Repository navigation
Move CI from Node 22 to Node 26 - #283
Merged
Merged
Conversation
netlify-cli 17 pulls in jsonwebtoken 9.0.2, then jws 3.2.2 and jwa 1.4.1. jwa 1.4.1 loads buffer-equal-constant-time at import, and that module reads SlowBuffer.prototype. Node 26 no longer exposes SlowBuffer, so the netlify-cli postinstall crashes and pnpm install fails before hardhat is installed. jwa 1.4.2 loads buffer-equal-constant-time only when crypto.timingSafeEqual is missing, which never happens on supported Node versions. It is inside the ^1.4.1 range that jws already asks for, so the override changes one package. The lockfile also picks up the registry's new deprecation text for glob 7.1.7.
Node 22 reaches end of life on 2027-04-30. Node 26 is the next LTS line, LTS from 2026-10-28 and supported until 2029-04-30. .nvmrc moves from 22 to 26. Every setup-node step already reads it with check-latest, so each run installs the newest 26.x. The solidity build, format, test and test:upgrades jobs and the dapp format, test and build jobs pass locally on 26.12.1. Refs: https://linear.app/thesis-co/issue/MEZO-5237
.nvmrc picks the Node version for both workflows, but their path filters only listed solidity/**, dapp/** and the workflow file. A PR that moved Node to a new major ran no checks at all, and the push to main after merging it wouldn't run them either. Both workflows now also trigger on .nvmrc, for pull requests and for pushes to main. A push still only builds, tests and dry-runs the deploy, because the testnet deploy needs workflow_dispatch. Refs: https://linear.app/thesis-co/issue/MEZO-5237
Coverage report for
|
St.❔ |
Category | Percentage | Covered / Total |
|---|---|---|---|
| 🟢 | Statements | 100% | 2/2 |
| 🟢 | Branches | 100% | 0/0 |
| 🟢 | Functions | 100% | 1/1 |
| 🟢 | Lines | 100% | 2/2 |
Test suite run success
2 tests passing in 1 suite.
Report generated by 🧪jest coverage report action from 217afb8
Both workflows ran only when their own directory, their workflow file or .nvmrc changed. A change to the root package.json or pnpm-lock.yaml alone, such as a dependency bump or a pnpm override, skipped every build and test that runs against those dependencies. The push and pull_request paths now also match both root files. A sibling package's dependency change reaches the shared lockfile, so it triggers both workflows too.
This reverts commit 32aceab. The next merge removes netlify-cli, the only package that pulled in jwa 1.4.1, so the override has nothing left to apply to.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on: #284
Node 22 reaches end of life on 2027-04-30. Node 26 becomes LTS on 2026-10-28 and is supported until 2029-04-30. This moves
.nvmrcfrom22to26, and everysetup-nodestep already reads it withcheck-latest: true.On Node 26,
pnpm installfailed insidenetlify-cli. #284 removesnetlify-cli, so this PR needs no dependency changes. Thejwaoverride from the first version of this PR is reverted.solidity.ymlanddapp.ymlnow also run when.nvmrc, the rootpackage.jsonorpnpm-lock.yamlchanges. Before, a change to any of those alone ran no checks.All solidity and dapp jobs pass locally on Node 26.12.1 (822 Hardhat tests).
Resolves: https://linear.app/thesis-co/issue/MEZO-5237