Tighten `engines` and `devEngines` #682

bedrich-schindler · 2025-12-17T18:14:42Z

Tighten engines and devEngines

engines requires node version >=22.11.0 instead of >=22,
while 22.11.0 is first long term support minor version of this major version.

devEngines requires node version ^22.11.0 || ^24.11.0 instead
of 22.x || 24.x, while 22.11.0 and 24.11.0 are first long term support
minor versions of those major versions. devEngines now requires npm version
^11.6.1 as it is first npm version delivered by node in version 24.11.0.
We require single major version of npm to generate package-lock.json
of compatible structure. This would not be possible without requiring
specific version of npm.

.github/workflows/build.yml requires changes to install latest npm
for previous node LTS.

`engines` requires `node` version `>=22.11.0` instead of `>=22`, while `22.11.0` is first long term support minor version of this major version. `devEngines` requires `node` version `^22.11.0 || ^24.11.0` instead of `22.x || 24.x`, while `22.11.0` and `24.11.0` are first long term support minor versions of those major versions. `devEngines` now requires `npm` version `^11.6.1` as it is first `npm` version delivered by `node` in version `24.11.0`. We require single major version of `npm` to generate `package-lock.json` of compatible structure. This would not be possible without requiring specific version of `npm`.

Copilot

Pull request overview

This PR tightens the Node.js and npm version requirements to align with Long Term Support (LTS) versions. The engines field now requires Node.js >=22.11.0 (the first LTS minor of v22), while devEngines restricts development to specific LTS versions (^22.11.0 || ^24.11.0) and introduces npm version constraint ^11.6.1 to ensure consistent package-lock.json structure.

Key Changes:

Updated engines.node from >=22 to >=22.11.0 to require the first LTS minor version
Changed devEngines.runtime.version from 22.x || 24.x to ^22.11.0 || ^24.11.0 for stricter LTS-only development
Added devEngines.packageManager.version requirement of ^11.6.1 for npm

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updated engine requirements to specific LTS versions and added npm version constraint
package-lock.json	Synchronized engine requirements with package.json and added devEngines configuration

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-17T18:16:21Z

package.json

+    "node": ">=22.11.0"
  },
  "devEngines": {
    "runtime": {
      "name": "node",
-      "version": "22.x || 24.x",
+      "version": "^22.11.0 || ^24.11.0",


There's an inconsistency between engines.node and devEngines.runtime.version. The engines field allows Node.js >=22.11.0 (including 23.x, 25.x, etc.), while devEngines restricts to only ^22.11.0 || ^24.11.0 (which excludes 23.x, 25.x). This means engines would pass but devEngines would fail with an error for versions like 23.x or 25.x.

Consider either:

Aligning devEngines to match engines by using >=22.11.0 <25.0.0 (if 24.x is the max supported), or

Tightening engines to match the actual supported versions if only 22.x and 24.x LTS lines are intended to be supported.

We want to have strictly tight dev environment, but we do not want to tight end-users.

bedrich-schindler · 2025-12-17T21:47:52Z

.github/workflows/build.yml

+  NPM_VERSION: 11
+
 jobs:
+  prepare_env:


prepare_env is need as matrix does not allow to access env as steps does.

bedrich-schindler · 2025-12-17T21:50:04Z

.github/workflows/build.yml

+          node-version: ${{ matrix.node }}
+          cache: npm
+        if: matrix.node == env.NODE_PREVIOUS_LTS_VERSION
+        continue-on-error: true


continue-on-error: true is needed as Node 22 is shipped with npm@10 and devEngines requires 11. This allow us to continue to Install npm@11 for Node.js step where up-to-date version is installed.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

.github/workflows/build.yml

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-17T22:09:29Z

.github/workflows/build.yml

+  prepare_env:
+    name: Prepare environment
+    runs-on: ubuntu-24.04
+    outputs:
+      NODE_ACTIVE_LTS_VERSION: ${{ env.NODE_ACTIVE_LTS_VERSION }}
+      NODE_PREVIOUS_LTS_VERSION: ${{ env.NODE_PREVIOUS_LTS_VERSION }}
+      NPM_VERSION: ${{ env.NPM_VERSION }}
+    steps:
+      - name: Compute outputs
+        run: |
+          echo "NODE_ACTIVE_LTS_VERSION=${{ env.NODE_ACTIVE_LTS_VERSION }}" >> $GITHUB_OUTPUT
+          echo "NODE_PREVIOUS_LTS_VERSION=${{ env.NODE_PREVIOUS_LTS_VERSION }}" >> $GITHUB_OUTPUT
+          echo "NPM_VERSION=${{ env.NPM_VERSION }}" >> $GITHUB_OUTPUT


The prepare_env job appears to only pass through environment variables as outputs without any transformation. Consider using the workflow-level env variables directly in the matrix strategy to simplify the workflow, or add a comment explaining why this indirection is needed.

