Bump NPM version and configure it to be more secure against supply chain attacks

.github/workflows/audit.yml

@@ -18,7 +18,7 @@ jobs:
   audit:
     strategy:
       matrix:
-        node-version: [ '22' ]
+        node-version: [ '26' ]
         os: [ 'ubuntu-latest' ]
     name: audit
     runs-on: ${{ matrix.os }}

.github/workflows/build-docs.yml

@@ -18,7 +18,7 @@ jobs:
   publish-docs:
     strategy:
       matrix:
-        node-version: [ '22' ]
+        node-version: [ '26' ]
         os: [ 'ubuntu-latest' ]
     name: build-docs
     runs-on: ${{ matrix.os }}

.github/workflows/build.yml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [ 20, 22, 24 ]
+        node-version: [ 22, 24, 26 ]
         os: [ ubuntu-latest, windows-latest, macos-latest ]
         install-command: [ i, ci ]
     runs-on: ${{ matrix.os }}

.github/workflows/lint.yml

@@ -18,7 +18,7 @@ jobs:
   lint:
     strategy:
       matrix:
-        node-version: [ '22' ]
+        node-version: [ '26' ]
         os: [ 'ubuntu-latest' ]
     name: lint
     runs-on: ${{ matrix.os }}

.github/workflows/performance.yml

@@ -14,7 +14,7 @@ jobs:
   performance-test:
     strategy:
       matrix:
-        node-version: [ '22' ]
+        node-version: [ '26' ]
         os: [ 'ubuntu-latest' ]
     name: Test performance
     runs-on: ${{ matrix.os }}

.github/workflows/publish.yml

@@ -12,7 +12,7 @@ jobs:
   publish-docs:
     strategy:
       matrix:
-        node-version: [ '22' ]
+        node-version: [ '26' ]
         os: [ 'ubuntu-latest' ]
     name: publish-docs
     runs-on: ${{ matrix.os }}

.github/workflows/test.yml

@@ -18,7 +18,7 @@ jobs:
   unit-tests:
     strategy:
       matrix:
-        node-version: [ '22' ]
+        node-version: [ '26' ]
         os: [ 'ubuntu-latest' ]
     name: unit-tests
     runs-on: ${{ matrix.os }}
@@ -56,7 +56,7 @@ jobs:
   browser-tests:
     strategy:
       matrix:
-        node-version: [ '22' ]
+        node-version: [ '26' ]
         os: [ 'ubuntu-latest' ]
     name: browser-tests
     runs-on: ${{ matrix.os }}

.npmrc

@@ -0,0 +1,16 @@
+# --- Security ---
+# Run only minimal lifecycle scripts; block arbitrary install scripts from deps
+ignore-scripts=true
+# Fail install if a package has a known advisory at/above this level
+audit-level=low
+# Always verify package integrity against the lockfile
+package-lock=true
+# Dependency cooldown: only install versions published more than N days ago
+# (requires npm >= 11.10.0; silently ignored on older npm)
+min-release-age=30
+
+# --- Reproducibility / supply chain ---
+# Pin exact versions (no ^ or ~) so installs are deterministic
+save-exact=true
+# Enforce the Node/npm range declared in package.json "engines"
+engine-strict=true

.nvmrc

@@ -1 +1 @@
-v18
+v26

docs/guide/building.md

@@ -43,7 +43,7 @@ format , builds ES6 version
 * `npm run bundle:languages` - builds the languages
 * `npm run bundle:typings` - generates TypeScript typing, only emits ‘.d.ts’ declaration files
 
-We use the Node 22 LTS in the build-chain and recommend this version for building. Note that for using (not building) HyperFormula, a wider range of Node versions is supported.
+We use the Node 26 LTS in the build-chain and recommend this version for building. Note that for using (not building) HyperFormula, a wider range of Node versions is supported.
 
 ## Verify the build
 

package.json

@@ -77,14 +77,14 @@
     "verify:typings": "tsc --noEmit",
     "test": "npm-run-all lint test:jest test:browser",
     "test:setup-private": "bash test/fetch-tests.sh",
-    "test:jest": "cross-env NODE_ICU_DATA=node_modules/full-icu jest",
+    "test:jest": "jest",
     "test:watch": "npm run test:jest -- --watch",
     "test:tmp": "npm run test:jest -- --watch function-irr",
     "test:coverage": "npm run test:jest -- --coverage",
     "test:logMemory": "npm run test:jest -- --runInBand --logHeapUsage",
     "test:performance": "npm run benchmark:basic && npm run benchmark:cruds",
     "test:compatibility": "bash test/compatibility/test-compatibility.sh",
-    "test:ci": "cross-env NODE_ICU_DATA=node_modules/full-icu node --expose-gc ./node_modules/jest/bin/jest --forceExit",
+    "test:ci": "node --expose-gc ./node_modules/jest/bin/jest --forceExit",
     "test:browser": "cross-env-shell BABEL_ENV=dist env-cmd -f ht.config.js karma start",
     "test:browser.debug": "cross-env-shell BABEL_ENV=dist NODE_ENV=debug env-cmd -f ht.config.js karma start",
     "typedoc:build-api": "cross-env NODE_OPTIONS=--openssl-legacy-provider typedoc --options .typedoc.md.ts",
@@ -142,7 +142,6 @@
     "eslint-plugin-prettier": "^5.2.1",
     "esm": "^3.2.25",
     "exceljs": "^4.4.0",
-    "full-icu": "^1.5.0",
     "jasmine": "^5.4.0",
     "jest": "^26.6.3",
     "jsdom": "^25.0.1",