Add engines.node field to package.json - #432
Conversation
package.json had no engines field, so nothing warned or blocked a contributor running the project on an incompatible Node version. The version was already implicit elsewhere: - .github/workflows/validate-docs.yml pins node-version: 20 - Dockerfile.web / Dockerfile.worker both build from node:20-alpine - next@16.2.10 (a direct dependency) itself declares engines.node ">=20.9.0" Set engines.node to ">=20.9.0" to match all three, making the existing requirement explicit instead of introducing a new one. Also corrected README.md and CONTRIBUTING.md, which both still said "Node.js >= 18" - already inaccurate given Next 16's own floor, and now directly contradicted by the new engines field. package-lock.json was regenerated by `npm install` to resync with package.json (it was missing a few devDependencies entries, e.g. @eslint/eslintrc and @types/react-syntax-highlighter). This was already a latent problem: both Dockerfiles run `npm ci`, which fails outright on a package.json/package-lock.json mismatch. Closes Open-audit-foundation#425
|
@Osuochasam this PR is ready for review — closes #425 (add engines.node field). One heads up: the |
|
@Osuochasam friendly follow-up on this one — would appreciate a review when you get a chance. Happy to make any adjustments needed. |
|
@Osuochasam checking in again — this is still awaiting the workflow-run approval and a review. Let me know if anything needs changing. |
|
@Osuochasam bumping this once more — still sitting unreviewed with the workflow run unapproved. Whenever you have a moment. |
|
@Osuochasam bumping this too — still awaiting the workflow-run approval and a review. Happy to adjust anything. |
|
@Osuochasam same here — this one's also been waiting a while, including on the workflow-run approval needed to run CI. Would appreciate a review soon. |
|
@Osuochasam kindly check and review its long overdue already #432 |
2 participants
Closes #425
Problem
package.jsonhad noenginesfield, so nothing warns (or blocks) a contributor running the project on an incompatible Node version.What I checked
The Node version is already implicit in three places, all consistent with each other:
.github/workflows/validate-docs.yml→node-version: 20Dockerfile.web/Dockerfile.worker→ bothFROM node:20-alpinenext@16.2.10(a direct dependency) declares its ownengines.node: ">=20.9.0"in the published packageChange
"engines": { "node": ">=20.9.0" }topackage.json— matches CI/Docker and the floor Next itself already requires. Not a new requirement, just an explicit one.README.mdandCONTRIBUTING.md, which both saidNode.js >= 18. That was already inaccurate (Next 16 needs 20.9+) and would now directly contradict the newenginesfield.package-lock.jsonwas regenerated bynpm install. It was missing a fewdevDependenciesentries (@eslint/eslintrc,@types/react-syntax-highlighter, etc.) — out of sync withpackage.json. Worth flagging: both Dockerfiles runnpm ci, which fails hard on a lockfile/package.json mismatch, so this was a latent build risk independent of this issue.Verification
Ran
npm installon Node v24.18.0 (satisfies>=20.9.0): completed with noEBADENGINE/engines warning.