build(web): upgrade to Node 26 LTS and TypeScript 7

.devcontainer/Dockerfile

@@ -1,11 +1,11 @@
 FROM ubuntu:24.04
 
-ARG NODE_MAJOR=24
+ARG NODE_MAJOR=26
 
 # Avoid interactive prompts during package install
 ENV DEBIAN_FRONTEND=noninteractive
 
-# Install the Node 24 LTS baseline required by Babel 8 and the web toolchain.
+# Install the Node 26 LTS baseline used by the web toolchain.
 RUN apt-get update && apt-get install -y curl ca-certificates gnupg \
     && curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash - \
     && apt-get install -y nodejs

.github/workflows/reliability-qualification.yml

@@ -39,7 +39,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: '24.22.1'
+          node-version-file: .nvmrc
 
       - uses: actions/setup-go@v6
         with:

.nvmrc

@@ -1 +1 @@
-24.22.1
+26.13.0

Dockerfile

@@ -6,7 +6,7 @@ ARG SQLITE_AUTOCONF_VERSION=3540100
 ARG LIBUV_VERSION=1.53.0
 ARG LLHTTP_VERSION=9.4.3
 ARG LLHTTP_TARBALL_SHA256=1eb813c7437b31a87496a1cd3ed79f00746720f5e7e29c79b42c02cb69f36c39
-ARG NODE_MAJOR=24
+ARG NODE_MAJOR=26
 ARG DEB_BUILD=false
 
 FROM debian:${DEBIAN_SUITE}-slim AS target-sysroot
@@ -59,8 +59,8 @@ ENV DEBIAN_FRONTEND=noninteractive
 COPY --from=target-sysroot / /opt/target-sysroot/
 
 # Install build dependencies including Node.js and target FFmpeg dev libraries.
-# Node.js comes from NodeSource so every Debian suite uses the Node 24 LTS
-# baseline required by the Babel 8 web test toolchain.
+# Node.js comes from NodeSource so every Debian suite uses the Node 26 LTS
+# baseline used by the web toolchain.
 # sid ships Go 1.26+/FFmpeg 9.x; trixie ships Go 1.24+/FFmpeg 7.x.
 #
 # ARMv7 is cross-compiled on the x86_64 runner. Compiling LiteRT/XNNPACK under

README.md

@@ -85,7 +85,7 @@ environment variables and upgrades are covered in the [Docker guide](docs/DOCKER
 | **Home Assistant** | Add [opensensor/lightnvr-hassio-addons](https://github.com/opensensor/lightnvr-hassio-addons) under *Settings → Add-ons → Add-on Store → ⋮ → Repositories*, then install LightNVR. See [Home Assistant](docs/HOME_ASSISTANT.md). |
 | **Debian / Ubuntu** | `.deb` packages for amd64, arm64 and armhf are attached to each [release](https://github.com/opensensor/lightNVR/releases). |
 | **Windows** | [Podman + WSL2](docs/WINDOWS_PODMAN.md) |
-| **From source** | [Build guide](docs/BUILD.md): FFmpeg ≥ 7.1, Node.js 24, CMake. Required for embedded targets. |
+| **From source** | [Build guide](docs/BUILD.md): FFmpeg ≥ 7.1, Node.js 26, CMake. Required for embedded targets. |
 
 ### First login
 

docs/BUILD.md

@@ -41,7 +41,7 @@ sudo apt-get install -y \
 - `libmbedtls-dev` is **required** for ONVIF and authentication.
 - `libmosquitto-dev` (≥ 2.0) and `libyaml-dev` are optional. Without them CMake prints a
   warning and builds without MQTT, or without go2rtc override validation.
-- Building the web UI needs **Node.js 24** (the version in `.nvmrc`). Distribution packages
+- Building the web UI needs **Node.js 26** (the version in `.nvmrc`). Distribution packages
   are often older; use [NodeSource](https://github.com/nodesource/distributions) or
   [nvm](https://github.com/nvm-sh/nvm).
 

docs/RELEASE_PROCESS.md

@@ -207,7 +207,7 @@ When you push a tag, GitHub Actions automatically:
    releases.
 
