build: require Node 24.19.0 and npm 11.17.0 - #64
Open
velocitysystems wants to merge 2 commits into
Open
Conversation
velocitysystems
force-pushed
the
build/node-24.19-npm-11.17-min-release-age
branch
from
August 15, 2026 20:18
8b563a0 to
8e95215
Compare
velocitysystems
force-pushed
the
build/node-24.19-npm-11.17-min-release-age
branch
from
August 15, 2026 20:31
8e95215 to
f55db87
Compare
velocitysystems
force-pushed
the
build/node-24.19-npm-11.17-min-release-age
branch
from
August 18, 2026 10:10
ff2407d to
b3f8e88
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
npm's
min-release-age/min-release-age-excluderefuse to install package versions thathave not been public for a given number of days — a cheap, high-leverage mitigation against
registry compromises like Shai-Hulud/ChainDrop, which arrive as freshly published versions of
otherwise-trusted packages.
Those flags require npm >= 11.14.0. This repo pins npm 10.5.0 via
check-node-version, sothey are currently unavailable. Node 24.19.0 (Krypton LTS) bundles npm 11.17.0 exactly, so
a single
.nvmrcbump delivers both.This PR is only the toolchain upgrade that makes those flags usable. It deliberately does not
set any release-age policy itself, so
.npmrcis untouched.What changed
1.
build: require Node 24.19.0 and npm 11.17.0.nvmrc24.13.1→24.19.0package.jsoncheck-node-version --npm 11.17.0, andstandardsnow runs it2.
style: apply rustfmt to fix cargo lint-fmt failurescrates/sqlx-sqlite-conn-mgr/src/attached.rscrates/sqlx-sqlite-observer/src/conn_mgr.rscrates/sqlx-sqlite-toolkit/tests/attached_detach_tests.rsNo dependency or lockfile changes.
Why the formatting commit is in this PR
cargo lint-fmtwas already failing onmasterbefore this PR — the reformatted files areuntouched by the toolchain commit. Because
rust:lintruns insidenpm run standards, thatpre-existing drift blocks CI for any change to this repo, so the upgrade could not go green
without it. It is kept as a separate, formatting-only commit so it can be reviewed
independently, and I am happy to split it into its own PR if you would prefer that to land
first.
Verification
.nvmrcbump alone pins both versions.min-release-ageandmin-release-age-exclude(added innpm 11.14.0), so the upgrade achieves its stated purpose.
cargo fmt --alloutput from rustfmt 1.8.0 / rustc 1.94.0, matchingthe
1.94.0pin inrust-toolchain.tomland the CI workflow — not a different formatter'sopinion. It is whitespace and line-wrapping only, with no behaviour change.
cargo lint-fmtandcargo lint-clippyboth exit 0, andcargo test --workspace --lib --test '*'passes across all 16 test binaries with 0 failures.tauri-plugin-*repos,where the run log shows the runner resolving to exactly Node 24.19.0 and npm 11.17.0.
Notes for reviewers
check-node-versionbut never calls it fromstandards, so the npm pinwas inert. This PR wires it in.
rust:lint, thecommitlintandcheck-node-versionstepsthat follow it in the
standardschain run here for the first time.