VSO updates Node.js and strengthens VCP Explorer validation
VeritasChain Standards Organization (VSO) has updated the Node.js baseline for VCP Explorer and repaired build checks. We also reviewed PHP usage in the accessible repository inventory and corrected unverified package-installation guidance. This maintenance does not change the VCP specification.
Runtime update and validation
VCP Explorer API and GUI now use Node.js 24.22.1 for development and CI. The GUI container and development image use the same patch. Node.js 18 and 20 are no longer supported. We resolved 15 API TypeScript diagnostics and 12 GUI build diagnostics, added reproducible dependency installs, and removed CI settings that ignored failures. Eight API regression tests and three cryptographic byte-handling tests passed, alongside strict type-checking and production builds. The GUI container is also built and checked over HTTP in CI.
Repository inventory and hosting scope
The accessible inventory contained 31 repositories at the time of review, rather than the earlier estimate of 28. We inspected 1,889 tracked files at recorded default-branch commits (1,694 text files and 195 binary files counted). No PHP implementation or PHP runtime configuration was detected in this source review. The main website uses GitHub Pages. Other hosting internals and any running Explorer API server were not inspected; source findings do not establish that every host is unaffected or updated.
Package-name verification
At the time of the 22 October 2026 review (JST), the public npm endpoint for @veritaschain/sdk returned 404. The checked PyPI names veritaschain and veritaschain-sdk also returned 404; PyPI does not use npm’s @scope/name syntax. The PyPI package vcp-sdk was a different project, Value Context Protocol. We removed the affected installation recommendations from the organization profile, SDK specification guide and conformance guide. A 404 does not establish name reservation, scope ownership or the absence of private packages. Always verify the publisher and the repository before installing a similarly named package.
Recording the response with VAP
We recorded observations, decisions, changes, validation results and unresolved items using an experimental local mapping based on VAP v1.2 Draft 3. Records use hash chaining, Ed25519 signatures, Merkle proofs and an RFC 3161 timestamp. The public evidence bundle below contains a selected, privacy-reviewed record; private operational evidence is not published. It is an example of applying the framework, not a registered domain profile or a VAP conformance claim. The signing key identifies this recording session, not an independently certified VSO identity.
What the record establishes
A timestamp and valid cryptographic checks help establish the integrity and existence of the recorded material. They do not prove that every observation is true, that an uninspected host is safe, or that no compromise occurred. These are retrospective session records, not proof of the original time of human awareness. Dependency audit findings outside this Node.js and build repair remain separate follow-up work; this notice is not a claim that all dependencies or deployments are free of vulnerabilities.
Public change records and evidence
- Node.js — October 2026 security releases
- VCP Explorer API — Node.js baseline (PR #2)
- VCP Explorer API — build and regression checks (PR #3)
- VCP Explorer GUI — Node.js and validation (PR #1)
- VSO profile — package guidance (PR #3)
- VCP SDK guide — package guidance (PR #2)
- VCP conformance guide — package guidance (PR #2)
Download the public VAP example and verification instructions