 2. **Builds web assets** during the Docker build:
-   - Installs Node.js 24.x LTS
+   - Installs Node.js 26.x LTS
    - Runs `npm ci --ignore-scripts` from the committed lockfile
    - Runs `npm run build` to build with Vite
    - Copies built assets to `/var/lib/lightnvr/www/` in the runtime image
@@ -324,10 +324,10 @@ If the Docker build fails to find web assets:
 
 ### Local build doesn't match Docker build
 
-This can happen if you have different Node.js versions. The Docker build uses Node.js 24.x LTS. To match locally:
+This can happen if you have different Node.js versions. The Docker build uses Node.js 26.x LTS. To match locally:
 
 ```bash
-# Install the version pinned in .nvmrc (Node.js 24.x LTS)
+# Install the version pinned in .nvmrc (Node.js 26.x LTS)
 nvm install
 nvm use
 

docs/api/contracts/toolchain.md

@@ -1,14 +1,15 @@
 # Contract toolchain
 
-T3 installs exact versions without changing any pre-existing locked package
-version: Redocly CLI 2.75.0, openapi-typescript 7.13.0, Ajv 8.20.0,
+The contract tooling pins exact versions: Redocly CLI 2.76.0,
+openapi-typescript 7.13.0, Ajv 8.20.0,
 ajv-formats 3.0.1, esbuild 0.28.2, root TypeScript 5.9.3 and Node types
-24.19.2. The docs-only web dependency is swagger-ui-dist 5.34.1.
-The application retains TypeScript 6.0.3 and its existing dependencies.
+26.6.6. The docs-only web dependency is swagger-ui-dist 5.34.1.
+The application checks types with TypeScript 7.0.2 through `@typescript/native`;
+its `typescript` alias provides the TypeScript 6 compatibility API for ESLint.
 
 Root TypeScript is 5.9.3 because openapi-typescript 7.13.0 declares a `^5.x`
 peer dependency. No force/legacy-peer-deps override is used. Generated declarations
-are independently compiled with **both** root TS 5.9.3 and application TS 6.0.3,
+are independently compiled with **both** root TS 5.9.3 and application TS 7.0.2,
 with strict mode and library checking enabled. The root compiler also checks all
 contract TS/config files via `tests/contracts/tsconfig.json`; existing integration
 and load test typing remains the separate T18 task.

package.json

@@ -3,7 +3,7 @@
   "version": "1.0.0",
   "description": "LightNVR Integration Tests",
   "engines": {
-    "node": ">=24.11.0 <25"
+    "node": ">=26.13.0 <27"
   },
   "scripts": {
     "test": "npx playwright test",
@@ -25,7 +25,7 @@
   "devDependencies": {
     "@playwright/test": "^1.62.1",
     "@redocly/cli": "2.76.0",
-    "@types/node": "24.19.2",
+    "@types/node": "26.6.6",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
     "esbuild": "0.28.2",

scripts/README.md

@@ -132,7 +132,7 @@ sudo systemctl start lightnvr
 
 **Building C backend:** GCC/Clang, CMake, libsqlite3-dev, libuv1-dev
 
-**Building web frontend:** Node.js (v24.11+ and <25), npm
+**Building web frontend:** Node.js (v26.13+ and <27), npm
 
 **Screenshot capture:** Node.js, Playwright, Chromium
 

tests/contracts/mqtt-sink.ts

@@ -9,7 +9,7 @@ export async function startMqttSink(port = 0) {
   sockets.add(socket);socket.on('close',()=>sockets.delete(socket));socket.on('error',()=>{});
   let buffered=Buffer.alloc(0);
   socket.on('data',chunk=>{
-   buffered=Buffer.concat([buffered,chunk]);
+   buffered=Buffer.concat([buffered,typeof chunk==='string'?Buffer.from(chunk):chunk]);
    while(buffered.length>=2){
     let remaining=0,multiplier=1,end=1;
     for(;end<buffered.length&&end<=4;end++){

tests/contracts/tooling/generator.test.mjs

@@ -101,7 +101,7 @@ test('generated declarations accept unknown and narrow correctly under strict TS
   await writeFile(path.join(directory,'consumer.ts'),positive);
   const config={compilerOptions:{strict:true,noEmit:true,skipLibCheck:false,target:'ES2022',module:'ESNext',moduleResolution:'Bundler',types:[],rootDir:'.'},files:['consumer.ts']};
   await writeFile(path.join(directory,'tsconfig.json'),JSON.stringify(config));
-  for(const compiler of ['node_modules/typescript/bin/tsc','web/node_modules/typescript/bin/tsc']) {
+  for(const compiler of ['node_modules/typescript/bin/tsc','web/node_modules/@typescript/native/bin/tsc']) {
     const run=()=>spawnSync(process.execPath,[path.join(root,compiler),'-p',path.join(directory,'tsconfig.json')],{encoding:'utf8'});
     const good=run();assert.equal(good.status,0,good.stdout);
     await writeFile(path.join(directory,'consumer.ts'),positive+"const wrong: components['schemas']['Fixture'] = {identity:{id:'synthetic'},count:'zero',variant:1}; void wrong;\n");

tests/performance/active-recording.md

@@ -1,6 +1,6 @@
 # Bounded active recording measurement
 
-From the repository root, with a Release native build, Node 24, Linux `/proc`,
+From the repository root, with a Release native build, Node 26, Linux `/proc`,
 and FFmpeg/ffprobe with libx264:
 
