why

Follow-up to #3298. Node's Oct 21 security release (10 CVEs, 4 high) is fixed in 22.23.4 / 24.22.1 / 26.12.1; our engines ranges still admit unpatched versions and EOL 25.x.

what changed

• every engines.node → ^22.23.4 || ^24.22.1 || >=26.12.1; packages that were 24-only → ^24.22.1 || >=26.12.1
• published: @browserbasehq/stagehand, @browserbasehq/eve, browse (patch changeset)
• browse enforces engines at startup (bin/run.js), so it now exits on unpatched Node instead of just warning at install
• v4 docs, CLI/integration READMEs, and CONTRIBUTING updated to the new minimums

test plan

• browse --version runs on 24.22.1 and exits with the upgrade message on 24.18.0
• root + cookbook lockfiles unchanged by the engines edits
• CI

---

Summary by cubic

Floors all Node.js engine ranges at the October 2026 patched releases (22.23.4, 24.22.1, 26.12.1) to fix 10 CVEs, 4 of them high severity. The new ranges also exclude EOL Node 25.x.

• Every engines.node range becomes ^22.23.4 || ^24.22.1 || >=26.12.1; 24-only packages use ^24.22.1 || >=26.12.1.
• The browse CLI now exits at startup on unpatched Node instead of only warning during install.
• CLI tests verify unpatched and EOL releases are rejected and the first patched release on each line is accepted.
• Docs, cookbooks, and READMEs state the new minimums.