@ihyeon/flow-qa 0.2.4 → 0.2.5

package/README.ko.md

@@ -13,17 +13,19 @@ CLI와 `127.0.0.1` 전용 웹 UI를 제공합니다. UI는 영어로 시작하
 
 ## 로컬 데모 시작
 
-Node.js 24.8 이상이 필요합니다. 브라우저는 첫 웹 실행 전에 설치합니다.
+Node.js 24.x(24.22.1 이상) 또는 26.12.1 이상이 필요합니다. 브라우저는 첫 웹 실행 전에 설치합니다.
 
 ```sh
-npm install -g @ihyeon/flow-qa@0.2.4
+npm install -g @ihyeon/flow-qa@0.2.5
 flow-qa browser install
 flow-qa ui --demo
 ```
 
 출력된 로컬 UI 주소에서 **케이스 보관함 → 예제 불러오기 → 검토 → 실행** 순서로 진행합니다. 데모 앱과 별도 작업 공간이 함께 시작되며 API 키가 필요하지 않습니다. 결과는 현재 디렉터리의 `.flowqa/ui-demo-en/`에 저장됩니다. 기존 한국어 데모 데이터는 별도로 유지되며, 언어 전환은 예제·사용자 문장을 자동 번역하지 않습니다. 문제가 있으면 `flow-qa browser install --with-deps`로 Chromium의 시스템 의존성을 설치할 수 있습니다. 자세한 화면 동작은 [UI 안내](https://github.com/hyeonse-swing/flow-qa/blob/main/docs/ui.md)에 있습니다.
 
-소스에서 개발하거나 검증을 재현하려면:
+Flow QA를 설치하기 전에 Node 자체도 업데이트해야 합니다. npm 패키지 업데이트만으로 실행 중인 Node가 패치되지는 않습니다. 최소 버전은 [2026년 10월 21일 Node 보안 릴리스](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)를 기준으로 하며 Node 25는 지원하지 않습니다. nvm을 쓴다면 `nvm install 24.22.1`, `nvm use 24.22.1`을 실행하고 이미 실행 중인 Flow QA를 재시작하세요.
+
+소스에서 개발하거나 검증을 재현하려면 `.nvmrc`에 지정된 Node 24 LTS를 사용합니다(nvm: `nvm install`, `nvm use`).
 
 ```sh
 npm ci

package/README.md

@@ -13,17 +13,19 @@ Flow QA is available as a CLI and a web UI bound to `127.0.0.1`. Provide a targe
 
 ## Try the local demo
 
-Node.js 24.8 or later is required. Install Chromium before the first web run:
+Node.js 24.x (24.22.1 or later) or 26.12.1 or later is required. Install Chromium before the first web run:
 
 ```sh
-npm install -g @ihyeon/flow-qa@0.2.4
+npm install -g @ihyeon/flow-qa@0.2.5
 flow-qa browser install
 flow-qa ui --demo
 ```
 
 Open the printed local UI address, then follow **Case library → Load → Review → Run QA**. The command starts a separate local demo app and workspace; no API key is needed. Results are saved under `.flowqa/ui-demo-en/` in the current directory. If Chromium lacks system libraries, use `flow-qa browser install --with-deps`. See the [UI guide](https://github.com/hyeonse-swing/flow-qa/blob/main/docs/ui.md).
 
-To work from source or reproduce the checks:
+Upgrade Node itself before installing Flow QA; an npm package update does not patch the runtime. This minimum follows the [October 21, 2026 Node.js security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Node 25 is not supported. With nvm, run `nvm install 24.22.1` and `nvm use 24.22.1`, then restart any running Flow QA process.
+
+To work from source or reproduce the checks, use the Node 24 LTS version pinned in `.nvmrc` (with nvm: `nvm install` and `nvm use`):
 
 ```sh
 npm ci

package/docs/mobile.md

@@ -1,6 +1,6 @@
 # User-configured iOS and Android targets
 
-Mobile targets require Flow QA `0.2.0` or later and Node.js 24.8 or later. The web demo remains a browser demo; it is not proof of a mobile run.
+Mobile targets require Flow QA `0.2.0` or later and Node.js 24.x (24.22.1 or later) or 26.12.1 or later. The web demo remains a browser demo; it is not proof of a mobile run.
 
