fix: remove fixed engines field and add npm install cooldown - #23
Draft
odanado wants to merge 3 commits into
Draft
fix: remove fixed engines field and add npm install cooldown#23odanado wants to merge 3 commits into
odanado wants to merge 3 commits into
Conversation
npm 12 requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, so `npm install -g npm@12` fails on the pinned 22.2.0. `@types/node` follows the update. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
odanado
commented
Aug 31, 2026
| echo "${tmpdir}" >> "$GITHUB_PATH" | ||
|
|
||
| - run: mkcert localhost | ||
| - run: npm install -g npm@12 |
Member
Author
There was a problem hiding this comment.
No Node.js release bundles npm 12 yet, so npm install -g npm@12 is added before npm ci in the workflows. Contributors need to run it locally as well.
| @@ -1 +1 @@ | |||
| 22.2.0 | |||
| 22.23.2 | |||
Member
Author
There was a problem hiding this comment.
npm 12 requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, so .nvmrc is bumped from 22.2.0 to 22.23.2 (the latest 22 LTS), and @types/node follows it to 22.20.1.
npm 12 blocks dependency install scripts unless they are listed in allowScripts. All four candidates work without them, so they are recorded as false (reviewed, not needed) rather than omitted (unreviewed). - esbuild: ships prebuilt binaries via 23 os/cpu optionalDependencies - fsevents / msw: load fine without their install scripts - node-pty: the native build does not run, which only affects the deprecated ngrok-v1 proxy when run from source Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Closes #7.
The
enginesfield pinned exact versions of Node.js and npm. It propagates to consumers, so installing@line/liff-cliprintedEBADENGINEwarnings on any other version. I removed it and moved the npm requirement todevEngines, which is not propagated.I also added
min-release-age=3to.npmrcas a mitigation against supply chain attacks. It makes npm ignore versions published less than 3 days ago.