diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5a559c4..0cedbf6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -34,7 +34,7 @@ jobs: - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: - node-version-file: .nvmrc # single source of truth (Node 22.22+ — Kùzu native is unstable on Node 20 Linux) + node-version-file: .nvmrc # single source of truth (Node 24+ — Kùzu native is unstable on Node 20 Linux) cache: pnpm # The integration + E2E suites build throwaway git repos and commit into them; a runner has diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9f92984..5b00727 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -42,7 +42,7 @@ jobs: - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: - node-version-file: .nvmrc # single source of truth w/ ci.yml — Node 22.22+ (Kùzu native SIGSEGVs on Node 20 Linux; the `pnpm test` gate below opens Kùzu) + node-version-file: .nvmrc # single source of truth w/ ci.yml — Node 24+ (Kùzu native SIGSEGVs on Node 20 Linux; the `pnpm test` gate below opens Kùzu) registry-url: https://registry.npmjs.org cache: pnpm # Pinned (not @latest): this runs in the privileged publish job (id-token: write), so the one diff --git a/.nvmrc b/.nvmrc index 85e5027..a45fd52 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -22.22.0 +24 diff --git a/package.json b/package.json index 1c47a9e..335cb0e 100644 --- a/package.json +++ b/package.json @@ -39,7 +39,7 @@ }, "packageManager": "pnpm@10.32.0", "engines": { - "node": ">=22.22.0" + "node": ">=24" }, "scripts": { "typecheck": "tsc -p tsconfig.json", @@ -73,26 +73,9 @@ "zod": "^4.4.3" }, "devDependencies": { - "@types/node": "^22.10.0", + "@types/node": "^24.13.3", "tsup": "^8.5.1", "tsx": "^4.19.2", "vitest": "^4.1.0" - }, - "pnpm": { - "onlyBuiltDependencies": [ - "esbuild", - "kuzu" - ], - "overrides": { - "tar@<7.5.21": "^7.5.21", - "esbuild@<0.28.1": "^0.28.1", - "form-data@>=4.0.0 <4.0.6": "^4.0.6", - "hono@<4.12.27": "^4.12.27", - "@hono/node-server@<2.0.5": "^2.0.5", - "axios@<1.18.0": "^1.18.0", - "body-parser@>=2.0.0 <2.3.0": "^2.3.0", - "postcss@<8.5.18": "^8.5.18", - "fast-uri@<3.1.4": "^3.1.4" - } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4797ce4..02dd78f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -42,8 +42,8 @@ importers: version: 4.4.3 devDependencies: '@types/node': - specifier: ^22.10.0 - version: 22.19.20 + specifier: ^24.13.3 + version: 24.13.3 tsup: specifier: ^8.5.1 version: 8.5.1(postcss@8.5.25)(tsx@4.22.4)(typescript@6.0.3) @@ -52,7 +52,7 @@ importers: version: 4.22.4 vitest: specifier: ^4.1.0 - version: 4.1.9(@types/node@22.19.20)(vite@7.3.5(@types/node@22.19.20)(tsx@4.22.4)) + version: 4.1.9(@types/node@24.13.3)(vite@7.3.5(@types/node@24.13.3)(tsx@4.22.4)) packages/cli: dependencies: @@ -685,8 +685,8 @@ packages: '@types/estree@1.0.9': resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==} - '@types/node@22.19.20': - resolution: {integrity: sha512-6tELRwSDYWW9EdZhbeZmYGZ1/7Djkt+Ah3/ScEYT9cDord7UJzasR/4D3VONg9tQI5CDp+/CZC1AXj2pCFOvpw==} + '@types/node@24.13.3': + resolution: {integrity: sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==} '@vitest/expect@4.1.9': resolution: {integrity: sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA==} @@ -1533,8 +1533,8 @@ packages: ufo@1.6.4: resolution: {integrity: sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA==} - undici-types@6.21.0: - resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==} + undici-types@7.18.2: + resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==} universalify@2.0.1: resolution: {integrity: sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==} @@ -1967,9 +1967,9 @@ snapshots: '@types/estree@1.0.9': {} - '@types/node@22.19.20': + '@types/node@24.13.3': dependencies: - undici-types: 6.21.0 + undici-types: 7.18.2 '@vitest/expect@4.1.9': dependencies: @@ -1980,13 +1980,13 @@ snapshots: chai: 6.2.2 tinyrainbow: 3.1.0 - '@vitest/mocker@4.1.9(vite@7.3.5(@types/node@22.19.20)(tsx@4.22.4))': + '@vitest/mocker@4.1.9(vite@7.3.5(@types/node@24.13.3)(tsx@4.22.4))': dependencies: '@vitest/spy': 4.1.9 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: - vite: 7.3.5(@types/node@22.19.20)(tsx@4.22.4) + vite: 7.3.5(@types/node@24.13.3)(tsx@4.22.4) '@vitest/pretty-format@4.1.9': dependencies: @@ -2884,7 +2884,7 @@ snapshots: ufo@1.6.4: {} - undici-types@6.21.0: {} + undici-types@7.18.2: {} universalify@2.0.1: {} @@ -2896,7 +2896,7 @@ snapshots: vary@1.1.2: {} - vite@7.3.5(@types/node@22.19.20)(tsx@4.22.4): + vite@7.3.5(@types/node@24.13.3)(tsx@4.22.4): dependencies: esbuild: 0.28.1 fdir: 6.5.0(picomatch@4.0.4) @@ -2905,14 +2905,14 @@ snapshots: rollup: 4.62.0 tinyglobby: 0.2.17 optionalDependencies: - '@types/node': 22.19.20 + '@types/node': 24.13.3 fsevents: 2.3.3 tsx: 4.22.4 - vitest@4.1.9(@types/node@22.19.20)(vite@7.3.5(@types/node@22.19.20)(tsx@4.22.4)): + vitest@4.1.9(@types/node@24.13.3)(vite@7.3.5(@types/node@24.13.3)(tsx@4.22.4)): dependencies: '@vitest/expect': 4.1.9 - '@vitest/mocker': 4.1.9(vite@7.3.5(@types/node@22.19.20)(tsx@4.22.4)) + '@vitest/mocker': 4.1.9(vite@7.3.5(@types/node@24.13.3)(tsx@4.22.4)) '@vitest/pretty-format': 4.1.9 '@vitest/runner': 4.1.9 '@vitest/snapshot': 4.1.9 @@ -2929,10 +2929,10 @@ snapshots: tinyexec: 1.2.4 tinyglobby: 0.2.17 tinyrainbow: 3.1.0 - vite: 7.3.5(@types/node@22.19.20)(tsx@4.22.4) + vite: 7.3.5(@types/node@24.13.3)(tsx@4.22.4) why-is-node-running: 2.3.0 optionalDependencies: - '@types/node': 22.19.20 + '@types/node': 24.13.3 transitivePeerDependencies: - msw diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index aa43005..426b46a 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,6 +1,21 @@ packages: - 'packages/*' +onlyBuiltDependencies: + - esbuild + - kuzu + +overrides: + 'tar@<7.5.21': '^7.5.21' + 'esbuild@<0.28.1': '^0.28.1' + 'form-data@>=4.0.0 <4.0.6': '^4.0.6' + 'hono@<4.12.27': '^4.12.27' + '@hono/node-server@<2.0.5': '^2.0.5' + 'axios@<1.18.0': '^1.18.0' + 'body-parser@>=2.0.0 <2.3.0': '^2.3.0' + 'postcss@<8.5.18': '^8.5.18' + 'fast-uri@<3.1.4': '^3.1.4' + # Supply-chain cooldown (ADR-35 / SECURITY.md): refuse any dependency version published less # than this many MINUTES ago, resolving to the last version old enough instead. The 2026 npm # worms (Shai-Hulud / IronWorm / Miasma) land malicious versions in builds within minutes of @@ -14,8 +29,8 @@ minimumReleaseAge: 4320 # Narrow, deliberate exception (ADR-35): take the esbuild 0.28.1 SECURITY patch # (GHSA-gv7w-rqvm-qjhr) before the cooldown elapses. esbuild is a devDep (build/test tooling, not # shipped), already in `onlyBuiltDependencies`, single-author + enormously-vetted — about the -# lowest-risk package to grant a cooldown exception. Paired with the `esbuild@<0.28.1` override in -# package.json. Remove once the floor naturally clears the patched range. +# lowest-risk package to grant a cooldown exception. Paired with the `esbuild@<0.28.1` override +# above. Remove once the floor naturally clears the patched range. minimumReleaseAgeExclude: - esbuild - '@esbuild/*' diff --git a/tsup.config.ts b/tsup.config.ts index dea6f1e..2e877ae 100644 --- a/tsup.config.ts +++ b/tsup.config.ts @@ -12,7 +12,7 @@ export default defineConfig({ }, format: ['esm'], platform: 'node', - target: 'node22', + target: 'node24', bundle: true, // Bundle only our own workspace source; every third-party dep (esp. the native Kùzu // CJS addon, which cannot be ESM-bundled) stays external and resolves from node_modules.