 ## Write cases now, connect an app later
 
@@ -9,7 +9,7 @@ Choose **Mobile** on the scenario screen, describe the flow, and generate or dow
 With the installed CLI:
 
 ```sh
-npm install -g @ihyeon/flow-qa@0.2.4
+npm install -g @ihyeon/flow-qa@0.2.5
 flow-qa init ./my-qa
 # Write your mobile flow in my-qa/flows/my-flow.md first.
 flow-qa plan flows/my-flow.md --platform mobile --prompt-only --workspace ./my-qa

package/docs/releases.md

@@ -2,6 +2,19 @@
 
 The alpha entries below are historical release records. They document earlier package versions and checks.
 
+## 0.2.5: update the Node.js security baseline
+
+Raises the Node.js requirement to `^24.22.1 || >=26.12.1` for the [October 21, 2026 security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases), including fixes in TLS, DNS, HTTP, and Brotli. Vulnerable Node 24/26 versions and the unsupported Node 25 line no longer satisfy the package engine requirement. Local development and all release jobs use Node 24.22.1 from `.nvmrc`.
+
+Upgrade Node itself and restart Flow QA; installing this package does not replace an existing Node process. With nvm, run `nvm install 24.22.1` and `nvm use 24.22.1` before installing Flow QA. The locked Undici dependency is also updated from 7.30.0 to 7.30.1 for its [security fixes](https://github.com/nodejs/undici/releases/tag/v7.30.1). Application behavior and direct dependency versions remain unchanged.
+
+The separate MCP server SDK findings in `npm audit` remain in the pinned e2e dependency. Flow QA invokes `e2e run`, not the MCP server command; upgrading that runner requires separate compatibility validation and is outside this Node security patch.
+
+Locally verified on macOS with Node.js 24.22.1 on 2026-10-22: 92 tests, type checking, UI syntax and design-system audit, real Chromium UI and demo checks, package validation, and a fresh tarball install with three passing browser cases. The engine range rejects older Node 24/26 versions and Node 25, and all release jobs read the same runtime pin. No model calls were used.
+
+- Package: [`@ihyeon/flow-qa@0.2.5`](https://www.npmjs.com/package/@ihyeon/flow-qa/v/0.2.5)
+- Release: [GitHub 0.2.5](https://github.com/hyeonse-swing/flow-qa/releases/tag/v0.2.5)
+
 ## 0.2.4: confirm before replacing unsaved cases
 
 Loading a library suite, importing valid case files, or starting a new JSON draft now asks before discarding unsaved content. Cancel preserves the current draft and selected import files. New JSON drafts keep the scenario text; unchanged saved cases, flow-only JSON resets, and ordinary screen navigation stay quiet. Failed imports still report validation errors without replacing the draft. Existing save, review, generation, and execution behavior remains unchanged.

package/docs/ui.md

@@ -4,10 +4,10 @@ Describe a user flow, review cases, and configure a target when ready to run. We
 
 ## Start
 
-Node.js 24.8 or later is required. Install Flow QA and start the web demo:
+Node.js 24.x (24.22.1 or later) or 26.12.1 or later is required. Node 25 is unsupported. Upgrade the Node runtime and restart any running UI process; updating Flow QA alone does not patch Node. Install Flow QA and start the web demo:
 
 ```sh
-npm install -g @ihyeon/flow-qa@0.2.4
+npm install -g @ihyeon/flow-qa@0.2.5
 flow-qa browser install
 flow-qa ui --demo
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ihyeon/flow-qa",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "license": "MIT",
   "author": "Hyeonse Im",
   "repository": {
@@ -38,7 +38,7 @@
   "description": "Turn user flows into repeatable tests and evidence-backed QA reports.",
   "type": "module",
   "engines": {
-    "node": ">=24.8.0"
+    "node": "^24.22.1 || >=26.12.1"
   },
   "bin": {
     "flow-qa": "./dist/bin/flow-qa.mjs"