       - name: Test desktop-runtime staging modules
-        # Glob UNQUOTED so bash expands it. This job runs Node 20, where
-        # `node --test` does not expand glob patterns itself — quoting it made
-        # node look for a literal file named "*.test.mjs" and fail with
-        # "Could not find". The desktop workflow gets away with the quoted form
-        # only because it runs Node 22.
+        # Glob left UNQUOTED so the shell expands it, which works on every Node.
         run: node --test tools/desktop-runtime/*.test.mjs
 
       - name: Build payload inputs

.github/workflows/ci-desktop.yml

@@ -69,7 +69,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version-file: ".nvmrc"
           cache: npm
 
       - name: Install Node dependencies
@@ -133,7 +133,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version-file: ".nvmrc"
           cache: npm
 
       # --ignore-scripts skips electron's postinstall (a ~100 MB download this job
@@ -236,7 +236,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version-file: ".nvmrc"
           cache: npm
 
       # _lib.py needs 3.11+ (StrEnum). Pinned rather than trusting whatever

.github/workflows/ci-frontend.yml

@@ -56,7 +56,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version-file: ".nvmrc"
           cache: npm
 
       - name: Install Node dependencies

.github/workflows/ci-host-typecheck.yml

@@ -64,7 +64,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version-file: ".nvmrc"
           cache: npm
 
       # Plain `npm ci`, matching ci-frontend and ci-desktop. --ignore-scripts

.github/workflows/deploy-website.yml

@@ -30,7 +30,7 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version: "22"
+          node-version-file: ".nvmrc"
           cache: npm
 
       - name: Install

.github/workflows/desktop-supervised-boot-drill.yml

@@ -84,7 +84,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version-file: ".nvmrc"
           cache: npm
 
       # Same download cache release-desktop.yml uses — keyed on the pinned

.github/workflows/release-cli.yml

@@ -80,12 +80,11 @@ jobs:
         with:
           python-version: "3.13"
 
-      # Node 22, not the 20 the CI workflows use: trusted publishing requires
-      # >= 22.14.0. ci-desktop already runs 22, so this is not a new runtime for
-      # the desktop and frontend builds this job performs.
+      # The repo's pinned Node, same as every other builder. Trusted publishing
+      # needs >= 22.14.0, which the pin satisfies.
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version-file: ".nvmrc"
           cache: npm
           cache-dependency-path: package-lock.json
           registry-url: "https://registry.npmjs.org"

.github/workflows/release-desktop.yml

@@ -74,7 +74,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version-file: ".nvmrc"
           cache: npm
 
       # Cache the downloaded CPython + PostgreSQL archives (~80 MB/platform).

.npmrc

@@ -0,0 +1,7 @@
+# The lockfile is only valid for the npm that wrote it: npm 10 and npm 11
+# disagree about which tree a given package.json resolves to, so a lockfile
+# written by one can be rejected by the other. `engines` in package.json names
+# the one Node this repo builds with; engine-strict turns npm's advisory
+# EBADENGINE warning into a refusal, because a precondition nobody enforces is
+# not a precondition. Use .nvmrc to get that Node.
+engine-strict=true

.nvmrc

@@ -0,0 +1 @@
+22.23.2

apps/frontend/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:26-alpine AS build
+FROM node:22.23.2-alpine AS build
 
 WORKDIR /repo