diff --git a/csv-table-hub-main/package-lock.json b/csv-table-hub-main/package-lock.json
index 0a87aa0..36668a3 100644
--- a/csv-table-hub-main/package-lock.json
+++ b/csv-table-hub-main/package-lock.json
@@ -6078,7 +6078,7 @@
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
       "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-diff": {
@@ -7113,6 +7113,18 @@
         }
       }
     },
+    "node_modules/nitro/node_modules/lru-cache": {
+      "version": "11.5.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
+      "integrity": "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true,
+      "peer": true,
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
     "node_modules/nitro/node_modules/unstorage": {
       "version": "2.0.0-alpha.7",
       "resolved": "https://registry.npmjs.org/unstorage/-/unstorage-2.0.0-alpha.7.tgz",
@@ -7796,7 +7808,7 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
       "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
diff --git a/docs/QUICKSTART.md b/docs/QUICKSTART.md
index 72f6ac2..91df9b4 100644
--- a/docs/QUICKSTART.md
+++ b/docs/QUICKSTART.md
@@ -14,7 +14,7 @@ For architecture and rationale see `docs/ARCHITECTURE.md`, `docs/VCRM.md`, and
 |---|---|---|
 | PostgreSQL | 17 or 18 | PG 18 recommended — installs on port 5433 by default |
 | Python | 3.10+ | Must be on PATH |
-| Node.js | 20+ | Required for the React frontend |
+| Node.js | 22.12+ | Required for the React frontend (TanStack Start needs >=22.12) |
 | Git Bash | Any | Required for bash scripts on Windows |
 | psql client | Matching server | Windows: `C:\Program Files\PostgreSQL\<ver>\bin` |
 
diff --git a/docs/offline-install.md b/docs/offline-install.md
index c08db5a..2c5b97a 100644
--- a/docs/offline-install.md
+++ b/docs/offline-install.md
@@ -25,7 +25,7 @@ The bundle is about 140 MB.
 
 ## 1. Build the bundle (connected machine)
 
-You need Ubuntu 24.04 x86_64 with `git`, `python3-pip`, Node.js 20 or later and `apt-utils`. WSL Ubuntu 24.04 on Windows works.
+You need Ubuntu 24.04 x86_64 with `git`, `python3-pip`, Node.js 22.12 or later and `apt-utils`. WSL Ubuntu 24.04 on Windows works. It must be 24.04, not a newer release, because the Ubuntu packages are downloaded from the build machine's own sources.
 
 ```bash
 cd ~/PostgreDataMigrationAppWithCSVLoader
diff --git a/scripts/offline/build_bundle.sh b/scripts/offline/build_bundle.sh
index ed15196..19edee0 100755
--- a/scripts/offline/build_bundle.sh
+++ b/scripts/offline/build_bundle.sh
@@ -2,7 +2,7 @@
 # build_bundle.sh: build the offline install bundle (#60).
 #
 # Run on an INTERNET-CONNECTED Ubuntu 24.04 x86_64 machine with git, python3-pip,
-# Node.js 20+ and apt-utils installed, from the repo root:
+# Node.js 22.12+ and apt-utils installed, from the repo root:
 #   bash scripts/offline/build_bundle.sh
 # Output: dist/offline-bundle-<commit>.tar.gz plus its .sha256 file.
 # Copy both to the offline VM and follow docs/offline-install.md.
@@ -29,7 +29,7 @@ echo "== 3/4 frontend, built for a plain Node server"
 # The placeholder is replaced by install.sh with the real API address. No API key
 # is built in: browsers sign in per user (#96).
 ( cd csv-table-hub-main
-  [ -d node_modules ] || npm ci
+  npm ci   # always clean: a reused node_modules hid a stale lock file (see #130)
   rm -rf .output
   NITRO_PRESET=node-server VITE_API_BASE=__OFFLINE_API_BASE__ npm run build >/dev/null
   cp -r .output "$OUT/frontend" )