Repository navigation
chore: Node 26, @types/node 26 and pnpm 12 - #259
Merged
Merged
Conversation
procoduck
force-pushed
the
chore/go-1.27
branch
from
October 1, 2026 13:48
85d999b to
a070eb3
Compare
procoduck
force-pushed
the
chore/node-26-pnpm-12
branch
from
October 1, 2026 13:49
350305e to
915511f
Compare
procoduck
enabled auto-merge (squash)
October 1, 2026 13:58
- NODE_IMAGE (deploy/versions.env + Dockerfile.{local,init} ARG
defaults): node:26-slim@sha256:ec7758ee... (Node 26.10.0).
- PNPM_VERSION and web/package.json packageManager: 12.8.1.
- ci.yml (4 jobs) and release.yml setup-node: node-version 26.
- web/package.json: @types/node ^26.6.3 and engines.node ">=26"
(engineStrict was already on but had no engine to enforce).
- web/pnpm-lock.yaml rewritten by pnpm 12.8.1: @types/node 26.6.3 /
undici-types 8.9.0, plus pnpm 12's packageManagerDependencies document
at the top. lockfileVersion stays 9.0.
- Finding: node:26-slim no longer ships corepack (Node 25+ dropped it),
so `corepack enable && corepack prepare` in the Dockerfiles would fail.
They now `npm install --global --ignore-scripts pnpm@${PNPM_VERSION}`.
COREPACK_NPM_REGISTRY is gone with it.
- pnpm 12 breaking changes checked: pnpm-workspace.yaml keys
(allowBuilds, saveExact, engineStrict) are all recognised; nothing
uses `--frozen-lockfile false`; there are no git dependencies.
- Docs: AGENTS.md image table, web/AGENTS.md tooling (Node 26, pnpm 12,
no corepack, unknown-workspace-setting failure), README, CONTRIBUTING,
docs-content requirements (+ make docs), vite.config.ts comment,
CHANGELOG.
- dependabot.yml (@types/node majors ignored) and renovate.json (node
majors frozen) need no edit: neither names a version.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BPMsuQQBnedAsJ8tJMH3rw
procoduck
force-pushed
the
chore/node-26-pnpm-12
branch
from
October 1, 2026 13:59
915511f to
18343e7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Node 24 -> 26 runtime, with @types/node 26 and pnpm 11 -> 12 (maintainer-approved 2026-10-01).
Stacked on #254 (Go 1.27): this PR's base is
chore/go-1.27. When #254 merges and its branch is deleted, GitHub retargets this PR tomain.What moved
NODE_IMAGE(deploy/versions.env) and the ARG defaults indeploy/Dockerfile.localanddeploy/Dockerfile.init:node:26-slim@sha256:ec7758ee051e457b468b32bde57b0879010b325bb9862718e9615225ce4aaae1(Node 26.10.0).PNPM_VERSION, the Dockerfile ARG defaults andweb/package.jsonpackageManager:12.8.1. CI and release still read the pin frompackageManager.node-version: 26inci.yml(4 jobs) andrelease.yml.web/package.json:@types/node^24.19.0->^26.6.3.engines.node: ">=26".engineStrictwas already on inpnpm-workspace.yaml, but there was no engine for it to enforce.web/pnpm-lock.yaml, rewritten by pnpm 12.8.1:@types/node26.6.3 andundici-types8.9.0.packageManagerDependenciesdocument, now at the top of the file.lockfileVersionis still9.0, and no other package moved.AGENTS.mdimage table,web/AGENTS.mdtooling section, README, CONTRIBUTING,scripts/docs-content/requirements.html(make docsregenerated the site page), avite.config.tscomment, and a CHANGELOG Unreleased entry.dependabot.ymlorrenovate.json. Dependabot ignores@types/nodemajors and Renovate freezes node majors, and neither file names a version.Findings fixed
node:26-slimdoes not include corepack. Node 25+ stopped bundling it, so the Dockerfiles'corepack enable && corepack prepare pnpm@…would fail. Both Dockerfiles now runnpm install --global --no-fund --no-audit --ignore-scripts pnpm@${PNPM_VERSION}, andCOREPACK_NPM_REGISTRYis removed.--ignore-scriptsis safe here. pnpm's preinstall only relinks its bin onto the native binary; without it, the placeholder bin starts the same binary through Node. Without the flag, npm 11.19 printed an "install scripts not covered by allowScripts" warning instead.pnpm-workspace.yamlkeys are now fatal. All of ours (allowBuilds,saveExact,engineStrict) are recognised.--frozen-lockfile falseis gone. Nothing here uses it.Verification (Node 26.10.0, pnpm 12.8.1)
make web-ci: typecheck, vitest (41 files, 646 tests), biome check and build all pass.make generate: no diff at all ingen/,web/src/gen/orinternal/store/sqlc/, including the version headers.make guardspasses, includingcheck-dockerandcheck-docs-drift.golangci-lint run: 0 issues.go test ./scripts/repocheck/: ok.make smoke: passed. It builtshepherd:localandshepherd:local-initon node:26-slim + pnpm 12.8.1, andcheck-alloy-runnableis OK.make config-scan: OK.🤖 Generated with Claude Code
https://claude.ai/code/session_01BPMsuQQBnedAsJ8tJMH3rw