chore(deps): enforce the .nvmrc Node 22 pin locally (engine-strict + engines.node upper bound)#7617
Merged
Merged
Conversation
Every engines.node in this repo was open-ended (root and 4 of 5 engines-declaring workspaces at ">=22.0.0", loopover-miner at ">=22.13.0" -- both with no upper bound), and there was no root .npmrc, so npm never warned or blocked a Node 23+ install locally. That silent gap is exactly how the Node 26 jsdom/localStorage bug (#7592/#7597, #7612) went undetected until someone happened to run tests locally on a newer Node -- twice. - Tighten engines.node to exclude Node 23+ on root + every workspace that already declares one (discovery-index, loopover-engine, loopover-ui-kit, loopover-miner, loopover-mcp), preserving each workspace's own floor (loopover-miner keeps >=22.13.0, aligned with unflagged node:sqlite support per its own test). - Add a root .npmrc with engine-strict=true so an out-of-range Node becomes a hard install/run error instead of a silently-ignored warning. CI is unaffected: .github/actions/setup-workspace already strips any repo .npmrc before installing (a guard against a malicious fork PR's .npmrc), and pins its own Node via node-version-file: .nvmrc regardless. - Add scripts/check-engines-nvmrc-sync.mjs (+ .d.mts + unit tests), asserting .nvmrc and every declared engines.node stay in lockstep, so a future .nvmrc bump that forgets to widen engines.node is caught mechanically. Wired into both the local test:ci aggregate and a real ci.yml step (gated like Branding drift check; .nvmrc added to the backend path filter so a .nvmrc-only change still triggers it). - Update the 3 pre-existing tests that hard-asserted the old un-bounded engines.node strings (loopover-engine-scaffold, miner-package-skeleton, miner-run-state) to the new values. - Document the new check in reference.md's CI table. Closes #7613
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
loopover-ui | 99733aa | Commit Preview URL Branch Preview URL |
Jul 21 2026, 02:15 AM |
Bundle ReportChanges will increase total bundle size by 1 bytes (0.0%) ⬆️. This is within the configured threshold ✅ Detailed changes
Affected Assets, Files, and Routes:view changes for bundle: loopover-uiAssets Changed:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #7617 +/- ##
=======================================
Coverage 88.50% 88.50%
=======================================
Files 724 724
Lines 75961 75961
Branches 22610 22612 +2
=======================================
Hits 67232 67232
Misses 7681 7681
Partials 1048 1048
Flags with carried forward coverage won't be shown. Click here to find out more. |
loopover-orb
Bot
added
the
gittensor:bug
|
Warning ⏸️ LoopOver review result - manual review recommendedReview updated: 2026-07-21 03:07:43 UTC
Review summary Nits — 7 non-blocking
Decision drivers
Context & advisory signals — never blocks the verdict
Linked issue satisfactionAddressed Review context
Contributor next steps
Signal definitions
🧪 Chat with LoopOverAsk LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.
Full command reference: https://loopover.ai/docs/loopover-commands 🧪 Experimental — new and may change. 🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed 💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →. Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #7613
Summary
engines.nodein this repo was open-ended, and there was no root.npmrc, so npm never warnedor blocked a Node 23+ install locally -- exactly how the Node 26 jsdom/localStorage bug (theme-toggle tests fail under Node 26 — jsdom's localStorage is shadowed by Node's experimental global #7592/fix(test): pin miner-ui jsdom localStorage over Node 26's broken global #7597,
fix(test): Node 26 jsdom localStorage gap in apps/loopover-ui and packages/loopover-ui-kit #7612) went undetected twice. Tightens
engines.node(root + 5 workspaces) to exclude Node 23+, addsa root
.npmrcwithengine-strict=true, and adds a drift-check script + CI step asserting.nvmrcand every
engines.nodestay in lockstep going forward.Scope
type(scope): short summaryConventional Commit format, for examplefix(api): restore profile access checks.CONTRIBUTING.mdand does not reintroduce GitHub Pages, VitePress,site/, orCNAME.Closes #123) — a linked open issue is required for every contributor PR.Validation
git diff --checknpm run actionlintnpm run typechecknpm run test:coveragelocally;codecov/patchrequires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.npm run test:workersnpm run build:mcpnpm run test:mcp-packnpm run ui:openapi:checknpm run ui:lintnpm run ui:typechecknpm run ui:buildnpm audit --audit-level=moderateIf any required check was skipped, explain why:
scripts/check-engines-nvmrc-sync.mjsand its test are outside Codecov'ssrc/**-only include glob(
scripts/**,test/**), so no patch-coverage number applies -- but the script ships its ownthorough unit suite (fake-repo cases for every branch + a real-repo-state regression guard + a
subprocess smoke test), matching this repo's existing drift-check test convention
(
test/unit/check-manifest-drift-script.test.ts). Three pre-existing tests(
loopover-engine-scaffold.test.ts,miner-package-skeleton.test.ts,miner-run-state.test.ts)hard-asserted the old, un-bounded
engines.nodestrings; updated all three to the new values as partof this PR (caught by a full local
npm run test:cirun, not assumed).Safety
UI Evidencesection below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.UI Evidence
Not applicable — no visible UI/frontend change (dependency/tooling/CI-config only).
Notes
scoped separately to keep each diff narrow.
.github/workflows/ci.yml(adding the new check as a real CI step, plus adding.nvmrctothe
backendpath filter) -- a guarded path, so per the loopover gate's own rules this PR will beheld for manual review/merge, not auto-merged, regardless of how green CI is.