Close PYSEC-2026-2132 and pin the Node the frontend is built with

CHANGELOG.md

@@ -174,6 +174,28 @@ aggregate instead: an italic *Catalog* line at the end of the version section an
   idle window — so the instance is in practice never reclaimed and visitors keep the
   same time to first byte. `anyplot-api` keeps `min-instances=1`: its cold start is
   ~11.6 s and its traffic does leave gaps over 15 minutes. (#10812)
+- **The frontend declares the Node version it is actually built with, and something
+  enforces it** — `app/package.json` asked for `node >=20` while the image that produces
+  the deployed bundle builds on Node 22 and CI tests on Node 24, so the only version the
+  manifest still admitted was the one nothing tests and that reached end of life in April
+  2026. The floor moves to `>=22.12.0` — the version the build path actually requires
+  (Vite and rolldown declare `^20.19.0 || >=22.12.0`, so `>=22` would have advertised
+  22.0–22.11 as supported and let Vite's own engine check reject them instead) — `app/.nvmrc`
+  names 22 for `nvm use` and `setup-node`, and `app/.npmrc` sets `engine-strict=true` so an
+  npm install in `app/` refuses an unsupported runtime at install time rather than failing
+  later inside the build with a message that never mentions the version (yarn 1, the app's
+  package manager, checks `engines` itself). `docs/development.md` said "Node.js 20+" and now
+  matches. Same pin as the sibling repo kurrentschrift. (#11206)
+
+### Security
+
+- **`click` 8.3.1 → 8.3.3 closes PYSEC-2026-2132** — the only advisory `pip-audit`
+  reports against the resolved runtime dependency set (`uv export --no-dev`), which now
+  comes back clean. A transitive dependency, so the fix is a lock-file bump with no
+  `pyproject.toml` constraint, per the repository's dependency rule. The bump is the
+  minimal one that clears the advisory; `click` 8.5.0 exists and is left to Dependabot,
+  where a minor bump of the library behind every console script gets its own PR and its
+  own CI run. (#11206)
 
 ## [3.2.0] — 2026-08-29 — Findable by assistants
 

app/.npmrc

@@ -0,0 +1,23 @@
+# package.json declares `engines.node` and, until this file existed, nothing
+# enforced it: npm ignores the field unless engine-strict is set, so a machine
+# on an older Node installed happily and only failed later inside the build,
+# with an error that never mentions the version. Enforced here, the refusal
+# happens at install time and names the version it wants.
+#
+# The app's package manager is yarn (CLAUDE.md "Package Management"), and
+# yarn 1 checks `engines` on its own. This file covers the other half: anyone
+# who reaches for npm in `app/` — a quick `npm ci`, a tool that shells out to
+# npm — gets the same refusal instead of a silently unsupported toolchain.
+#
+# The declared floor is 22.12 because that is what the build path needs (Vite
+# and rolldown: `^20.19.0 || >=22.12.0`). `.nvmrc` says plain `22` — the latest
+# 22.x — on purpose, because the dev-only test stack reaches higher still
+# (jsdom wants `^22.22.2`); a floor tracking a transitive dev dependency's
+# patch version would need editing on every bump.
+engine-strict=true
+
+# The audit step of a local install reports the registry's view of dev
+# dependencies, which the deployed bundle does not contain, and costs minutes
+# for an answer no one acts on here. Dependabot watches the manifest instead.
+audit=false
+fund=false

app/.nvmrc

@@ -0,0 +1 @@
+22

app/package.json

@@ -18,7 +18,7 @@
     "test:watch": "vitest"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22.12.0"
   },
   "packageManager": "yarn@1.22.22",
   "dependencies": {

docs/development.md

@@ -7,7 +7,9 @@ Guide for setting up a local development environment.
 ## Prerequisites
 
 - **Python 3.13+**
-- **Node.js 20+** and yarn
+- **Node.js 22.12+** and yarn — `app/.nvmrc` names the version to use (`nvm use` in `app/`),
+  and `app/package.json` refuses anything older. Take the latest 22.x: the build toolchain
+  needs 22.12, and the dev-only test stack (jsdom) currently wants 22.22.
 - **PostgreSQL** (or access to Cloud SQL)
 - **uv** - Fast Python package manager