Skip to content

Commit 3ce701a

Browse files
tensornulltensornull
committed
fix: enforce patched Node.js runtimes
1 parent 685c889 commit 3ce701a

22 files changed

Lines changed: 140 additions & 49 deletions

‎.github/workflows/ci.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
- name: Set up Node.js 24
3030
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
3131
with:
32-
node-version: 24.x
32+
node-version: 24.22.1
3333
cache: npm
3434
- name: Install locked dependencies
3535
run: npm ci
@@ -66,8 +66,8 @@ jobs:
6666
fail-fast: false
6767
matrix:
6868
node-version:
69-
- 22.x
70-
- 24.x
69+
- 22.23.4
70+
- 24.22.1
7171
steps:
7272
- name: Check out the repository
7373
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -118,7 +118,7 @@ jobs:
118118
- name: Set up Node.js 24
119119
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
120120
with:
121-
node-version: 24.x
121+
node-version: 24.22.1
122122
cache: npm
123123
- name: Install locked dependencies
124124
run: npm ci
@@ -179,7 +179,7 @@ jobs:
179179
- name: Set up Node.js 22
180180
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
181181
with:
182-
node-version: 22.x
182+
node-version: 22.23.4
183183
cache: npm
184184
- name: Install locked development dependencies
185185
run: npm ci
@@ -202,7 +202,7 @@ jobs:
202202
- name: Set up Node.js 24
203203
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
204204
with:
205-
node-version: 24.x
205+
node-version: 24.22.1
206206
cache: npm
207207
- name: Install locked development dependencies
208208
run: npm ci
@@ -222,7 +222,7 @@ jobs:
222222
- name: Set up Node.js 26
223223
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
224224
with:
225-
node-version: 26.x
225+
node-version: 26.12.1
226226
cache: npm
227227
- name: Install locked dependencies
228228
run: npm ci
@@ -249,7 +249,7 @@ jobs:
249249
- name: Set up Node.js 24
250250
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
251251
with:
252-
node-version: 24.x
252+
node-version: 24.22.1
253253
cache: npm
254254
- name: Install locked dependencies
255255
run: npm ci

‎.github/workflows/live-smoke.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131
- name: Set up Node.js 24
3232
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
3333
with:
34-
node-version: 24.x
34+
node-version: 24.22.1
3535
cache: npm
3636
- name: Install locked dependencies
3737
run: npm ci

‎.github/workflows/publish.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ jobs:
6666
- name: Set up Node.js 24
6767
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
6868
with:
69-
node-version: 24.x
69+
node-version: 24.22.1
7070
cache: npm
7171
- name: Classify the exact Release Please handoff
7272
id: result
@@ -544,7 +544,7 @@ jobs:
544544
- name: Set up Node.js 24
545545
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
546546
with:
547-
node-version: 24.x
547+
node-version: 24.22.1
548548
cache: npm
549549
- name: Install validation dependencies without lifecycle scripts
550550
run: npm ci --ignore-scripts
@@ -695,7 +695,7 @@ jobs:
695695
- name: Set up Node.js 24
696696
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
697697
with:
698-
node-version: 24.x
698+
node-version: 24.22.1
699699
cache: npm
700700
- name: Install locked dependencies
701701
run: npm ci
@@ -755,7 +755,7 @@ jobs:
755755
- name: Set up Node.js 24
756756
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
757757
with:
758-
node-version: 24.x
758+
node-version: 24.22.1
759759
package-manager-cache: false
760760
registry-url: https://registry.npmjs.org
761761
- name: Use a Trusted Publishing-capable npm CLI

‎.github/workflows/release-please.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ jobs:
6464
- name: Set up Node.js 24
6565
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
6666
with:
67-
node-version: 24.x
67+
node-version: 24.22.1
6868
cache: npm
6969
- name: Install validation dependencies without lifecycle scripts
7070
run: npm ci --ignore-scripts

‎ARCHITECTURE.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -232,10 +232,11 @@ does not establish GitHub Actions execution.
232232

233233
## Runtime policy
234234

235-
The package `engines` contract supports Node.js 22 and 24 only. Node.js 26 is an
236-
advisory compatibility target and remains outside `engines` until it enters LTS
237-
and the policy is deliberately updated. Node.js 18 and 20 are unsupported. The
238-
normal publication runtime is Node.js 24 and must satisfy npm Trusted
235+
The package `engines` contract supports patched Node.js 22.23.4+ and 24.22.1+
236+
within those major lines only. Node.js 26 is an advisory compatibility target
237+
and remains outside `engines` until it enters LTS and the policy is deliberately
238+
updated. Node.js 18 and 20 are unsupported. The normal publication runtime is
239+
Node.js 24.22.1+ and must satisfy npm Trusted
239240
Publishing's minimum Node.js and npm CLI versions recorded in
240241
[RELEASING.md](./RELEASING.md).
241242

