QM requires Node.js >=24.15.0 and npm >=11.10.0 in the root workspace; the CLI package relaxes Node.js to >=24.0.0 but is otherwise an unpublished ES module monorepo.
QM requires Node.js >=24.15.0 and npm >=11.10.0, as declared in the root package.json engines field.[1] The @yc-software/qm CLI package sets a slightly looser engine floor of Node.js >=24.0.0 in cli/package.json.[2] The root package.json declares the project as an ES module ("type": "module") and marks it private: true, meaning the root package is not published directly to npm.[1]
The web UI plugin's DOMPurify dependency in plugins/web-ui/package.json is pinned at version 3.4.13 to address CVE GHSA-55q2-fjhq-7xh7, a cross-site scripting (XSS) vulnerability.
Sources