JavaScript GCP KMS Storage: raise Node engines floor to >=22, drop unnecessary tootallnate override (KSM-1534)

[stas-schaller]

Summary

JavaScript GCP KMS Storage: declares the Node version floor this release already requires, and removes a dependency override that resolves nothing in the current tree.

Changes

Maintenance

• No engines field was declared despite core 17.6.0 (this package's own dependency) pulling an engines.node >=20 floor into the tree. A consumer on an unsupported Node version got only a silent npm warn EBADENGINE instead of a clear, enforced failure. Added "engines": { "node": ">=20" }, matching the placement and value already used in sdk/javascript/packages/core/package.json. (KSM-1534)
• Removed the "overrides": { "@tootallnate/once": "3.0.1" } block. Verified it resolves nothing in the current dependency tree: http-proxy-agent is on 7.0.2 here, which does not depend on @tootallnate/once at all, so the override was unnecessary regardless of which version it pinned. Lockfile regenerated; @tootallnate/once does not appear anywhere in it before or after this change.

Testing

cd sdk/javascript/packages/gcp
npm test

124/124 passing. npm run build and npm run lint also clean.

Breaking Changes

None. The engines field only surfaces npm's existing warning as documented metadata; core already required Node 20 as of 17.6.0.

Related Issues

• Jira: KSM-1534

[mgallego-keeper]

Summary

This PR adds "engines": { "node": ">=20" } to package.json. It also removes the overrides block that pins @tootallnate/once to 3.0.1.

Verification: the override removal is correct

I checked the release branch lockfile before this PR. @tootallnate/once does not appear anywhere in it. http-proxy-agent is already on 7.0.2, from the earlier KSM-1510 bump. Version 7.0.2 does not depend on @tootallnate/once at all. The override was already dead weight. Removing it is safe.

I merged this PR onto the release branch tip and ran npm ci and the full test suite. All 124 tests pass.

Finding: the declared floor does not match the real dependency floor

@google-cloud/kms is already at ^6.2.0 in this package, from the earlier KSM-1510 bump. The npm registry lists its engines.node field as >=22, not >=20. Six of its own dependencies list the same >=22 floor: google-gax, gcp-metadata, google-logging-utils, proto3-json-serializer, retry-request, and teeny-request.

I ran npm ci on Node 20.20.1 against this exact tree, with this PR merged. It printed this warning:

npm warn EBADENGINE Unsupported engine {
npm warn EBADENGINE   package: 'teeny-request@11.0.1',
npm warn EBADENGINE   required: { node: '>=22' },
npm warn EBADENGINE   current: { node: 'v20.20.1', npm: '10.8.2' }
npm warn EBADENGINE }

I ran the same install on Node 22.22.1. The warning did not appear.

Why this matters

The point of this ticket is to stop a consumer from installing on an unsupported Node version with only a warning, not a clear signal. Declaring >=20 reproduces that same problem one Node version later. A Node 20 or 21 consumer now sees a specific, confident floor from this package's own package.json. A dependency two levels down already disagrees with it.

This repository's own CI test workflow, test.javascript.storage.gcp.kms.yml, runs on Node 20.x. It would show the same warning. Its test suite mocks the GCP KMS client in every test file, so it does not exercise the real client library either way.

Requested change

Raise the declared floor to >=22 to match @google-cloud/kms and its own dependencies. If >=20 is intentional for some other reason, please state that reason in the PR body or the ticket.

Merge order

See the note on #1189 for the overlap and merge order across #1196 to #1200.

[mgallego-keeper]

Summary

This PR raises the declared engines.node floor to >=22 and removes the unused @tootallnate/once override. I checked both claims directly, not just by reading the diff.

I built the package from this branch and ran npm pack. I installed the resulting tarball fresh on four real Node runtimes. Node 20.20.1 and Node 20 with --engine-strict both show the problem this PR fixes: a plain install now warns and names this package itself (not just a dependency), and --engine-strict now fails the install outright. Node 22.22.1 and Node 24.14.0 install with zero warnings. >=22 is the correct, tightest floor: I confirmed it against the actual resolved lockfile, and no runtime package in the tree needs anything higher.

The override removal is also safe. I ran npm ls @tootallnate/once and npm ls http-proxy-agent on the built tree: @tootallnate/once is absent entirely, and http-proxy-agent resolves once, at 7.0.2, which does not depend on it.

Finding: the README still states the old floor

README.md line 20 says "Node.js 20 or later is required." That line was added by a different PR (#1200) after this PR's branch point, so this PR's diff never touches it.

I confirmed this in the actual shipped artifact, not only the source tree. The npm pack tarball from this branch has package.json declaring >=22 and the same tarball's README.md still telling the reader >=20 is fine. A consumer who reads the bundled README gets the wrong number for the exact fact this PR exists to fix.

Finding: three CHANGELOG lines now disagree with the rest of the file

• The paragraph introducing the two existing "Changed" entries says both entries "follow from the move to an atomic temp-file-then-rename." This PR adds a third entry under that same paragraph, and the new entry has nothing to do with that change.
• The KSM-1500 entry under "Maintenance" still says "this package's own CI already tests on Node 20, so no other change was needed here." That sentence is the one KSM-1534 names as the reasoning it corrects. After this PR, CI tests on Node 22, and other change was needed. Leaving the old sentence in place puts a direct contradiction two sections below the fix.
• The new entry says the floor is "now >=22, not >=20," and describes a consumer who "previously installed with only an EBADENGINE warning." No released version of this package ever declared >=20. The only published version, 1.0.0, declared no engines field at all, and at that time its @google-cloud/kms dependency only required Node 18.

Requested change

Update README.md line 20 to Node 22. Adjust the three CHANGELOG lines above to describe the real before-and-after state.

Non-blocking note

This PR adds a third breaking change (dropping Node 20 and 21) on top of two breaking changes the CHANGELOG already lists for this release. Worth a quick check against this release's own version number before it ships. That number is not part of this PR's diff, so it does not block this PR either way.

[mgallego-keeper]

Summary

I re-reviewed this PR at 46b4768b. The merge commit fixed most of the round 2 items. I pushed one small commit, 123271c, to fix the last two CHANGELOG problems. The PR is now ready to merge.

What 123271c changes

The commit changes only CHANGELOG.md:

• It moves the KSM-1534 entry to the end of the "Changed" list. The merge had put it between the KSM-1450/KSM-1458 symlink entry and the KSM-1514 entry. So "the entry above" in the KSM-1514 entry pointed at the Node engines entry.
• It rewrites the KSM-1534 entry. The old entry said that a Node 20 or 21 consumer "only ever saw EBADENGINE warnings." That is not correct. I installed 1.0.0, the only published version, on Node 20.20.1, and npm printed no EBADENGINE warning. The new entry says that 1.1.0 drops support that 1.0.0 had.

You can change the wording, but please keep the facts.

Verified

• README.md line 20 says Node 22, in the source and in the npm pack tarball.
• The "Changed" intro now covers only its two entries. The KSM-1500 entry no longer says that CI tests on Node 20.
• On Node 20.20.1, a tarball install warns and names this package. With --engine-strict, the install exits with status 1. Node 22.22.1 and Node 24.14.0 install with no warning.
• >=22 is still the lowest floor that works, in the lockfile and in a fresh consumer install.
• Build and lint pass on Node 22.22.1. The suite passes 181 of 181 tests on Node 22.22.1 and on Node 24.14.0.
• CI on 123271c ran on Node 22.23.2 and passed 181 of 181.
• A relock with npm 10.9.4 and with npm 11.9.0 leaves the lockfile byte-identical.
• @tootallnate/once is absent from the tree. http-proxy-agent resolves once, at 7.0.2.

Non-blocking

• The PR body still describes the first commit: >=20, 124 of 124 tests, and "Breaking Changes: None." Please update it before the merge. The squash commit uses the commit messages, so git history is not affected.
• The version note from round 2 still stands. @google-cloud/kms shipped this same floor change, from >=18 to >=22, as 6.0.0, a major release. 1.1.0 passes that change to consumers in a minor release. That decision belongs to the release PR, #1189.
• Optional: the README "Prerequisites" section does not state the Node floor. Only "Behavior Notes (v1.1.0)" states it.