Skip to content

build: require Node >= 22 and build with Node 24 - #30

Merged
antobinary merged 3 commits into
v0.1.xfrom
node-24
Sep 14, 2026
Merged

antobinary merged 3 commits into
v0.1.xfrom
node-24

Conversation

@antobinary

Copy link
Copy Markdown
Member

What

Moves the template onto Node 24 and declares a supported-Node floor.

  • package.json gains an engines field: "node": ">=22", mirrored into
    package-lock.json so the two agree.
  • @types/node bumped ^20.4.4 -> ^24.13.3 so the typings match the runtime
    the plugin is actually built with.
  • CI moved from Node 20 to Node 24:
    • ts-code-compilation.ymlnode-version: 20.x -> 24.x
    • ts-code-validation.ymlnode-version: 20.x -> 24.x
    • publish-tag.ymlnode-version: '20' -> '24'
    • build-plugin-deb-package.yml — NodeSource setup_20.x -> setup_24.x
  • Debian packaging: debian/control Build-Depends raised from
    nodejs (>= 18) to nodejs (>= 22).

Why this one matters more than its diff suggests

This is the template new plugins are generated from, and its CI workflows are
the ones copied into the sibling repos (several carry commits literally titled
"chore: update CI from bbb-plugin-template"). Landing it means new plugins start
on Node 24 rather than inheriting Node 20 and needing this same change later.

Worth merging ahead of the others for that reason.

Why >=22 and not >=24

The floor is the compatibility contract for anyone consuming or building a
plugin; 22 is still in maintenance and there is no reason to lock it out. The
preferred version is expressed where it takes effect — CI and the Debian build
both pin 24.

Build-Depends follows the same logic: it is a minimum constraint, not a pin,
so the package stays buildable on a Node 22 builder while the version used to
build is pinned to 24 by the NodeSource line.

Testing

Against Node 24.20.0 / npm 11.19.0, running the same chain CI does:

  • npm ci — PASS
  • npx tsc — PASS
  • npm run lint — PASS
  • npm run build-bundle — PASS

TypeScript resolves to 5.6.3, comfortably above the 5.2 that @types/node 24
requires for Symbol.dispose / Disposable.

Notes for review

The package-lock.json diff is confined to the engines block and the
@types/node resolution. lockfileVersion is unchanged.

@types/node is already declared only in devDependencies here, which is the
correct shape — several plugins generated from older revisions of this template
carry it in both sections and need a separate cleanup. Nothing to fix in the
template itself.

Add an `engines` floor of Node >= 22 to package.json and mirror it into
package-lock.json, and bump @types/node to ^24.13.3 so the typings match
the runtime the plugin is built with.

Move CI onto Node 24 (was Node 20). Raise the Debian Build-Depends floor
to nodejs (>= 22) and install Node 24 from NodeSource when building the
package.
Run npm audit fix, then take the two major upgrades it could not apply
on its own: copy-webpack-plugin 12 -> 14 and webpack-dev-server 4 -> 6.
Between them these clear the shell-quote and websocket-driver criticals
and the serialize-javascript, sockjs and uuid advisories.

Everything changed here is build tooling; none of it ships in the
bundle. webpack-dev-server 6 was verified beyond a successful build by
starting the dev server and confirming the custom devServer.app route
for /manifest.json still answers 200.
Pin watch back to ^0.13.0, the version the other repos already use. Its
1.x line pulls exec-sh and a prototype-pollution advisory in merge, and
npm's own resolution for those advisories is 0.13.0. It only backs the
lint:watch helper script.
@antobinary
antobinary requested a review from GuiLeme September 11, 2026 01:05

@imdt-claudiop imdt-claudiop left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved.

Same shape as bigbluebutton/bbb-plugin-picture-in-picture#43, which is already merged: Node 24 across the workflows, nodejs (>= 22) in debian/control, and engines.node >= 22 plus @types/node ^24.13.3 in package.json.

Checked out this branch and ran it on Node 24.9.0:

  • npm install clean, and package-lock.json shows no drift afterwards
  • npx tsc passes (same command as the ts-code-compilation check)
  • npm run lint passes (same command as the ts-code-validation check)
  • npm run build-bundle produces dist/<plugin-name>.js

I also scanned the rest of the tree for leftover references to the older Node line, and there are none.

build: resolve npm audit advisories
@antobinary
antobinary merged commit 500e8b9 into v0.1.x Sep 14, 2026
4 checks passed
@antobinary
antobinary deleted the node-24 branch September 14, 2026 18:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants