chore(deps)!: update dependencies and require Node 22 - #12
Merged
Conversation
BREAKING: the minimum supported Node.js is now 22. Node 20 reached end of life on 30 April 2026, so `engines: >=20` was promising support for an unsupported runtime. It was also promising something that did not work: `@inquirer/prompts` v8 is ESM-only, and `require()` of an ES module only landed in Node 20.19 — so interactive mode was broken on Node 20.0 through 20.18. TypeScript's old `node10` resolution could not see that; `nodenext` reports it immediately, which is how it surfaced. TypeScript 7 removes `moduleResolution: node10`, so the projects move to `nodenext`. That is the setting that correctly models Node 22+ being able to require an ES module — `node16` still rejects it and would have forced a dynamic import for no reason. `@types/node` is pinned to the supported floor (22.x) rather than the newest release, so the compiler rejects APIs that would not exist on the oldest runtime we claim to support. A dependabot ignore rule keeps it there. Also updates ioredis to 6, mongodb to 7, pg, @inquirer/prompts and @biomejs/biome, and the GitHub Actions to their current majors, and drops the Node 20 leg from the CI matrix. Each major was verified against a real database container — CLI and programmatic API, full analysis and health scoring — rather than on a green type-check alone.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the whole Dependabot backlog in one verified change, and fixes a latent bug it uncovered.
Node 20 is EOL, and interactive mode was already broken on it
enginessaid>=20. Node 20 reached end of life on 30 April 2026, so that was promising support for an unsupported runtime — and promising something that did not work.@inquirer/promptsv8 is ESM-only, andrequire()of an ES module only landed in Node 20.19, so interactive mode threwERR_REQUIRE_ESMon Node 20.0 through 20.18. CI's Node 20 leg used a recent 20.x, so it never caught it.TypeScript's old
node10resolution could not see this at all.nodenextreports it immediately, which is how it surfaced.The floor is now Node 22, and the CI matrix drops the EOL leg.
TypeScript 7
Dependabot asked for 6.0.3; current is 7.0.2, so this takes 7. It removes
moduleResolution: node10, so the projects move tonodenext— specificallynodenextand notnode16, because onlynodenextmodels Node 22+ being able torequire()an ES module.node16still rejects it and would have forced a pointless dynamic import.@types/nodeis pinned to the supported floor (22.x) rather than the newest release, so the compiler rejects APIs that would not exist at runtime on the oldest Node we claim to support. A Dependabotignorerule keeps it there with a comment explaining why, instead of this becoming a recurring PR.Everything else
ioredis5→6,mongodb6→7,pg,@inquirer/prompts,@biomejs/biome, and the GitHub Actions (checkoutv7,setup-nodev7,pnpm/action-setupv6,action-gh-releasev3) — each target verified to exist via the releases API rather than trusted from a PR body.Verification
Not just a green type-check. Every analyzer was exercised against a real container —
postgres:17-alpine,redis:7-alpine,mongo:7— through both the CLI and the programmatic API: full analysis, health scoring, and report generation. Also confirmed--jsonstdout stays clean with warnings on stderr, which is what makes piping to a file safe.pnpm lint,pnpm build,pnpm testand the--helpsmoke test all pass.Released as 1.2.0
Raising the Node floor is a support-policy change, so this is a minor rather than a patch.