fix: sichere Brotli-Laufzeit ab und erhöhe Patchversionen

.nvmrc

@@ -0,0 +1 @@
+24.22.1

backend/.nvmrc

@@ -0,0 +1 @@
+24.22.1

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "timeclock-backend",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "TimeClock v3 - Backend API für Zeiterfassung",
   "main": "src/index.js",
   "scripts": {
@@ -34,5 +34,8 @@
   },
   "devDependencies": {
     "nodemon": "^3.0.2"
+  },
+  "engines": {
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
   }
 }

backend/scripts/require-safe-node.cjs

@@ -0,0 +1,22 @@
+// CVE-2026-111497: Node's bundled Brotli decoder must include the security fix.
+// Check Node versions: patched releases can still report Brotli 1.2.0.
+// https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
+'use strict';
+
+function requireSafeNode() {
+  const [major, minor, patch] = process.versions.node.split('.').map(Number);
+  const minimum = { 22: [23, 4], 24: [22, 1], 26: [12, 1] }[major];
+  const patched = minimum && (minor > minimum[0] ||
+    (minor === minimum[0] && patch >= minimum[1]));
+
+  if (!patched) {
+    throw new Error(
+      `CVE-2026-111497: Node.js ${process.versions.node} is not an approved patched runtime. ` +
+      'Use Node.js 22.23.4+, 24.22.1+ or 26.12.1+ within those release lines. ' +
+      'Recommended: nvm install && nvm use (see .nvmrc). Restart all server/PM2 processes after upgrading.'
+    );
+  }
+}
+
+requireSafeNode();
+module.exports = requireSafeNode;

backend/src/index.js

@@ -1,3 +1,4 @@
+require('../scripts/require-safe-node.cjs');
 const express = require('express');
 const cors = require('cors');
 const helmet = require('helmet');

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "timeclock",
-  "version": "3.1.1",
+  "version": "3.1.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "timeclock",
-      "version": "3.1.1",
+      "version": "3.1.3",
       "license": "ISC",
       "workspaces": [
         "backend",
@@ -14,11 +14,14 @@
       ],
       "devDependencies": {
         "concurrently": "^8.2.2"
+      },
+      "engines": {
+        "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
       }
     },
     "backend": {
       "name": "timeclock-backend",
-      "version": "3.0.1",
+      "version": "3.0.2",
       "license": "ISC",
       "dependencies": {
         "bcrypt": "^5.1.1",
@@ -39,6 +42,9 @@
       },
       "devDependencies": {
         "nodemon": "^3.0.2"
+      },
+      "engines": {
+        "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
       }
     },
     "frontend": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "timeclock",
-  "version": "3.1.2",
+  "version": "3.1.3",
   "description": "TimeClock v3 - Full-Stack Zeiterfassungsanwendung",
   "private": true,
   "workspaces": [
@@ -27,6 +27,9 @@
   "license": "ISC",
   "devDependencies": {
     "concurrently": "^8.2.2"
+  },
+  "engines": {
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
   }
 }