Move Node to 26 LTS everywhere at once

.devcontainer/Dockerfile

@@ -40,16 +40,17 @@ RUN apt-get update \
     && chmod 0440 /etc/sudoers.d/ubuntu
 
 # Node for src/vue. Pinned exactly and checksummed, rather than tracking a
-# floating major the way ci.yml's `node-version: 24` does. The container is the
+# floating major the way ci.yml's `node-version: 26` does. The container is the
 # place to be reproducible; CI tracking the major is a separate, deliberate
-# choice, and the two are allowed to differ. v24.21.0 is the current 24 LTS
-# (Krypton) and what this repo's contributors have on the host today.
+# choice, and the two are allowed to differ. v26.13.0 is the first 26 LTS
+# (Lithium), released 2026-10-28.
 #
 # Both checksums are here because this image has to build on arm64 (a Mac) and
-# amd64 (CI, and the Windows PC's WSL). `dpkg --print-architecture` picks.
-ARG NODE_VERSION=v24.21.0
-ARG NODE_SHA256_ARM64=6ad1325edbdb5649c379b75a237147a666c95d4f9ae8d340fef2d1575d289ad2
-ARG NODE_SHA256_AMD64=fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6
+# amd64 (CI, and the Windows PC's WSL). `dpkg --print-architecture` picks. They
+# come from https://nodejs.org/dist/v26.13.0/SHASUMS256.txt.
+ARG NODE_VERSION=v26.13.0
+ARG NODE_SHA256_ARM64=406fe3fbde1c054adff8b297c16fdb5af6659db327c1ac8acd46b56ef1af9a92
+ARG NODE_SHA256_AMD64=d28a96af6c38596f6d9d97c0ee531c13d238d757742387d1928de822d959e997
 RUN set -eux; \
     case "$(dpkg --print-architecture)" in \
         arm64) node_arch=arm64; node_sha="${NODE_SHA256_ARM64}" ;; \

.github/renovate.json5

@@ -233,12 +233,12 @@
       // No tracking issue by design - this is not a deferred upgrade. It tracks
       // whatever Node CI runs on, so it moves when that moves and never on its own.
       description:
-        "HOLD @types/node on 24.x to match the Node 24 used by CI and the Cloudflare deploy. It should track the runtime, not the registry. Raise this and the workflows' node-version together.",
+        "HOLD @types/node on 26.x to match the Node 26 used by CI and the Cloudflare deploy. It should track the runtime, not the registry. Raise this and the workflows' node-version together.",
       matchManagers: ["npm"],
       matchPackageNames: ["@types/node"],
-      allowedVersions: "<25.0.0",
+      allowedVersions: "<27.0.0",
       prBodyNotes: [
-        "`node-version: 24` is hardcoded in both .github/workflows/ci.yml and .github/workflows/deploy-cloudflare.yml - there is no .node-version or .nvmrc file for Renovate to bump instead. If this ceiling is ever raised, those two workflows must move in the same PR, or the types will describe a runtime CI is not using.",
+        "`node-version: 26` is hardcoded in both .github/workflows/ci.yml and .github/workflows/deploy-cloudflare.yml - there is no .node-version or .nvmrc file for Renovate to bump instead. If this ceiling is ever raised, those two workflows must move in the same PR, or the types will describe a runtime CI is not using.",
       ],
     },
     {

.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
-          node-version: 24
+          node-version: 26
           cache: "npm"
           cache-dependency-path: ${{ env.BUILD_PATH }}/package-lock.json
 

.github/workflows/deploy-cloudflare.yml

@@ -40,7 +40,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
-          node-version: 24
+          node-version: 26
           cache: "npm"
           cache-dependency-path: ${{ env.BUILD_PATH }}/package-lock.json
       # Node is set up before the planner build because build-wasm runs through

CLAUDE.md

@@ -11,7 +11,7 @@ The planner is written in Rust, in `rust/` (core logic in `rust/planner`). The s
 ## Prerequisites
 
 - **Rust, through rustup.** `rust/rust-toolchain.toml` pins the toolchain (1.99.1, with rustfmt, clippy and the `wasm32-unknown-unknown` target). Inside `rust/`, rustup reads that file and installs the pin on first use, so there is nothing to choose. The pin is deliberate: the planner's whole job is exact, repeatable output, and a compiler change is a codegen change.
-- **Node 24 (Active LTS) and npm** for the front-end in `src/vue`. It uses npm, not pnpm: `package-lock.json` is the lockfile, and CI deploys with the `wrangler` pinned there.
+- **Node 26 (Active LTS) and npm** for the front-end in `src/vue`. It uses npm, not pnpm: `package-lock.json` is the lockfile, and CI deploys with the `wrangler` pinned there.
 - That is all for building and testing. There are no submodules and no .NET. `python3` and a real Factorio install are needed only to capture the Factorio oracle (see below).
 
 ## Common commands
@@ -56,7 +56,7 @@ CI (`.github/workflows/ci.yml`) runs the five Rust check and build commands abov
 
 ### Devcontainer
 
-`.devcontainer/` builds a Linux container carrying every toolchain this repo needs: **Rust 1.99.1 through rustup (with rustfmt, clippy, rust-src and the wasm32 target), Node 24.21.0, python3, git and gcc** (cargo's linker), on plain `ubuntu:26.04` pinned by digest. Node is pinned exactly and checksummed. The base already has user `ubuntu` at uid 1000, which is the container's `remoteUser`. Before stage 13b the image was built on the .NET SDK and also carried dotnet, PowerShell and Lua 5.2; those are gone with the C#.
+`.devcontainer/` builds a Linux container carrying every toolchain this repo needs: **Rust 1.99.1 through rustup (with rustfmt, clippy, rust-src and the wasm32 target), Node 26.13.0, python3, git and gcc** (cargo's linker), on plain `ubuntu:26.04` pinned by digest. Node is pinned exactly and checksummed. The base already has user `ubuntu` at uid 1000, which is the container's `remoteUser`. Before stage 13b the image was built on the .NET SDK and also carried dotnet, PowerShell and Lua 5.2; those are gone with the C#.
 
 **Rust is pre-installed, and `rust/rust-toolchain.toml` still decides.** The image installs the toolchain named by `RUST_VERSION` in the Dockerfile, so creating the container downloads no compiler. Inside `rust/`, rustup reads the toolchain file as it does anywhere else. A stale `RUST_VERSION` therefore breaks nothing - rustup just installs the new pin on first use (about 10 s, measured) - which is exactly why nobody would notice. So the Devcontainer CI job compares `RUST_VERSION` with the toolchain file, checks that `rustc` and `cargo` in `rust/` report that version, and checks that the wasm32 target is installed. **When `rust/rust-toolchain.toml` moves, move `RUST_VERSION` with it.** The toolchain file is in that job's paths filter for this reason.
 

src/vue/package.json

@@ -19,7 +19,7 @@
     "vue": "^3.5.40"
   },
   "devDependencies": {
-    "@types/node": "^24.13.2",
+    "@types/node": "^26.6.6",
     "@vitejs/plugin-vue": "^6.0.8",
     "@vue/devtools-api": "^8.1.5",
     "@vue/eslint-config-prettier": "^10.2.0",