From 8421b7b668484f87cd2bacda8fb4d95a3bc07ab5 Mon Sep 17 00:00:00 2001
From: Paul Nothaft <paul@MacStudio-von-Paul.local>
Date: Mon, 7 Sep 2026 09:00:02 +0200
Subject: [PATCH] fix(setup): require Node 22.12 for sanitize-html

---
 backend/package-lock.json |  2 +-
 backend/package.json      |  2 +-
 scripts/picpeak-setup.sh  | 26 +++++++++-----------------
 3 files changed, 11 insertions(+), 19 deletions(-)

diff --git a/backend/package-lock.json b/backend/package-lock.json
index a5249246..81a66699 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -68,7 +68,7 @@
         "supertest": "^6.3.3"
       },
       "engines": {
-        "node": "^20.19.0 || >=22"
+        "node": ">=22.12.0"
       }
     },
     "node_modules/@apidevtools/json-schema-ref-parser": {
diff --git a/backend/package.json b/backend/package.json
index 7e14fdab..184c3674 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -4,7 +4,7 @@
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
   "engines": {
-    "node": "^20.19.0 || >=22.12.0"
+    "node": ">=22.12.0"
   },
   "scripts": {
     "start": "node server.js",
diff --git a/scripts/picpeak-setup.sh b/scripts/picpeak-setup.sh
index 0e990b8f..4c5e5358 100755
--- a/scripts/picpeak-setup.sh
+++ b/scripts/picpeak-setup.sh
@@ -14,8 +14,8 @@ IFS=$'\n\t'
 readonly SCRIPT_VERSION="2.1.0"
 readonly APP_NAME="PicPeak"
 readonly REPO_URL="https://github.com/PicPeak/picpeak.git"
-readonly NODE_VERSION="20"
-readonly NODE_MIN_VERSION="20.19.0"  # backend engines: ^20.19.0 || >=22.12.0 (sharp 0.35, html-to-text 10; sanitize-html 2.17.7 needs require(esm), unflagged in 20.19 and 22.12)
+readonly NODE_VERSION="22"
+readonly NODE_MIN_VERSION="22.12.0"  # backend engines: >=22.12.0 (sanitize-html 2.17.7)
 readonly MIN_RAM_DOCKER=2048
 readonly MIN_RAM_NATIVE=1024
 readonly MIN_DISK_GB=2
@@ -721,17 +721,11 @@ EOF
 # Native Installation
 ################################################################################
 
-# True when a Node.js version satisfies the backend's engines range
-# (^20.19.0 || >=22.12.0). 21.x is out, and so is 22.0-22.11.
+# True when a Node.js version satisfies the backend's engines range (>=22.12.0).
 node_version_supported() {
-    local ver="$1" major minor
-    major="${ver%%.*}"
-    minor="${ver#*.}"; minor="${minor%%.*}"
-    [[ "$major" =~ ^[0-9]+$ && "$minor" =~ ^[0-9]+$ ]] || return 1
-    [[ "$(printf '%s\n' "$NODE_MIN_VERSION" "$ver" | sort -V | head -1)" == "$NODE_MIN_VERSION" ]] || return 1
-    [[ "$major" == "21" ]] && return 1
-    [[ "$major" == "22" && "$minor" -lt 12 ]] && return 1
-    return 0
+    local ver="$1"
+    [[ "$ver" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || return 1
+    [[ "$(printf '%s\n' "$NODE_MIN_VERSION" "$ver" | sort -V | head -1)" == "$NODE_MIN_VERSION" ]]
 }
 
 install_nodejs() {
@@ -742,9 +736,7 @@ install_nodejs() {
 
     local node_ver
     node_ver=$(command_exists node && node -v | cut -d'v' -f2 || echo "0")
-    # backend engines range is ^20.19.0 || >=22.12.0 (Node 21 is excluded by the glob/minimatch
-    # family; 22.0-22.11 lack unflagged require(esm), which sanitize-html 2.17.7's ESM-only
-    # htmlparser2 needs — the backend would not start)
+    # Match sanitize-html's declared Node minimum, including strict npm installs.
     if node_version_supported "$node_ver"; then
         log_success "Node.js $(node -v) is already installed"
         return
@@ -763,10 +755,10 @@ install_nodejs() {
             ;;
     esac
 
-    # Package managers won't downgrade a newer Node (e.g. 21), so re-verify before continuing
+    # Re-verify in case the package manager did not replace an unsupported Node.
     node_ver=$(command_exists node && node -v | cut -d'v' -f2 || echo "0")
     if ! node_version_supported "$node_ver"; then
-        die "Node.js v$node_ver does not satisfy the backend requirement (^$NODE_MIN_VERSION || >=22.12.0); remove the current Node.js, install a supported version, then re-run this script"
+        die "Node.js v$node_ver does not satisfy the backend requirement (>=$NODE_MIN_VERSION); remove the current Node.js, install a supported version, then re-run this script"
     fi
     log_success "Node.js installed: $(node -v)"
 }