Meteor 3

Apply the Node.js 24 prompt, including its JavaScript ES2026 baseline, first. These rules target Meteor 3's server methods, reactive publications, Mongo collections, Accounts, HTTP integration, DDP transports, and build boundaries, and were checked against 3.5.1. Where a rule below names 3.5.2, it describes a fix that 3.5.1 lacks, not behavior already present in 3.5.1.

Runtime and required security fixes

• Use the Node.js 24 runtime family required by Meteor 3.5. Compare meteor node -v and the bundle's .node_version.txt with the deployment runtime; test security patch upgrades and rebuild native dependencies for the target operating system and architecture. Do not assume every API in the language or runtime baseline exists in the original bundled patch.
• On Meteor 3.5 and 3.5.1, which predate the 3.5.2 cookie-endpoint fix in accounts-base@3.3.1, Accounts mounts /_accounts/cookie/set, /refresh, and /clear even when useHttpOnlyCookies is false, and /set buffers an unbounded body. On those releases, block the whole /_accounts/cookie/ prefix when the feature is unused; otherwise enforce a 4 KiB body limit before Meteor buffers input, including streamed bodies and route-prefix variants.
• On Meteor 3.3.1 through 3.5.1, which predate the 3.5.2 startup-probe fix in npm-mongo@6.16.3, the MongoDB compatibility probe disables TLS certificate validation and can print credentials from malformed MONGO_URL values, and correct application-driver TLS settings don't repair it. On those releases, validate MONGO_URL before launch, protect startup stderr, and