Repository navigation
Conversation
npm compares a package's engines only with the Node that runs the install, so CI stays green on the versions it uses while the root engines.node keeps advertising versions a dependency has dropped. scripts/check-node-engines.js fails when the root range isn't a subset of each locked package's range, and node-lint runs it after npm ci. The check's first finding is main's own range: >=22.22.1 admits Node 23, which vitest excludes, and Node 23.0-23.1, which the Sentry SDK excludes. engines.node narrows to ^22.22.1 || >=24.0.0, the intersection. semver becomes a direct devDependency because the hoisted copy is 6.x, which has no subset(), and could change under any bump. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
barborico
marked this pull request as ready for review
October 28, 2026 00:59
Jeff-Rowell
previously approved these changes
Oct 28, 2026
…ines # Conflicts: # package-lock.json # package.json
eguerrant
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a CI check that fails when
package.json'sengines.nodeadmits a Node version that some package inpackage-lock.jsondoesn't support.Urgency: LOW
Expected review effort: LOW
Motivation
npm compares a package's
enginesonly with the Node that runs the install. CI therefore stays green on the versions it runs, while the rootengines.nodekeeps advertising versions a dependency has dropped. That's how #704 came to need a review comment: jsdom 30 needs^22.22.2 || ^24.15.0 || >=26.0.0, and the root still said>=22.22.1. A check catches this on the Dependabot PR that raises the floor, so nobody has to notice it in review.Description of Changes
scripts/check-node-engines.js: reads the rootengines.nodefrompackage.jsonand every locked package'sengines.nodefrompackage-lock.json. It fails, listing each package and its range, when the root range isn't a subset of a package's range (semver.subset). A rangesemvercan't parse is skipped with a warning.npm run check:engines: runs the script. Thenode-lintjob runs it afternpm ci.semverdevDependency (ISC): the hoisted copy in the tree is 6.3.1, which has nosubset(), and any other bump could change it..claude/access-dev-testing.md: documents the check and what to do when it fails.Validation of Changes
npm ci,npm run check:engines(againstmain's^22.22.2 || ^24.15.0 || >=26.0.0),npx prettier --check .andtsc --noEmitpass.>=22.22.1, the check fails and listsvitestand seven@sentry/*packages.>=22.22.1, it fails and listsjsdomand nine of its dependencies. With Bump frontend test tools: vitest 5, jsdom 30, testing-library 16 #704's fixed range,^22.22.2 || ^24.15.0 || >=26.0.0, it passes on the tip of the frontend stack (Upgrade to MUI 9 and MUI X 9 #706).Guidance for Reviewers
🤖 Generated with Claude Code