Skip to content

build: require Node >= 22 and build with Node 24 - #26

Merged
antobinary merged 2 commits into
v0.1.xfrom
node-24
Sep 29, 2026
Merged

antobinary merged 2 commits into
v0.1.xfrom
node-24

Conversation

@antobinary

Copy link
Copy Markdown
Member

What

Moves this plugin onto Node 24 and declares a supported-Node floor.

  • package.json gains an engines field: "node": ">=22", mirrored into
    package-lock.json so the two agree.
  • @types/node bumped to ^24.13.3 so the typings match the runtime the plugin
    is actually built with. It was declared twice, at ^20.3.1 and ^20.4.4;
    both are aligned here.
  • CI moved from Node 20 to Node 24:
    • ts-code-compilation.yml — node-version: 20.x -> 24.x
    • ts-code-validation.yml — node-version: 20.x -> 24.x
    • publish-tag.yml — node-version: '20' -> '24'
    • build-plugin-deb-package.yml — NodeSource setup_20.x -> setup_24.x
  • Debian packaging: debian/control Build-Depends raised from
    nodejs (>= 18) to nodejs (>= 22).

One new lockfile entry

undici-types appears as a new entry. It is a genuine dependency of
@types/node 24 (the 20.x line did not have it), not incidental churn. It is
the only package added anywhere in this change.

Why the Debian floor is 22 while the build pin is 24

Build-Depends is a minimum constraint, not a pin, so it is kept in step with
the engines floor — the package stays buildable on a Node 22 builder. The
version actually used to build is pinned separately, and that is 24 via the
NodeSource line in the workflow.

Testing

Against Node 24.20.0 / npm 11.19.0, running the same chain CI does:

  • npm ci — PASS
  • npx tsc — PASS
  • npm run lint — PASS
  • npm run build-bundle — PASS

Worth flagging for the future: TypeScript resolves to 5.2.2 here, the lowest of
any plugin in the set. @types/node 24 needs 5.2 or newer for Symbol.dispose
and Disposable, so this repo passes with no margin at all. A sibling repo
pinned at 5.1.3 failed tsc outright with ~55 errors inside @types/node's own
declaration files and had to have TypeScript moved forward. Nothing to do here
today — the ^5.1.6 spec already allows newer — but this is the repo most
likely to be tripped by the next typings bump.

Notes for review

Aside from undici-types, the lock diff is confined to the engines block and
the @types/node resolution. lockfileVersion is unchanged.

Add an `engines` floor of Node >= 22 to package.json and mirror it into
package-lock.json, and bump @types/node to ^24.13.3 so the typings match
the runtime the plugin is built with.

Move CI onto Node 24 (was Node 20). Raise the Debian Build-Depends floor
to nodejs (>= 22) and install Node 24 from NodeSource when building the
package.
@antobinary
antobinary requested a review from GuiLeme September 11, 2026 01:03

@imdt-claudiop imdt-claudiop left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved.

Same shape as bigbluebutton/bbb-plugin-picture-in-picture#43, which is already merged: Node 24 across the workflows, nodejs (>= 22) in debian/control, and engines.node >= 22 plus @types/node ^24.13.3 in package.json.

Checked out this branch and ran it on Node 24.9.0:

  • npm install clean, and package-lock.json shows no drift afterwards
  • npx tsc passes (same command as the ts-code-compilation check)
  • npm run lint passes (same command as the ts-code-validation check)
  • npm run build-bundle produces dist/BbbPluginSessionShare.js

I also scanned the rest of the tree for leftover references to the older Node line, and there are none.

* build: declare @types/node only in devDependencies

@types/node was listed in both dependencies and devDependencies, and the
two had drifted apart before they were aligned on ^24.13.3. It supplies
build-time typings only, so keep the devDependencies entry and drop the
duplicate.

npm already resolved it as a dev-only package, so installs are unaffected;
this just makes package.json say what npm was already doing.

* build: resolve npm audit advisories (#28)

Run npm audit fix, then take the two major upgrades it could not apply
on its own: copy-webpack-plugin 12 -> 14 and webpack-dev-server 4 -> 6.
Between them these clear the shell-quote and websocket-driver criticals
and the serialize-javascript, sockjs and uuid advisories.

Everything changed here is build tooling; none of it ships in the
bundle. webpack-dev-server 6 was verified beyond a successful build by
starting the dev server and confirming the custom devServer.app route
for /manifest.json still answers 200.
Pin watch back to ^0.13.0, the version the other repos already use. Its
1.x line pulls exec-sh and a prototype-pollution advisory in merge, and
npm's own resolution for those advisories is 0.13.0. It only backs the
lint:watch helper script.
@antobinary
antobinary merged commit 196e411 into v0.1.x Sep 29, 2026
4 checks passed
@antobinary
antobinary deleted the node-24 branch September 29, 2026 17:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants