smart-web-mcp 1.9.3 → 1.10.0

package/CHANGELOG.md

@@ -5,6 +5,7 @@ All notable changes to this project will be documented in this file.
 The format is based on Keep a Changelog[^1] and this project uses SemVer.
 
 ## Unreleased
+* Support Node.js 24 LTS and 26 Current with engine-strict installs and a required two-runtime CI gate. Align the development Node pin at 24.21.0 and npm at 11.13.0 without changing the dependency graph; verify pin/lockfile consistency and add local native Impit, fresh stdio MCP and owned Playwright smoke checks with single-run timing receipts. Keep npm as the package manager; no live host migration is implied.
 * Bind Threads text to the exact requested native timestamp permalink instead of an earlier same-author root. Reuse direct source HTML or one deadline/session-preserving browser continuation; retain actual verified author-continuation URLs, reject unbound metadata completeness, and record real browser provenance. Dates come only from the selected native timestamp; whole-conversation/comment retrieval and metadata media scoping are not implied.
 * Make the pending native-tab cleanup regression reach its actual create request after CDP fixture initialization. Preserve the 100ms task deadline, cleanup-incomplete assertion and 1.5s bound; production behavior is unchanged.
 * Reject missing-page shells before adaptive-scraper recovery can replace failed acquisition, sharing title/body validation with generic articles and reader relays. Preserve real recovered articles and failed-attempt provenance; direct primary extraction is no longer labeled browser evidence when no browser ran.
@@ -469,6 +470,13 @@ The format is based on Keep a Changelog[^1] and this project uses SemVer.
 - Korean public API helpers now validate outbound URLs and redirects before fetching, blocking localhost, private, and reserved targets unless `network.allowPrivateHosts` is explicitly enabled.
 - CI now declares read-only default repository permissions, Dependabot auto-merge pins the reusable workflow without forwarding all caller secrets, and the workflow check enforces those guards.
 
+## [1.10.0](https://github.com/jojo-labs/smart-web/compare/v1.9.3...v1.10.0) (2026-10-07)
+
+
+### Features
+
+* support Node 24 and 26 with reproducible runtime gates ([#896](https://github.com/jojo-labs/smart-web/issues/896)) ([f3f3ab1](https://github.com/jojo-labs/smart-web/commit/f3f3ab19c3d8d8dd71c0d771d819b7968a8bf10e))
+
 ## [1.9.3](https://github.com/jojo-labs/smart-web/compare/v1.9.2...v1.9.3) (2026-10-05)
 
 

package/README.md

@@ -22,7 +22,7 @@ Track shipped evidence and remaining work in [the revamp issue](https://github.c
 
 ## Quick start
 
-Requires Node.js 24 and npm. Start the stdio server:
+Requires Node.js 24 (LTS) or 26 (Current) and npm. Development pins and isolated runtime checks: [runtime support](https://github.com/jojo-labs/smart-web/blob/main/docs/runtime-support.md). Start the stdio server:
 
 ```bash
 npx -y smart-web-mcp

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "smart-web-mcp",
   "mcpName": "io.github.jojo-labs/smart-web",
-  "version": "1.9.3",
-  "packageManager": "npm@11.9.0",
+  "version": "1.10.0",
+  "packageManager": "npm@11.13.0",
   "description": "Local MCP for web search, direct-URL fetch, site crawling, docs export, and bounded smartbrowser local browser actions.",
   "homepage": "https://github.com/jojo-labs/smart-web",
   "bugs": {
@@ -70,8 +70,9 @@
     "test": "node --import tsx --test src/browser-continuation.test.ts src/generic-discussion.test.ts src/github-discussion.test.ts src/blind-post.test.ts src/cli-fetch-options.test.ts src/body-export.test.ts src/assessment.test.ts src/browser-session.test.ts src/shared.test.ts src/extraction.test.ts src/assets.test.ts src/dev-runtime.test.ts src/release-scripts.test.ts src/provider-benchmark-script.test.ts src/smartsearch-quality-benchmark-script.test.ts src/no-secret-surface-watchdog-script.test.ts src/partial-handoff-watchdog-script.test.ts src/render.test.ts src/providers.test.ts src/hackernews-recovery.test.ts src/smartcrawl.test.ts src/smartcrawl-export.test.ts src/provider-policy.test.ts src/archive-fallback.test.ts src/mcp.test.ts src/korea/korea.test.ts src/korea/coupang-recovery.test.ts src/search-browser.test.ts src/search-integrity.test.ts src/fetch-isolation.test.ts src/fetch-deadline.test.ts src/search-quality.test.ts src/smartbrowser.test.ts src/browser-participation.test.ts src/retirement.test.ts src/dcinside-comments.test.ts src/ppomppu-comments.test.ts src/clien-comments.test.ts src/naver-blog.test.ts src/naver-cafe.test.ts src/operator-canary.test.ts src/operator-canary-cli.test.ts src/operator-cdp.test.ts src/operator-cancellation.test.ts src/operator-restart.test.ts",
     "test:e2e": "node --import tsx --test src/packaged-mcp.test.ts",
     "test:browser": "node --import tsx --test --test-concurrency=1 src/operator-browser.e2e.test.ts src/browser-actions.e2e.test.ts src/dcinside-pages.e2e.test.ts src/naver-cafe.e2e.test.ts src/operator-cancellation.e2e.test.ts",
+    "test:runtime": "node scripts/runtime-smoke.mjs",
     "test:file": "node --import tsx --test",
-    "check:meta": "node scripts/check-metadata.mjs",
+    "check:meta": "node scripts/check-toolchain.mjs && node scripts/check-metadata.mjs",
     "check:workflow": "node scripts/verify-release-workflow.mjs",
     "check:smoke": "npm run typecheck && npm run check:meta && npm run check:workflow",
     "check": "npm run build && npm run check:meta && npm run check:workflow && npm run test && npm run test:e2e",
@@ -94,7 +95,7 @@
   "author": "jojo-labs",
   "license": "SEE LICENSE IN LICENSE",
   "engines": {
-    "node": ">=24 <25"
+    "node": "^24.0.0 || ^26.0.0"
   },
   "dependencies": {
     "@extractus/article-extractor": "^9.0.0",