From 46a40a1a3758036efa6f8b3823934c8b5e1c01c6 Mon Sep 17 00:00:00 2001 From: jbujula Date: Thu, 13 Aug 2026 17:47:35 -0700 Subject: [PATCH] fix(ci): publish workflow cannot run release-it@21 on Node 16 PR #506 upgraded release-it 17 -> 21 to clear the @octokit ReDoS advisories. release-it@21 declares: engines.node: "^22.21.0 || >=24.0.0" Publish.yml still provisions Node 16, so `npm run set-version` would fail and no package could be published. Since no released version of this package currently contains the #506 security fixes, the publish path is on the critical path and had to be unblocked. Changes: - Node 16 -> 24 in Publish.yml (satisfies the >=24.0.0 branch of the engines range; avoids the 22.21.0 minor-version floor). - Drop `npm i -g npm@8.19.4`. npm 8 does not support Node 24, and the pin is unnecessary: package-lock.json is lockfileVersion 3, which Node 24's bundled npm handles natively. Only the publish job is changed. PullRequest.yml stays on Node 16 deliberately: the test suite uses ts-node/register via gulp-mocha, and Node >=22.6 native TypeScript stripping conflicts with it (ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX). The publish job never runs tests -- `npm run dist` maps to the `recompile` task only. Verified locally on Node 24.14.1: - npm ci -> exit 0 - npm run dist -> compile OK, exit 0 - release-it --version -> v21.0.1 loads - release-it --ci --dry-run -> config honored: tagName v${version}, --force, pushRepo, npm.publish=false, github.release=false, and the after:release ADO variable hook all resolve correctly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292 --- .github/workflows/Publish.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/Publish.yml b/.github/workflows/Publish.yml index 2d8b9391..d413e43e 100644 --- a/.github/workflows/Publish.yml +++ b/.github/workflows/Publish.yml @@ -23,7 +23,9 @@ jobs: - name: Setup Node.js environment uses: actions/setup-node@v3 with: - node-version: 16 + # release-it@21 (used by `npm run set-version`) declares + # engines.node "^22.21.0 || >=24.0.0" -- Node 16 cannot run it. + node-version: 24 registry-url: "https://npm.pkg.github.com" - name: Setup git tag committer info for set-version @@ -33,7 +35,6 @@ jobs: - name: Build run: | - npm i -g npm@8.19.4 npm ci npm run set-version npm run dist