[Darkdragon14]

Summary

• Bump the plugin manifest version to 2.2.0.1.
• Address the October 2026 Node.js security advisory: development/CI pin Node 24.22.1, enforce patched Node 24.x, and select Node 24 / Stream Deck 7.1 in the manifest.
• Resolve all current npm audit findings with compatible updates to ws, tar, fast-uri, brace-expansion, and serialize-javascript.
• Keep SDK 2.0.1. Pin the inspected Elgato Utils 0.4.1 and narrowly override its Zod dependency to patched 4.6.7. Elgato already imports Zod 4 Mini from its Zod 3.25 dependency, and patched Zod preserves the consumed subpath; regression tests exercise its actual RPC schemas. README documents the override and removal condition.
• Add compatibility tests and CI type/build/test/audit checks. No npm audit fix --force, SDK downgrade, or application behavior changes.
• Runtime limitation: manifest selects a major only. Stream Deck's managed runtime must independently be Node 24.22.1 or later; system Node/npm updates do not update it.

Testing

All final checks passed on Node 24.22.1 / npm 11.19.1:

• npm ci
• npm audit and npm audit --audit-level=high: 0 vulnerabilities (previously 6 high, 1 critical, 1 low).
• npm test: Rollup build plus 2 regression tests (valid/invalid Elgato RPC schemas and built-plugin registration against a mock Stream Deck WebSocket server).
• npx tsc --noEmit
• npx prettier --check .
• git diff --check
• Initial Node batch also verified npm rejects unpatched Node 24.19.0 with EBADENGINE.
• Real Windows/macOS Stream Deck hardware validation was unavailable on this Linux host.

Review

• Latest JEV verdict: PASS, confidence 0.97.
• Cumulative independent review cycles: 4, across 3 batches.
• Node migration batch: 2 cycles, CLEAN reports; RETRY then PASS (0.91).
• User-authorized npm audit follow-up batch: cycle 1 of 4, fresh independent report CLEAN, PASS (0.85). Reviewer inspected the complete PR scope.
• User-authorized version correction batch: cycle 1 of 1, fresh independent report CLEAN, PASS (0.97). Build, both tests, types, formatting, audit (0 vulnerabilities), and version/metadata consistency assertions passed again.
• Committed content matches the exact reviewed state; no hook-induced changes.