Bumps the documented Node.js version in .nvmrc from 20.19.0 to 20.20.2 to
pick up the March 24, 2026 security release covering 8 CVEs (2 high-severity
process-crash DoS, 4 medium, 2 low) including:
- CVE-2026-21717 (array index hash collision)
- CVE-2026-21713 (timing-safe comparison in Web Crypto HMAC/KMAC)
- CVE-2026-21710 (null prototype for headersDistinct)
- CVE-2026-21716, 21715 (permission model bypasses)
- CVE-2026-21714 (HTTP/2 NGHTTP2_ERR_FLOW_CONTROL handling)
- CVE-2026-21637 (SNICallback wrap)
Source: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases
Note: Node.js 20 reaches EOL on 2026-04-30. This is likely the last security
release for the 20.x line; a Node 22 LTS migration should follow soon.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: Rohan Prabhu <rohan.prabhu@composio.dev>