fix: update Node.js for November 2026 security release

Author: johnshearar

.changeset/patched-node-runtimes.md

@@ -0,0 +1,6 @@
+---
+'powersync': patch
+'@powersync/cli-plugin-config-edit': patch
+---
+
+Update the Node.js runtime bundled in standalone installers to 24.22.3. The configuration editor now uses the CLI's Node executable so standalone installations use their bundled runtime for the editor.

.nvmrc

@@ -1 +1 @@
-24
+24.22.3

README.md

@@ -6,9 +6,11 @@ Monorepo for the PowerSync CLI and related tooling. Built with [pnpm](https://pn
 
 ## Requirements
 
-- **Node**: LTS v24+ (see [.nvmrc](./.nvmrc); use `nvm use` to switch)
+- **Node**: LTS v24+ (see [.nvmrc](./.nvmrc); use `fnm use --install-if-missing` to switch)
 - **Package manager**: pnpm
 
+Package installations use your own Node runtime; update it to Node 22.23.5, 24.22.3, or 26.13.1 (or a newer patched release in those lines). Rebuild and reinstall standalone installers to update their bundled Node runtime. The configuration editor uses the same Node executable as the CLI.
+
 ## Monorepo structure
 
 The workspace is split into the main CLI, shared **packages**, and optional **plugins**:
@@ -58,7 +60,7 @@ Users can manage their own installed plugins dynamically at runtime. Run `powers
 ## Getting started
 
 ```bash
-nvm use          # use Node from .nvmrc (optional)
+fnm use --install-if-missing
 pnpm install
 pnpm build
 ```

plugins/config-edit/src/commands/edit/config.ts

@@ -49,7 +49,7 @@ export default class EditConfig extends SharedInstanceCommand {
     this.log(`Serving built editor from: ${targetDist}`);
 
     const child = spawn(
-      'node',
+      process.execPath,
       [path.join(targetDist, 'server/index.mjs'), '--host', flags.host, '--port', String(flags.port)],
       {
         cwd: editorDir,