impr(VLTCLT-69): Run CI on Node 24 and raise the Node floor - #472
Open
francoisferrand wants to merge 6 commits into
Open
francoisferrand wants to merge 6 commits into
francoisferrand wants to merge 6 commits into
Conversation
Node 22 enters maintenance next month and is EOL in April 2027, so we need to know vaultclient is fine on 24 before consumers move. CI now runs the whole suite on both 22 and 24, since consumers straddle the two for now. The engines floor still advertised >=20, which has been EOL since April 2026. It goes to >=22 and not >=24 on purpose: cloudserver, backbeat and scuba are still on 22, and raising a library floor ahead of its consumers just breaks their installs. It drops to >=24 once they have all moved. Issue: VLTCLT-69
yarn audit was reporting 57 advisories, all dev-only and all coming from stale transitives (cross-spawn, minimatch, js-yaml, brace-expansion, flatted). None of them needed a range change, the lockfile was simply old: picking up eslint 9.39.5, sinon 21.1.2 and typescript 5.9.3 takes us down to 26. The declaration map comes along because 5.9 emits slightly different mappings. The declarations themselves are untouched, so nothing changes for consumers. Issue: VLTCLT-69
The advisories left in our own tree were all mocha holding serialize-javascript on 6.x. The fix only exists in 7.x and mocha picks it up in 12, so the range has to move. Nothing else was needed: no config or test changes, and mocha 12 asks for ^20.19 || >=22.12, which both legs of the matrix satisfy. That leaves the markdown-it/linkify-it chain under eslint-config-scality, which can only be fixed in Guidelines. Issue: VLTCLT-69
Our lockfile held @smithy/signature-v4 at 4.1.0 while the declared ^4.1.0 resolves to 4.2.4 today. A library's lockfile never reaches its dependents, so cloudserver, backbeat and scuba have been installing 4.2.4 all along while CI exercised the request signing path against a version nobody runs. No advisory here and nothing an audit would flag. What makes it worth closing is that the v4 auth tests are the thing meant to catch a regression in signing, and they were covering the wrong tree, on the one runtime dependency doing crypto. The @smithy siblings it pulls along (protocol-http, types, util-middleware) and tslib move with it, all inside their existing ranges. Issue: VLTCLT-69
…mocha eslint-config-scality#8.3.3 clears the markdown-it/linkify-it advisory chain (markdownlint 0.38.0) that reached us as a dev dependency, plus picks up the node24 engines floor and MD059 rule tweak on the vendored markdown lint config. httpagent#1.1.1 and werelogs#8.2.5 are their own node24 engines bumps (>=20 -> >=22), landing on the same schedule as this repo. mocha bumps a patch version that was already in range. Issue: VLTCLT-69
Contributor
Hello francoisferrand,My role is to assist you with the merge of this Available options
Available commands
Status report is not available. |
Contributor
benzekrimaha
approved these changes
Sep 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
vaultclient still advertised Node 20 support even though that runtime is end-of-life and no longer tested. This moves CI to a Node 22/24 matrix and raises the library floor to Node 22, keeping compatibility with consumers that have not moved to Node 24 yet.
The dependency pass also updates the Node 24-aligned httpagent and werelogs releases, moves Guidelines to 8.3.3, refreshes compatible tooling, and aligns the lockfile with what consumers install. The release version is bumped to 8.5.9.
The audit result goes from 57 dev findings (37 high, 14 moderate, 5 low, plus one namesquat false positive) to only that known false positive. Production dependencies remain at zero findings.
Verified on Node 22 and Node 24:
bin/vaultclient --versionworks with the refreshed dependency treeIssue: VLTCLT-69