[sadrbot]

What this PR does

This PR moves CI from Node 24.22.1 to Node 26.13.0. Node 26 became the newest LTS line (Lithium) with 26.13.0 on 2026-10-28, which is past the 7-day cooldown. It also moves the Semgrep CI image from 1.182.0 to 1.183.0, pinned by digest.

Changes

• Node 24.22.1 → 26.13.0 (all three actions/setup-node steps in .github/workflows/conformance.yml)
• semgrep/semgrep image 1.182.0 → 1.183.0, pinned by digest (.github/workflows/semgrep.yml)

Supply chain

• cooldown: unchanged (the repo has no package manager and no lockfile)
• pins: semgrep/semgrep:1.183.0@sha256:2e45517a85e13a9cca14a2a00df6bb48affd66b8ebfae1b0991cd57578362fb0. The actions (checkout v7.0.1, setup-node v7.1.0, upload-artifact v7.0.2), the koreader/kosync digest and the koreader/test-data commit are unchanged and already on the newest release that cleared the cooldown.
• cooldown exceptions: none
• inside the cooldown (already merged): none
• waiting for cooldown: semgrep/semgrep 1.184.0 (clears 2026-11-12T18:52Z)

Security findings

• untriaged: 0 → 0 (Semgrep API and semgrep ci --dry-run)
• open: 0 → 0
• fixed: 0
• false positive: 0
• accepted risk: 0
• other: 0
• suppressions reviewed: 0

Holds

• None.

AGENTS.md

• ### Toolchain: CI fetches koreader/test-data at commit c3b5d06e1ae8ea088bd898b0e7f9da3753d0d86c. The repo has no release tags. Written in sadr: AGENTS.md facts 2026-11-08 #9.

Merging

• auto-merge: all (owner Settings in pid1/.github, upkeep PRs)
• turned on auto-merge (merge)

Needs you

• None.

Verification

• Node 26.13.0 (official linux-x64 tarball, SHA-256 checked against SHASUMS256.txt) ran every check below.
• node --check verify.mjs && node --check vectors/check.mjs && node --check coverage.mjs: passed
• node coverage.mjs: "OK — spec and verifier agree."
• node vectors/check.mjs --big --koreader koreader-test-data: 10 passed, 0 failed, against koreader/test-data at c3b5d06e1ae8ea088bd898b0e7f9da3753d0d86c
• node verify.mjs --help: exit 2, as designed
• reference check: KOSYNC_NAME=kosync-sadr KOSYNC_PORT=18080 sh reference-server/run.sh start (koreader/kosync digest bb3f1361), ciuser2 registered as the reference job does, then node verify.mjs --base-url http://127.0.0.1:18080 --user ciuser1 --password cipass1 --register --strict-accept --second-user ciuser2 --second-password secondpass: "RESULT: conformant", exit 0, 49 passed, 0 MUST failures, 2 SHOULD failures, as in the README table
• semgrep/semgrep:1.183.0 at the new digest: semgrep --version printed 1.183.0
• pins.py check .github/workflows/*.yml: 13 pins checked, 0 with problems
• semgrep ci --dry-run on main and on this branch: the same 3 Code findings, all triaged as accepted risk already
• gitleaks 8.30.1: full history and this branch, no leaks found

Run

• 7 minutes, US$1.69

Not done or not checked

• None.

---

Opened by Sadr, a dark factory for software.