[prx-my]

What changed and why

engines.node claimed >=20, but every workflow pinned Node 24, so the declared floor was never exercised. This raises the declaration to >=22 (the floor #1237 already chose) and adds a CI job that actually runs the suite there.

• package.json / package-lock.json: engines.node -> >=22
• .github/workflows/ci.yml: new node-floor job at Node 22
• website/docs/troubleshooting.md: minimum requirement -> node >= 22

Design choices

Separate job, not a matrix. The existing job is the required build status check. Matrixing it would rename the contexts to build (22) / build (24), so the required build context would never report and every PR would be blocked. The existing job and its name are unchanged.

The new job keeps the advisory sync. The --offline e2e tests need a synced database; skipping the sync would make them fail rather than merely reduce coverage, so the new job mirrors build end to end. It roughly doubles the sync work per push, which seemed the honest trade for a floor that is genuinely tested.

Verification

• npm run build clean on Node 22 and Node 24
• Full suite green on Node 22.23.3: 170 suites, 2406 tests
• Full suite green on Node 26.8.2: 170 suites, 2406 tests
• actionlint clean
• Existing build job untouched, so the required check keeps reporting under its current name

The final check from the issue - breaking something version-sensitive and watching node-floor go red - is being run on this PR next; I will note the result here.

Closes #1356

[cve-lite-cli-bot]

No new vulnerabilities introduced by this PR

_{Posted because this PR changes dependencies. Nothing is posted when they are untouched.}

_{Scanned by CVE Lite CLI, a free and open source OWASP project.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[prx-my]

Probe result, as the issue asked:

• Added a temporary test that loads an ESM module synchronously through require() inside the Jest sandbox. It passes on Node 24/26 and fails on Node 22 with Must use import to load ES Module.
• With that commit pushed, build passed and Node 22 floor failed: https://github.com/OWASP/cve-lite-cli/actions/runs/39551089169
• Removed the probe and pushed again. Both build and Node 22 floor are now green: https://github.com/OWASP/cve-lite-cli/actions/runs/39551348289

This also confirms the required build check still reports under its existing name, so existing PRs are not blocked.

[Copilot]

🟢 Approval recommended

No unresolved issues remain, and the review evidence confirms both CI jobs pass and the new job detects version-sensitive failures.

No open issues 🎉

_{Review effort: Balanced}

[sonukapoor]

Approved, thanks @prx-my.

The part I cared most about was whether the new Node 22 job can actually fail, and your probe settles it: a test that only passes on Node 24 turns the 22 job red while the existing build stays green. The engines floor matches in both the manifest and the lockfile, the job only has read access, and the docs agree with it.

I merge these one at a time rather than in a batch, so it will land shortly.