Skip to content

ci: publish on Node 24 with a pinned npm - #111

Merged
JohnMcLear merged 1 commit into
mainfrom
ci/fix-publish-node
Sep 21, 2026
Merged

JohnMcLear merged 1 commit into
mainfrom
ci/fix-publish-node

Conversation

@JohnMcLear

Copy link
Copy Markdown
Member

The bug

.github/workflows/npmpublish.yml ran the publish job on Node 25 and then
upgraded npm with npm install -g npm@latest. npm 12 requires
^22.22.2 || ^24.15.0 || >=26.0.0 — Node 25 is not in that range — so as soon
as npm 12 shipped, that step started dying:

npm error code EBADENGINE
npm error Not compatible with your version of node/npm: npm@12.0.2
npm error Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error Actual:   {"node":"v25.9.0","npm":"11.12.1"}

Every plugin's publish has been failing since.

The fix

  • node-version: 25 → node-version: 24 — an LTS line that every npm 11.x
    and 12.x supports.
  • npm@latest → npm@^11.5.1 — 11.5.1 is the floor OIDC trusted publishing
    needs. Pinning to a range rather than @latest means the next npm major
    dropping this Node line cannot silently break publishing fleet-wide again.
  • Replaced the stale comment that still described Node 20.x.

No other change. Mirrors the merged pilot, ether/ep_align#227.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

The publish workflow ran on Node 25 and then did
`npm install -g npm@latest`. npm 12 requires
`^22.22.2 || ^24.15.0 || >=26.0.0`, which excludes Node 25, so that
step died with EBADENGINE as soon as npm 12 shipped and the package
could no longer publish:

    npm error code EBADENGINE
    npm error Not compatible with your version of node/npm: npm@12.0.2
    npm error Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
    npm error Actual:   {"node":"v25.9.0","npm":"11.12.1"}

Move to Node 24 — an LTS line every npm 11.x and 12.x supports — and
pin the upgrade to `npm@^11.5.1` (the floor OIDC trusted publishing
needs) rather than `@latest`, so the next npm major dropping this Node
line cannot silently break publishing fleet-wide again.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw
@qodo-code-review

Copy link
Copy Markdown

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

@qodo-free-for-open-source-projects

Copy link
Copy Markdown

PR Summary by Qodo

Restore npm publishing with Node 24 and pinned npm 11

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

Grey Divider

AI Description

• Run npm publishing on Node 24 to restore CLI engine compatibility.
• Pin npm to compatible 11.x releases while retaining OIDC trusted publishing support.
High-Level Assessment

The chosen approach is appropriate: pairing an LTS Node release with a constrained npm 11 range restores publishing while preventing future npm majors from silently introducing incompatible engine requirements. Continuing with npm@latest or using non-LTS Node releases would reintroduce avoidable compatibility risk.

Files changed (1) +9 / -5

Bug fix (1) +9 / -5
npmpublish.ymlUse Node 24 and constrain npm for trusted publishing +9/-5

Use Node 24 and constrain npm for trusted publishing

• Changes the publishing runner from Node 25 to Node 24 and replaces npm@latest with npm@^11.5.1. Updated comments document the engine incompatibility and rationale for constraining npm majors.

.github/workflows/npmpublish.yml

@qodo-free-for-open-source-projects

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Grey Divider

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Grey Divider

Tip of the day
💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Qodo Logo

@JohnMcLear
JohnMcLear merged commit 99fbc88 into main Sep 21, 2026
4 checks passed
@JohnMcLear
JohnMcLear deleted the ci/fix-publish-node branch September 21, 2026 09:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant