Skip to content

build: require Node 24.19.0 and npm 11.17.0 - #64

Open
velocitysystems wants to merge 2 commits into
silvermine:masterfrom
velocitysystems:build/node-24.19-npm-11.17-min-release-age
Open

build: require Node 24.19.0 and npm 11.17.0#64
velocitysystems wants to merge 2 commits into
silvermine:masterfrom
velocitysystems:build/node-24.19-npm-11.17-min-release-age

Conversation

@velocitysystems

@velocitysystems velocitysystems commented Aug 15, 2026

Copy link
Copy Markdown
Contributor

Why

npm's min-release-age / min-release-age-exclude refuse to install package versions that
have not been public for a given number of days — a cheap, high-leverage mitigation against
registry compromises like Shai-Hulud/ChainDrop, which arrive as freshly published versions of
otherwise-trusted packages.

Those flags require npm >= 11.14.0. This repo pins npm 10.5.0 via check-node-version, so
they are currently unavailable. Node 24.19.0 (Krypton LTS) bundles npm 11.17.0 exactly, so
a single .nvmrc bump delivers both.

This PR is only the toolchain upgrade that makes those flags usable. It deliberately does not
set any release-age policy itself, so .npmrc is untouched.

What changed

1. build: require Node 24.19.0 and npm 11.17.0

File Change
.nvmrc 24.13.124.19.0
package.json check-node-version --npm 11.17.0, and standards now runs it

2. style: apply rustfmt to fix cargo lint-fmt failures

File Change
crates/sqlx-sqlite-conn-mgr/src/attached.rs +9/-6
crates/sqlx-sqlite-observer/src/conn_mgr.rs +1/-2
crates/sqlx-sqlite-toolkit/tests/attached_detach_tests.rs +5/-1

No dependency or lockfile changes.

Why the formatting commit is in this PR

cargo lint-fmt was already failing on master before this PR — the reformatted files are
untouched by the toolchain commit. Because rust:lint runs inside npm run standards, that
pre-existing drift blocks CI for any change to this repo, so the upgrade could not go green
without it. It is kept as a separate, formatting-only commit so it can be reviewed
independently, and I am happy to split it into its own PR if you would prefer that to land
first.

Verification

  • Confirmed against nodejs.org release metadata that Node v24.19.0 ships npm 11.17.0, so the
    .nvmrc bump alone pins both versions.
  • Confirmed npm 11.17.0 supports min-release-age and min-release-age-exclude (added in
    npm 11.14.0), so the upgrade achieves its stated purpose.
  • The formatting commit is cargo fmt --all output from rustfmt 1.8.0 / rustc 1.94.0, matching
    the 1.94.0 pin in rust-toolchain.toml and the CI workflow — not a different formatter's
    opinion. It is whitespace and line-wrapping only, with no behaviour change.
  • Locally after both commits: cargo lint-fmt and cargo lint-clippy both exit 0, and
    cargo test --workspace --lib --test '*' passes across all 16 test binaries with 0 failures.
  • The equivalent toolchain change is already green on CI in the sibling tauri-plugin-* repos,
    where the run log shows the runner resolving to exactly Node 24.19.0 and npm 11.17.0.

Notes for reviewers

  • This repo defines check-node-version but never calls it from standards, so the npm pin
    was inert. This PR wires it in.
  • Because CI previously stopped at rust:lint, the commitlint and check-node-version steps
    that follow it in the standards chain run here for the first time.

@velocitysystems
velocitysystems requested a review from a team August 15, 2026 20:15
@velocitysystems
velocitysystems force-pushed the build/node-24.19-npm-11.17-min-release-age branch from 8b563a0 to 8e95215 Compare August 15, 2026 20:18
@velocitysystems velocitysystems changed the title build: require Node 24.19.0 and npm 11.17.0 for release-age gate build: require Node 24.19.0 and npm 11.17.0 Aug 15, 2026
@velocitysystems
velocitysystems force-pushed the build/node-24.19-npm-11.17-min-release-age branch from 8e95215 to f55db87 Compare August 15, 2026 20:31
@velocitysystems
velocitysystems force-pushed the build/node-24.19-npm-11.17-min-release-age branch from ff2407d to b3f8e88 Compare August 18, 2026 10:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant