chore(ci): Node 20 → 22 (EOL) + markdownlint-cli2 ^0.23.0 retiring js-yaml/markdown-it overrides - #986
Merged
Merged
Conversation
Node 20 reached EOL 2026-04-30 (endoflife.date verified 2026-07-11); CI ran on an unsupported runtime for 2+ months. The original '20' pin (3f55ee2, 2026-05-07) carried no recorded rationale — convention copy-pasted across 23 jobs, never a decision. Node 22 = active LTS until 2027-04-30. Untouched on purpose: f17 matrix ['20','22'] (consumer-compat coverage, not our runtime); shipped templates (consumer CI reads node-version-file .nvmrc — f11-ci-node-version.test.sh 6/6 + nvmrc-ci-drift.test.sh 7/7 green); shipped .nvmrc 20.19.0 (consumer-facing default — separate decision, surfaced to maintainer).
…verrides The two overrides from PR #980 existed only because markdownlint-cli2 0.23.0 requires node>=22 while CI ran node 20. With CI on 22 (previous commit), the clean parent bump replaces the forced pins: mdl2 0.23.0 brings js-yaml 5.2.0 (nested) + markdown-it 14.2.0 natively; @eslint/eslintrc keeps js-yaml 4.2.0. No vulnerable version reappears (all >= Dependabot fixed versions; verified over the full lock). The qs override stays — still unavoidable upstream. Lint-behavior parity verified: markdownlint-cli2 0.22.1 vs 0.23.0 error sets over all 897 tracked *.md files are IDENTICAL (160 pre-existing findings, 0 new-only, 0 old-only). Prior-art: skipped — no new capability: devDep version bump within existing tooling + removal of two overrides entries; security-maintenance follow-up to PR #980
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Invited follow-up to PR #980. Two commits: CI Node 20 → 22; markdownlint-cli2 ^0.23.0 replacing the two temporary overrides.
Why
3f55ee281(2026-05-07, first CI job) and copy-pasted across 23 jobs. Node 22 = active LTS until 2027-04-30.js-yaml/markdown-itoverrides from PR fix(deps): resolve all 16 open Dependabot alerts — triaged bumps, overrides where unavoidable #980 existed ONLY because markdownlint-cli2 0.23.0 requires node>=22 while CI was on 20. With CI on 22, the clean parent bump replaces the forced pins.What changed / what deliberately didn't
node-version: '20'in.github/workflows/(4 files)'22'; actionlint cleanpackage.json: markdownlint-cli2^0.22.1^0.23.0(brings js-yaml 5.2.0 nested + markdown-it 14.2.0 natively)overrides:js-yaml,markdown-itoverrides.qs['20','22'](audit-self.yml:1222).nvmrc(20.19.0)node-version-file: '.nvmrc', cannot drift from our pins (tests/install-sh/f11-ci-node-version.test.sh6/6,nvmrc-ci-drift.test.sh7/7 green). Bumping the consumer-facing.nvmrcdefault is a separate maintainer decision — surfaced, not smuggled in.Verification
*.md— error sets byte-identical (160 pre-existing findings, 0 new-only, 0 old-only). The bump changes nothing for pre-commit.NODE_ENV=development build:synth-bundle:checkgreen;actionlintclean locally; local node 24 ≥ mdl2's engines floor.§1.7 Self-discipline check (REQUIRED if PR touches discipline-bearing files)
§1.7 Skipped: mechanical maintenance — version-pin flips (23 CI pins, 1 devDep range, 2 override removals) with no rule/discipline semantics introduced or extended; enforcement surfaces untouched (verified: tests/install-sh/f11-ci-node-version.test.sh 6/6, nvmrc-ci-drift.test.sh 7/7, actionlint clean).