‎COMPATIBILITY.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -95,11 +95,11 @@ deferred. No compatibility aliases are provided for legacy client names.
9595
The consumer manifest range is `openai:^6.47.0`. Release documentation may list a
9696
version as verified only after the corresponding lane passes.
9797

98-
| Lane | Version selection | Runtime | Required evidence |
99-
| ----------- | -------------------------------- | ----------------- | ---------------------------------------- |
100-
| Minimum | `6.47.0` | Node.js 22 | Runtime and ESM/CommonJS consumer types |
101-
| Development | Version from `package-lock.json` | Node.js 22 and 24 | Every blocking runtime |
102-
| Canary | Latest compatible 6.x | Node.js 24 | Scheduled and dependency-update workflow |
98+
| Lane | Version selection | Runtime | Required evidence |
99+
| ----------- | -------------------------------- | ----------------------------- | ---------------------------------------- |
100+
| Minimum | `6.47.0` | Node.js 22.23.4+ | Runtime and ESM/CommonJS consumer types |
101+
| Development | Version from `package-lock.json` | Node.js 22.23.4+ and 24.22.1+ | Every blocking runtime |
102+
| Canary | Latest compatible 6.x | Node.js 24.22.1+ | Scheduled and dependency-update workflow |
103103

104104
The compatible manifest range can resolve an upstream minor before it appears
105105
in this verified table. If the canary finds an incompatibility, maintainers

‎CONTRIBUTING.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ incidental 0.1 change. Propose future scope through an issue and roadmap update.
1717

1818
## Development setup
1919

20-
Use Node.js 22 or 24 and install exactly from the lock file:
20+
Use patched Node.js 22.23.4+ or 24.22.1+ and install exactly from the lock file:
2121

2222
```bash
2323
npm ci

‎README.md‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,14 @@ keys are outside the 0.1 scope.
2727

2828
## Requirements
2929

30-
- Node.js 22 or 24
30+
- Node.js 22.23.4 or newer within the 22.x line, or Node.js 24.22.1 or newer
31+
within the 24.x line
3132
- A CometAPI API key
3233

33-
Node.js 26 is an advisory test target until it enters LTS. Node.js 18 and 20 are
34-
not supported. The package `engines` range includes Node.js 22 and 24 only;
35-
passing the Node.js 26 advisory lane does not create a support claim.
34+
Node.js 26 is an advisory test target until it enters LTS; the advisory lane uses
35+
Node.js 26.12.1 or newer. Node.js 18 and 20 are not supported. The package
36+
`engines` range includes only the patched Node.js 22 and 24 lines; passing the
37+
Node.js 26 advisory lane does not create a support claim.
3638

3739
Create an API key at <https://www.cometapi.com/console/token>. Keep it secret:
3840
do not embed it in source code, browser bundles, logs, or committed environment

‎RELEASING.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -438,10 +438,10 @@ dist-tag. Before authorizing release:
438438
call before marking the alpha released. Enable Release Please only after
439439
the initial manual alpha is complete.
440440

441-
The normal publication runner uses Node.js 22.14.0 or later and npm CLI 11.5.1
442-
or later; Node.js 24 is preferred. npm Trusted Publishing requires the manifest
443-
`repository.url` to match the canonical GitHub repository exactly. Publication
444-
is blocked until that canonical URL is configured.
441+
The normal publication runner uses Node.js 24.22.1 or later and npm CLI 11.5.1
442+
or later; a Node.js 22 runner must use 22.23.4 or later. npm Trusted Publishing
443+
requires the manifest `repository.url` to match the canonical GitHub repository
444+
exactly. Publication is blocked until that canonical URL is configured.
445445

446446
## Conditional first-publication bootstrap
447447

‎ROADMAP.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -513,9 +513,10 @@ verification.
513513
## First npm Publication Bootstrap
514514

515515
The normal publication path is npm Trusted Publishing from a GitHub-hosted
516-
runner using Node.js 22.14.0 or later, npm CLI 11.5.1 or later, and a
517-
`repository.url` that exactly matches the GitHub repository. Node.js 24 is the
518-
preferred release runtime.
516+
runner using Node.js 24.22.1 or later, npm CLI 11.5.1 or later, and a
517+
`repository.url` that exactly matches the GitHub repository. A Node.js 22
518+
runner must use 22.23.4 or later; Node.js 24.22.1 is the preferred release
519+
runtime.
519520

520521
Maintainers must first attempt to configure the Trusted Publisher normally. If
521522
npm does not allow configuration before the first package publication, only

0 commit comments

Comments
 (0)