Cap nodejs at the current LTS (node 24) - #81
Merged
Merged
Conversation
Dependabot proposed widening nodejs to `>=20,<26`, which allows the non-LTS node 25 line that netlify-cli/jupyterlab don't reliably support. Instead: - set `nodejs>=20,<25` (<= node 24, the current LTS) in both container environment.yml files; - ignore nodejs >=25 in dependabot.yml so it stops re-proposing the widening. Supersedes the Dependabot PRs #58 and #65. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adjusts the Node.js version constraints used in the project’s Conda-based container environments to allow upgrades through the current intended LTS line while excluding the next non‑LTS major, and updates Dependabot configuration to stop re-proposing overly broad Node.js bumps.
Changes:
- Relaxed container
environment.ymlNode.js constraints from>=20,<21to>=20,<25(allow up to Node 24; exclude Node 25+). - Added a Dependabot ignore rule for
nodejsversions>=25under thecondaecosystem configuration. - Documented the change in
CHANGELOG.md.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
containers/quantecon/environment.yml |
Expands Node.js allowed range to <25 for the full container environment. |
containers/quantecon-build/environment.yml |
Expands Node.js allowed range to <25 for the lean build container environment. |
CHANGELOG.md |
Adds an “Unreleased” changelog entry describing the Node.js cap and Dependabot behavior. |
.github/dependabot.yml |
Adds an ignore rule to prevent Dependabot proposing Node.js updates to 25+. |
- CHANGELOG: reword the node-25 exclusion clause (was missing a "that"). - dependabot.yml: the conda-ecosystem header claimed `nodejs` "won't be updated", but Dependabot did propose nodejs bumps (#58/#65) and we now ignore node >=25 — so the comment was contradictory. Corrected it to note the conda ecosystem also proposes version-range bumps for conda deps like `nodejs` (hence the cap below). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
mmcky
added a commit
that referenced
this pull request
Jun 16, 2026
Roll up the work landed since v0.7.0 (#41–#81): conda-cache fix, sibling @v0 pins, release/checkout-SHA guards, build-lectures eval removal, container Miniconda pin + node-LTS cap, preview de-dup + script-injection fix, SHA-pinned third-party actions, Dependabot config, and the docs sweep. - CHANGELOG: cut [Unreleased] → [0.8.0]; refresh the Version History line. - README / copilot-instructions: bump the v0.7.0 mentions to v0.8.0. The floating v0 tag will be moved to this release after merge. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
mmcky
added a commit
that referenced
this pull request
Sep 18, 2026
* feat(containers): Node 24 LTS from nodejs.org, out of conda Both images carried Node 20 (lean 20.17.0, full 20.20.2), end-of-life since 2026-04-30. It cannot move to 24 through conda: every jupyterlab below 4.6 on the defaults channel -- including the 4.5.7 that anaconda=2026.06 pins -- constrains nodejs to 20.x, so `nodejs>=24` has no solution in either image, and the widening to `<25` in #81 never took effect. A conda-spec bump would have failed only after merge, since image builds do not run on pull requests. Node now comes from nodejs.org, pinned by version and SHA256 like Miniconda (24.21.0, the latest 24.x LTS; hash checked against SHASUMS256.txt), in a layer after conda so a Node bump never re-runs the solve, and on PATH ahead of the conda env so a lecture environment cannot shadow it. The build asserts the version -- until now nothing checked which Node the image had. Dropping the conda nodejs leaves the full image's solve unchanged. The lean image holds icu=73.1, the version the old nodejs pinned; without that hold the native stack re-solves (qt 5 -> 6, pillow, lxml, tbb and about 90 others). Solved for linux-64 with the image's own conda 25.11.1: no Python kernel package moves in either image. Who needed it: preview-netlify installs netlify-cli@latest (27.x, node >=22.13) into the image, and has been running it on Node 20 with EBADENGINE warnings; preview-cloudflare's wrangler refuses to start below node 22. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(preview-*): name node24 majors for setup-node and checkout Review feedback on #166. The Node note named `actions/setup-node` without a version; it now says `@v7`. Copilot suggested `@v4`, but v4 runs on Node 20, the runtime this PR moves the images off; v5 onwards run on node24. The same READMEs pointed readers at `actions/checkout@v4` -- in the changed-lecture note and in each usage example -- which is also Node 20. Both now say `@v7`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves the nodejs Dependabot PRs (#58, #65) deliberately rather than merging their over-wide bump.
Why
Dependabot proposed
nodejs>=20,<21→>=20,<26, which would allow node 25 — a non-LTS line that netlify-cli / jupyterlab don't reliably support. But the current<21pin (node 20) is also at the end of its LTS window.What
nodejs>=20,<25(≤ node 24, the current LTS) in bothcontainers/quantecon/environment.ymlandcontainers/quantecon-build/environment.yml.ignorefornodejs>=25, so it won't re-propose the<26widening every week.Net: the build can move up to node 24 LTS, the non-LTS 25 line is excluded, and Dependabot stays quiet on node.
Closes #58, closes #65 (superseded).
🤖 Generated with Claude Code