chore: upgrade to Node 24 and move pnpm overrides to pnpm-workspace.yaml

.github/workflows/ci.yml

@@ -34,7 +34,7 @@ jobs:
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .nvmrc # single source of truth (Node 22.22+ — Kùzu native is unstable on Node 20 Linux)
+          node-version-file: .nvmrc # single source of truth (Node 24+ — Kùzu native is unstable on Node 20 Linux)
           cache: pnpm
 
       # The integration + E2E suites build throwaway git repos and commit into them; a runner has

.github/workflows/release.yml

@@ -42,7 +42,7 @@ jobs:
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .nvmrc # single source of truth w/ ci.yml — Node 22.22+ (Kùzu native SIGSEGVs on Node 20 Linux; the `pnpm test` gate below opens Kùzu)
+          node-version-file: .nvmrc # single source of truth w/ ci.yml — Node 24+ (Kùzu native SIGSEGVs on Node 20 Linux; the `pnpm test` gate below opens Kùzu)
           registry-url: https://registry.npmjs.org
           cache: pnpm
       # Pinned (not @latest): this runs in the privileged publish job (id-token: write), so the one

.nvmrc

@@ -1 +1 @@
-22.22.0
+24

package.json

@@ -39,7 +39,7 @@
   },
   "packageManager": "pnpm@10.32.0",
   "engines": {
-    "node": ">=22.22.0"
+    "node": ">=24"
   },
   "scripts": {
     "typecheck": "tsc -p tsconfig.json",
@@ -73,26 +73,9 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^22.10.0",
+    "@types/node": "^24.13.3",
     "tsup": "^8.5.1",
     "tsx": "^4.19.2",
     "vitest": "^4.1.0"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild",
-      "kuzu"
-    ],
-    "overrides": {
-      "tar@<7.5.21": "^7.5.21",
-      "esbuild@<0.28.1": "^0.28.1",
-      "form-data@>=4.0.0 <4.0.6": "^4.0.6",
-      "hono@<4.12.27": "^4.12.27",
-      "@hono/node-server@<2.0.5": "^2.0.5",
-      "axios@<1.18.0": "^1.18.0",
-      "body-parser@>=2.0.0 <2.3.0": "^2.3.0",
-      "postcss@<8.5.18": "^8.5.18",
-      "fast-uri@<3.1.4": "^3.1.4"
-    }
   }
 }

pnpm-workspace.yaml

@@ -1,6 +1,21 @@
 packages:
   - 'packages/*'
 
+onlyBuiltDependencies:
+  - esbuild
+  - kuzu
+
+overrides:
+  'tar@<7.5.21': '^7.5.21'
+  'esbuild@<0.28.1': '^0.28.1'
+  'form-data@>=4.0.0 <4.0.6': '^4.0.6'
+  'hono@<4.12.27': '^4.12.27'
+  '@hono/node-server@<2.0.5': '^2.0.5'
+  'axios@<1.18.0': '^1.18.0'
+  'body-parser@>=2.0.0 <2.3.0': '^2.3.0'
+  'postcss@<8.5.18': '^8.5.18'
+  'fast-uri@<3.1.4': '^3.1.4'
+
 # Supply-chain cooldown (ADR-35 / SECURITY.md): refuse any dependency version published less
 # than this many MINUTES ago, resolving to the last version old enough instead. The 2026 npm
 # worms (Shai-Hulud / IronWorm / Miasma) land malicious versions in builds within minutes of
@@ -14,8 +29,8 @@ minimumReleaseAge: 4320
 # Narrow, deliberate exception (ADR-35): take the esbuild 0.28.1 SECURITY patch
 # (GHSA-gv7w-rqvm-qjhr) before the cooldown elapses. esbuild is a devDep (build/test tooling, not
 # shipped), already in `onlyBuiltDependencies`, single-author + enormously-vetted — about the
-# lowest-risk package to grant a cooldown exception. Paired with the `esbuild@<0.28.1` override in
-# package.json. Remove once the floor naturally clears the patched range.
+# lowest-risk package to grant a cooldown exception. Paired with the `esbuild@<0.28.1` override
+# above. Remove once the floor naturally clears the patched range.
 minimumReleaseAgeExclude:
   - esbuild
   - '@esbuild/*'

tsup.config.ts

@@ -12,7 +12,7 @@ export default defineConfig({
   },
   format: ['esm'],
   platform: 'node',
-  target: 'node22',
+  target: 'node24',
   bundle: true,
   // Bundle only our own workspace source; every third-party dep (esp. the native Kùzu
   // CJS addon, which cannot be ESM-bundled) stays external and resolves from node_modules.