 ```sh

tests/performance/browser-startup.md

@@ -7,7 +7,7 @@ fixture binary, then run from the repository root:
 node tests/performance/browser-startup.ts --binary build/mobile-review/bin/lightnvr --output build/browser-startup --samples 3
 ```
 
-The output directory must be new. Requires Node 24, Playwright Chromium,
+The output directory must be new. Requires Node 26, Playwright Chromium,
 FFmpeg/ffprobe with libx264 and the native fixture dependencies. All media,
 credentials and configuration belong to the isolated loopback fixture.
 

tests/performance/observations/README.md

@@ -113,7 +113,7 @@ node tests/performance/observations/compare.mjs repeat \
   build/perf-observations/disabled-run1/results.json build/perf-observations/disabled-run2/results.json
 ```
 
-The harness needs Node 24, ffmpeg/ffprobe with libx264, go2rtc on `PATH` (or
+The harness needs Node 26, ffmpeg/ffprobe with libx264, go2rtc on `PATH` (or
 `--go2rtc`), `findmnt`/`lsblk`, and Linux `/proc`. Use `--keep` to keep the
 fixture directory (server log, DB, media).
 

tests/reliability/README.md

@@ -250,7 +250,7 @@ preparation. It does not claim to have recompiled those executables.
 
 The manual workflow `.github/workflows/reliability-qualification.yml` runs only
 through **workflow_dispatch**. It adds no push/PR or branch-protection check.
-It installs coherent Debian sid dependencies, Node 24 and Go matching `go.mod`,
+It installs coherent Debian sid dependencies, Node 26 and Go matching `go.mod`,
 then builds and runs as an unprivileged user. Its private `TMPDIR` isolates
 storage-fault results. Current Go patch tests and the native reconciliation test
 run before interrupted-recording, storage-fault, reconnect/lifecycle and genuine

tools/rust-transpile/Dockerfile

@@ -14,7 +14,7 @@ ARG CLANG_MAJOR=21
 ARG C2RUST_REVISION=10c776738db3f6b202dd1cade85fcdd3c1ada6f8
 ARG RUST_TOOLCHAIN=nightly-2026-03-03
 ARG C2RUST_BUILD_TOOLCHAIN=1.95.0
-ARG NODE_VERSION=24.22.1
+ARG NODE_VERSION=26.13.0
 
 ENV DEBIAN_FRONTEND=noninteractive LC_ALL=C.UTF-8 \
     RUSTUP_HOME=/opt/rustup CARGO_HOME=/opt/cargo \

web/VITE.md

@@ -69,6 +69,15 @@ Vite compiles `.ts` and `.tsx` with Oxc using the same Preact JSX settings as
 `.jsx`, and only strips types. `npm run typecheck` is what checks them, and CI
 runs it in `static-analysis.yml`.
 
+Typechecking uses TypeScript 7.0.2 through the `@typescript/native` npm alias,
+which supplies `tsc`. The `typescript` alias supplies the TypeScript 6 compatibility
+API (and `tsc6`) required by `typescript-eslint`. This follows Microsoft's
+[side-by-side setup](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/#running-side-by-side-with-typescript-6.0).
+Keep both aliases until the linter supports the native compiler API. The root
+package retains TypeScript 5.9 for the OpenAPI generator's compiler API and peer
+dependency; contract tests check generated types with both the root compiler and
+the frontend's TypeScript 7 compiler. Node typings use 26 to match `.nvmrc`.
+
 - `tsconfig.base.json` holds the shared strict options. Do not relax them.
 - `tsconfig.json` covers `js/**`; Vite's client types come from `js/env.d.ts`.
 - `tsconfig.tests.json` covers TS tests under `tests/` with Jest and Node types.