From 60f977d50c5b15303804b7acf9e7e0ceae05800e Mon Sep 17 00:00:00 2001 From: dev_agent Date: Sat, 3 Oct 2026 00:24:07 -0400 Subject: [PATCH] Restrict dev secret permissions and state exact Node.js ranges in README The quick start now sets the dev data directory to 700 and the secret key file to 600, so other local users cannot read the key. The prerequisites state the exact supported Node.js ranges from the lockfile's jsdom engine (^22.22.2 || ^24.15.0 || >=26.0.0) instead of "22.22.2 or newer". Co-Authored-By: Claude Opus 5.5 --- README.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 6c5c3ca..c764516 100644 --- a/README.md +++ b/README.md @@ -13,14 +13,18 @@ single Go service with the React PWA embedded in the binary. ## Quick start -Requirements: Go 1.25 and Node.js 22.22.2 or newer (or 24.15 or newer). -Vite and Vitest need at least 22.12; jsdom in the committed lockfile needs -22.22.2 on the 22 line. +Requirements: Go 1.25 and Node.js `^22.22.2 || ^24.15.0 || >=26.0.0` — that +is, 22.22.2 or later on the 22 line, 24.15.0 or later on the 24 line, or 26.0.0 +or later. Node.js 23, 24.0–24.14 and 25 are not supported: this is the +`engines` range of jsdom in the committed lockfile, the strictest of all the +web dependencies. ```sh (cd web && npm ci) mkdir -p ~/.mealquest-dev # outside the repository: it holds a secret +chmod 700 ~/.mealquest-dev head -c 32 /dev/urandom | base64 > ~/.mealquest-dev/secret_key +chmod 600 ~/.mealquest-dev/secret_key export MEALQUEST_HTTP_ADDR=:8080 export MEALQUEST_PUBLIC_URL=http://localhost:5173 export MEALQUEST_DATA_DIR="$HOME/.mealquest-dev"