What

Two pre-GA dependency-hygiene fixes for 4.x.

1. Correct the Node engines floor

package.json advertised node: >=16.0, but the 4.x dependency set already requires Node 20.19+ at runtime:

• chokidar@5 → engines.node >= 20.19.0
• commander@15 / glob@11 → >=20

A user on Node 16–18 got a clean npm install (warning only) and then broke inside dependencies at runtime — the worst version error, during an RC when early adopters are exactly who's installing. >=20.19.0 matches what CI already tests (Node 26.x / 20.x).

Docs updated to state Node 20.19+ (docs/migration-4.md, docs/mcp.md).

2. Clear high/critical production audit findings (no --force)

npm audit --omit=dev:

Changes (all within-range / patch / override — no --force, no direct-dep major bump):

• multer ^2.0.2 → ^2.1.1 (out of the <=2.1.0 advisory; the only consumer is a comment in lib/test-server.js)
• uuid 11.1.0 → 11.1.1 (patch; clears the buffer-bounds advisory)
• tmp override 0.2.5 → 0.2.6 (advisory wants <0.2.6 gone)
• npm audit fix (within existing ranges) for the rest

Remaining 3 findings — justified (no non-breaking fix)

All route through mocha@11.7.5's pinned transitive deps:

• diff@7.0.0 (mocha pins ^7.0.0) — jsdiff DoS; patched in 8.0.3+/9 (crosses mocha's major range)
• serialize-javascript@6.0.2 (mocha pins ^6.0.2) — patched in 7.0.5 (crosses mocha's major range)

mocha@11.7.5 is already the latest mocha; npm's only offered fix is --force to mocha@11.3.0 (a breaking change), which is a deliberate major-bump decision deferred per the plan. These are DoS-class issues in a test runner's diff/serialization of test output — low exploitability in CodeceptJS's usage.

Verification

• npm run test:unit → 727 passed, 0 failed, 11 skipped
• npm run test:runner → 273 passed, 0 failed, 2 skipped
• npm run lint → clean
• npm run test:rest → 38 passed, 1 failed — JSONResponse … parse JSON responses hits the local mock server at :3001/api/comments/1, which returns 404 in this sandbox (the mock only serves /api/users). Environmental/local infra, not caused by these dependency changes (a 404 from a mock server is independent of multer/uuid/tmp); passes in CI's REST environment.

Notes for reviewers

• package-lock.json is gitignored in this repo, so it is not part of the diff; the fixes propagate via the package.json ranges/overrides on fresh install.
• No lib//bin/ source changed. The package.json diff is only version bumps + engines + the tmp override.

🤖 Generated with Claude Code