chore: bump CI Node version 20 → 26

Author: iknox

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20'
+          node-version: '26'
           cache: 'npm'
 
       - name: Install dependencies

.github/workflows/npm-publish.yml

@@ -20,17 +20,16 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20'
+          node-version: '26'
           registry-url: 'https://registry.npmjs.org/'
 
       # ──────────────────────────────────────────────────────────────────────
       # ⚠️  DO NOT REMOVE / DO NOT "SIMPLIFY" THIS STEP. It is load-bearing.
       #
       # Tokenless OIDC "trusted publishing" (used below — `npm publish --provenance`
-      # with NO NODE_AUTH_TOKEN) requires npm >= 11.5.1, but the GitHub-hosted
-      # Node 20 runner ships npm ~10. Without this upgrade the publish fails with:
-      #     npm error 404  'mcp-searxng@<version>' is not in this registry
-      # This exact regression shipped in v1.6.0 — see SEC-015 in TODO-done.md.
+      # with NO NODE_AUTH_TOKEN) requires npm >= 11.5.1, but Node 20 runner ships
+      # npm ~10. Node 26 ships with npm 12+, so this pin may be redundant, but
+      # that's a separate concern — leave it pinned for safety.
       #
       # It is pinned to an EXACT version (NOT `@latest`), so the "mutable npm
       # command" / supply-chain finding that previously prompted its removal does
@@ -76,7 +75,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20'
+          node-version: '26'
           registry-url: 'https://registry.npmjs.org/'
 
       - name: Install and verify mcp-publisher