chore: raise Node.js floor to 22.23.4

.github/workflows/ci.yml

@@ -83,8 +83,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          # Node 22 to match engines.node (>=22.5.0) and other jobs; Node 20 was causing sqlite/compat failures
-          node-version: '22'
+          # Exact 22.23.4 matches engines.node (>=22.23.4). A bare major
+          # (`22`) can resolve below the October 2026 security release.
+          # Node 20 was causing sqlite/compat failures.
+          node-version: '22.23.4'
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -173,7 +175,8 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          # Exact 22.23.4 so the 22 line cannot resolve below the October 2026 security release.
+          node-version: '22.23.4'
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -248,11 +251,12 @@ jobs:
         include:
           - runtime: bun
             version: latest
-          # Node 22 is the floor: prjct uses node:sqlite, which needs >=22.5
-          # (see package.json engines). Node 20 can't run the CLI without Bun,
-          # and we no longer auto-install Bun (MAL-2026-4647).
+          # Node 22.23.4 is the floor (package.json engines): node:sqlite
+          # needs >=22.5, and the October 2026 security release is 22.23.4.
+          # A bare `22` can resolve below that. Node 20 can't run the CLI
+          # without Bun, and we no longer auto-install Bun (MAL-2026-4647).
           - runtime: node
-            version: 22
+            version: '22.23.4'
 
     steps:
       - name: Checkout

.github/workflows/release.yml

@@ -133,8 +133,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          # Node 22: npm@11+ trusted publishing, and avoids GHA Node 20 deprecation.
-          node-version: '22'
+          # Node 22.23.4: October 2026 security release (engines.node >=22.23.4).
+          # A bare `22` can resolve below that floor. npm@11+ trusted publishing;
+          # avoids GHA Node 20 deprecation.
+          node-version: '22.23.4'
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -217,8 +219,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          # Node 22: npm@11+ trusted publishing, and avoids GHA Node 20 deprecation.
-          node-version: '22'
+          # Node 22.23.4: October 2026 security release (engines.node >=22.23.4).
+          # A bare `22` can resolve below that floor. npm@11+ trusted publishing;
+          # avoids GHA Node 20 deprecation.
+          node-version: '22.23.4'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Setup Bun

README.md

@@ -563,7 +563,7 @@ prjct-cli/
 
 ## Requirements
 
-- Node.js 22.5+ (ships `node:sqlite`) or Bun 1.0+
+- Node.js 22.23.4+ (October 2026 security release; `node:sqlite` since 22.5) or Bun 1.0+
 - One of: Claude Code, OpenAI Codex, Gemini CLI, Cursor, OpenCode, Cline, Grok Build, Pi, Kimi Code CLI, or Antigravity
 
 ## Common questions

package.json

@@ -117,7 +117,7 @@
   "packageManager": "bun@1.3.14",
   "engines": {
     "bun": ">=1.0.0",
-    "node": ">=22.5.0"
+    "node": ">=22.23.4"
   },
   "files": [
     "assets/",