From fe34480b06defb0bd8ad2caba0acf412b9f06cbd Mon Sep 17 00:00:00 2001 From: "tomoya.kita" Date: Mon, 31 Aug 2026 21:33:06 +0900 Subject: [PATCH 1/3] fix npm config and use npm v12 --- .github/workflows/code-check.yml | 1 + .github/workflows/publish.yml | 1 + .npmrc | 2 +- package-lock.json | 4 ---- package.json | 9 ++++++--- 5 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/workflows/code-check.yml b/.github/workflows/code-check.yml index 566b35e..569d94f 100644 --- a/.github/workflows/code-check.yml +++ b/.github/workflows/code-check.yml @@ -27,6 +27,7 @@ jobs: echo "${tmpdir}" >> "$GITHUB_PATH" - run: mkcert localhost + - run: npm install -g npm@12 - run: npm ci - run: npm run code-check - run: npm run test diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 07ae3a2..c3ab7c7 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -21,6 +21,7 @@ jobs: with: node-version-file: ./.nvmrc + - run: npm install -g npm@12 - run: npm ci - run: node --run build diff --git a/.npmrc b/.npmrc index 53c9775..8b4ebfd 100644 --- a/.npmrc +++ b/.npmrc @@ -1,3 +1,3 @@ -engine-strict=true save-exact=true registry=https://registry.npmjs.org/ +min-release-age=3 diff --git a/package-lock.json b/package-lock.json index 7e4035d..a7c0419 100644 --- a/package-lock.json +++ b/package-lock.json @@ -36,10 +36,6 @@ "typescript": "5.4.5", "vitest": "1.6.0" }, - "engines": { - "node": "22.2.0", - "npm": "10.7.0" - }, "peerDependencies": { "node-pty": "^1.0.0" }, diff --git a/package.json b/package.json index 4f29e6b..a429778 100644 --- a/package.json +++ b/package.json @@ -23,9 +23,12 @@ "release": "changelogen --release" }, "keywords": [], - "engines": { - "node": "22.2.0", - "npm": "10.7.0" + "devEngines": { + "packageManager": { + "name": "npm", + "version": ">=12.0.0", + "onFail": "error" + } }, "license": "Apache-2.0", "devDependencies": { From f211cc95504b2eeec724aa94aa5cd8a466934040 Mon Sep 17 00:00:00 2001 From: "tomoya.kita" Date: Mon, 31 Aug 2026 21:49:09 +0900 Subject: [PATCH 2/3] fix: bump Node.js to 22.23.2 to install npm v12 npm 12 requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, so `npm install -g npm@12` fails on the pinned 22.2.0. `@types/node` follows the update. Co-Authored-By: Claude Opus 5 --- .nvmrc | 2 +- package-lock.json | 39 +++++++++++++-------------------------- package.json | 2 +- 3 files changed, 15 insertions(+), 28 deletions(-) diff --git a/.nvmrc b/.nvmrc index 44e031b..c947119 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -22.2.0 +22.23.2 diff --git a/package-lock.json b/package-lock.json index a7c0419..8cfda67 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@line/liff-cli", - "version": "0.3.0", + "version": "0.5.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@line/liff-cli", - "version": "0.3.0", + "version": "0.5.0", "license": "Apache-2.0", "dependencies": { "@ngrok/ngrok": "1.4.1", @@ -23,7 +23,7 @@ "devDependencies": { "@types/http-proxy": "1.17.15", "@types/inquirer": "9.0.7", - "@types/node": "22.2.0", + "@types/node": "22.20.1", "@typescript-eslint/eslint-plugin": "6.7.3", "@typescript-eslint/parser": "6.7.3", "changelogen": "0.5.5", @@ -595,15 +595,6 @@ "node": ">=18" } }, - "node_modules/@inquirer/core/node_modules/@types/node": { - "version": "22.9.0", - "resolved": "https://registry.npmjs.org/@types/node/-/node-22.9.0.tgz", - "integrity": "sha512-vuyHg81vvWA1Z1ELfvLko2c8f34gyA0zaic0+Rllc5lbCnbSyuvb2Oxpm6TAUAC/2xZN3QGqxBNggD1nNR2AfQ==", - "dev": true, - "dependencies": { - "undici-types": "~6.19.8" - } - }, "node_modules/@inquirer/core/node_modules/ansi-regex": { "version": "5.0.1", "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz", @@ -625,12 +616,6 @@ "node": ">=8" } }, - "node_modules/@inquirer/core/node_modules/undici-types": { - "version": "6.19.8", - "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.19.8.tgz", - "integrity": "sha512-ve2KP6f/JnbPBFyobGHuerC9g1FYGn/F8n1LWTwNxCEzd6IfqTwUQcNXgEtmmQ6DlRrC1hrSrBnCZPokRrDHjw==", - "dev": true - }, "node_modules/@inquirer/figures": { "version": "1.0.8", "resolved": "https://registry.npmjs.org/@inquirer/figures/-/figures-1.0.8.tgz", @@ -1265,12 +1250,13 @@ } }, "node_modules/@types/node": { - "version": "22.2.0", - "resolved": "https://registry.npmjs.org/@types/node/-/node-22.2.0.tgz", - "integrity": "sha512-bm6EG6/pCpkxDf/0gDNDdtDILMOHgaQBVOJGdwsqClnxA3xL6jtMv76rLBc006RVMWbmaf0xbmom4Z/5o2nRkQ==", + "version": "22.20.1", + "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.1.tgz", + "integrity": "sha512-EANqOCF9QFyra+4pfxUcX9STKJpCLjMbObVzljIJomAWSnuSIEAvyzEU53GaajbXJEgdh0iEcPL+DGvpUd4k1Q==", "dev": true, + "license": "MIT", "dependencies": { - "undici-types": "~6.13.0" + "undici-types": "~6.21.0" } }, "node_modules/@types/semver": { @@ -5272,10 +5258,11 @@ } }, "node_modules/undici-types": { - "version": "6.13.0", - "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.13.0.tgz", - "integrity": "sha512-xtFJHudx8S2DSoujjMd1WeWvn7KKWFRESZTMeL1RptAYERu29D6jphMjjY+vn96jvN3kVPDNxU/E13VTaXj6jg==", - "dev": true + "version": "6.21.0", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz", + "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==", + "dev": true, + "license": "MIT" }, "node_modules/untildify": { "version": "4.0.0", diff --git a/package.json b/package.json index a429778..a00e21d 100644 --- a/package.json +++ b/package.json @@ -34,7 +34,7 @@ "devDependencies": { "@types/http-proxy": "1.17.15", "@types/inquirer": "9.0.7", - "@types/node": "22.2.0", + "@types/node": "22.20.1", "@typescript-eslint/eslint-plugin": "6.7.3", "@typescript-eslint/parser": "6.7.3", "changelogen": "0.5.5", From d32de4231907ce8f0a11e0e3e2a8cc498bc4926d Mon Sep 17 00:00:00 2001 From: "tomoya.kita" Date: Fri, 11 Sep 2026 13:51:37 +0900 Subject: [PATCH 3/3] chore: review dependency install scripts with allowScripts npm 12 blocks dependency install scripts unless they are listed in allowScripts. All four candidates work without them, so they are recorded as false (reviewed, not needed) rather than omitted (unreviewed). - esbuild: ships prebuilt binaries via 23 os/cpu optionalDependencies - fsevents / msw: load fine without their install scripts - node-pty: the native build does not run, which only affects the deprecated ngrok-v1 proxy when run from source Co-Authored-By: Claude Opus 5 --- package.json | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/package.json b/package.json index a00e21d..d85e9ab 100644 --- a/package.json +++ b/package.json @@ -30,6 +30,12 @@ "onFail": "error" } }, + "allowScripts": { + "esbuild": false, + "fsevents": false, + "msw": false, + "node-pty": false + }, "license": "Apache-2.0", "devDependencies": { "@types/http-proxy": "1.17.15",