build(deps): move the toolchain to node 26 - #157
Merged
Conversation
Dependabot offered the Docker base image alone (PR #151), which would have produced an image that cannot build itself: package.json pinned engines to 22.x and .npmrc sets engine-strict, so npm ci inside a node 26 image would have refused to run. Moves the whole toolchain instead: the image, the CI runners, .nvmrc, and the engines range, which now accepts 22 and 26 so a contributor still on 22 is not locked out mid-migration. The security and compliance workflows were on node 20, two majors behind everything else and behind their own repository's floor; they move too. Verified by installing with no engine override, which is the actual claim being made here, then running 234 unit, 86 integration and 14 e2e tests, plus type-check, lint and a production build on node 26.
This was referenced Aug 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes Dependabot PR #151, which bumped the Docker base image alone. That image could not have built itself:
enginespinned22.xand.npmrcsetsengine-strict, sonpm ciinside it would have refused to run.Moves the toolchain together: base image, CI runners,
.nvmrc, and anenginesrange accepting 22 or 26 so nobody is locked out mid-migration. The security and compliance workflows were still on node 20 and move as well.Verified by installing with no engine override, then 234 unit, 86 integration, 14 e2e, tsc, lint and a production build on node 26.