Copilot · 2025-12-17T22:09:30Z

.github/workflows/build.yml

      - name: Set up Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node }}
          cache: npm
+        if: matrix.node == env.NODE_ACTIVE_LTS_VERSION
+
+      # Perform this step for Node.js previous LTS version
+      # Continue on error to avoid failing the whole job if npm version is incompatible
+      - name: Set up Node.js ${{ matrix.node }}


The two steps on lines 38 and 47 have identical names but different behaviors. Consider giving them distinct names to make it clear which one is running in the GitHub Actions UI, such as "Set up Node.js ${{ matrix.node }} (Active LTS)" and "Set up Node.js ${{ matrix.node }} (Previous LTS)".

Copilot · 2025-12-17T22:09:30Z

.github/workflows/build.yml

+env:
+  NODE_ACTIVE_LTS_VERSION: 24
+  NODE_PREVIOUS_LTS_VERSION: 22
+  NPM_VERSION: 11


NPM_VERSION is set to 11, but package.json requires ^11.6.1. While npm install -g npm@11 will install the latest 11.x version (which should satisfy ^11.6.1), for clarity and to ensure the minimum version requirement is met, consider setting this to "^11.6" or "^11.6.1" to match the package.json specification.

Suggested change

NPM_VERSION: 11

NPM_VERSION: ^11.6.1

Copilot · 2025-12-17T22:09:30Z

.github/workflows/build.yml

+  NODE_ACTIVE_LTS_VERSION: 24
+  NODE_PREVIOUS_LTS_VERSION: 22


NODE_ACTIVE_LTS_VERSION and NODE_PREVIOUS_LTS_VERSION are set to major versions only (24 and 22), but package.json devEngines requires specific minor versions (^22.11.0 || ^24.11.0). When these values are passed to setup-node, they may install versions like 22.9.0 or 24.0.0 if those are the latest available on the runner. Consider setting these to 22.11 and 24.11 to match the devEngines requirements.

Suggested change

NODE_ACTIVE_LTS_VERSION: 24

NODE_PREVIOUS_LTS_VERSION: 22

NODE_ACTIVE_LTS_VERSION: 24.11

NODE_PREVIOUS_LTS_VERSION: 22.11

Copilot · 2025-12-17T22:09:30Z

.github/workflows/build.yml

+      - name: Install npm@${{ env.NPM_VERSION }} for Node.js ${{ matrix.node }}
+        run: npm install -g npm@${{ env.NPM_VERSION }}
+        if: matrix.node == env.NODE_PREVIOUS_LTS_VERSION


These lines use env.NPM_VERSION and env.NODE_PREVIOUS_LTS_VERSION while the matrix values come from the prepare_env job outputs. For consistency and maintainability, consider using needs.prepare_env.outputs.NPM_VERSION and needs.prepare_env.outputs.NODE_PREVIOUS_LTS_VERSION to keep the data source consistent throughout the job.

`engines` requires `node` version `>=22.11.0` instead of `>=22`, while `22.11.0` is first long term support minor version of this major version. `devEngines` requires `node` version `^22.11.0 || ^24.11.0` instead of `22.x || 24.x`, while `22.11.0` and `24.11.0` are first long term support minor versions of those major versions. `devEngines` now requires `npm` version `^11.6.1` as it is first `npm` version delivered by `node` in version `24.11.0`. We require single major version of `npm` to generate `package-lock.json` of compatible structure. This would not be possible without requiring specific version of `npm`.

bedrich-schindler · 2025-12-18T13:29:29Z

I am closing this in favor of new PR. There is so much mess generated by GH Copilot ...

bedrich-schindler requested review from Copilot and mbohal December 17, 2025 18:14

github-actions bot assigned bedrich-schindler Dec 17, 2025

github-actions bot added the feature label Dec 17, 2025

Copilot started reviewing on behalf of bedrich-schindler December 17, 2025 18:15 View session

Copilot AI reviewed Dec 17, 2025

View reviewed changes

bedrich-schindler force-pushed the task/tighten-engines branch 12 times, most recently from cbcd652 to b1e6d73 Compare December 17, 2025 21:42

bedrich-schindler commented Dec 17, 2025

View reviewed changes

bedrich-schindler force-pushed the task/tighten-engines branch from b1e6d73 to 6c5d827 Compare December 17, 2025 21:58

bedrich-schindler requested a review from Copilot December 17, 2025 21:58

Copilot started reviewing on behalf of bedrich-schindler December 17, 2025 21:59 View session

Copilot AI reviewed Dec 17, 2025

View reviewed changes

bedrich-schindler requested a review from Copilot December 17, 2025 22:03

Copilot started reviewing on behalf of bedrich-schindler December 17, 2025 22:03 View session

Copilot AI reviewed Dec 17, 2025

View reviewed changes

bedrich-schindler force-pushed the task/tighten-engines branch 2 times, most recently from a0e9458 to 7d1ae16 Compare December 18, 2025 13:11

bedrich-schindler force-pushed the task/tighten-engines branch from 7d1ae16 to 4199b8a Compare December 18, 2025 13:14

bedrich-schindler closed this Dec 18, 2025

Tighten engines and devEngines #682

Tighten engines and devEngines #682

Uh oh!

Conversation

bedrich-schindler commented Dec 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

bedrich-schindler Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

bedrich-schindler Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

bedrich-schindler Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

bedrich-schindler commented Dec 18, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Tighten `engines` and `devEngines` #682

Tighten `engines` and `devEngines` #682

bedrich-schindler commented Dec 17, 2025 •

edited

Loading