[tnikolova82]

Summary

Removes Node.js 26.13.0 from the buildpack dependency catalog ahead of the v1.9.8 release.

• 26.13.0 is affected by multiple High severity CVEs from the November 11, 2026 Node.js security release
• Removing it ensures semver constraints cannot resolve to a vulnerable runtime during staging
• Patched version 26.13.1 is already present in this same release

CVEs addressed (High severity)

CVE	26.x	Description
CVE-2026-123864	✓	TLS heap read via re-entrancy (info disclosure, CVSS 8.1)
CVE-2026-123865	✓	HTTP/2 memory/fd leak during shutdown
CVE-2026-123866	✓	HTTP/2 use-after-free in stream teardown
CVE-2026-123872	✓	TLS 1.2 renegotiation mTLS bypass
CVE-2026-123863	✓	HTTP/2 assertion failure DoS
CVE-2026-126051	✓	TLS deferred callback crash
CVE-2026-123874	✓	HTTP/2 use-after-free in respondWithFile()

Reference: https://nodejs.org/en/blog/vulnerability/november-2026-security-releases

Test plan

• Verify manifest.yml no longer contains 26.13.0 entries for any stack
• Unit tests pass
• Integration tests pass with 26.13.1 as the resolved version

[ivanovac]

lgtm