fix(tooling): require patched Node.js security releases (#415)

* fix(tooling): require patched Node.js security releases

Pin development and CI/build tooling to the October 2026 security releases.
Cloudflare Workers runtime and dependency versions are unchanged.

Signed-off-by: Codex <codex@openai.com>

* fix(deps): patch security scan findings and align Wrangler types

---------

Signed-off-by: Codex <codex@openai.com>

package.json

@@ -7,7 +7,7 @@
   "main": "src/index.ts",
   "type": "module",
   "engines": {
-    "node": "^22.19.0 || >=24.11.0"
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
   },
   "scripts": {
     "dev": "wrangler dev -c wrangler.toml",
@@ -58,12 +58,12 @@
     "@babel/core": ">=7.29.6",
     "esbuild": ">=0.28.1",
     "ws": "8.21.0",
-    "sharp": "0.35.4",
+    "sharp": "0.35.5",
     "browserslist": "4.28.7",
     "baseline-browser-mapping": "2.11.0"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^4.20260630.1",
+    "@cloudflare/workers-types": "^5.20261001.1",
     "@preact/preset-vite": "^2.10.6",
     "@tailwindcss/vite": "^4.3.3",
     "@types/node": "^26.6.4",
@@ -71,7 +71,7 @@
     "tailwindcss": "^4.3.3",
     "tsx": "^4.23.15",
     "typescript": "^6.0.3",
-    "vite": "^8.3.2",
+    "vite": "^8.3.3",
     "wrangler": "^4.146.0"
   },
   "dependencies": {