chore: lower minimum Node version to 18 by amacsmith · Pull Request #14 · looptech-ai/understand-quickly

amacsmith · 2026-05-10T06:29:13Z

Summary

Lowers the declared minimum Node version from >=20.0.0 to >=18.0.0 across the three packages (/, /cli, /mcp). Broadens contributor and downstream-user reach — Node 18 is still in maintenance until April 2025 and is the default in many CI presets.

Changes

package.json — engines.node: >=20.0.0 → >=18.0.0
cli/package.json — engines.node: >=20.0.0 → >=18.0.0
mcp/package.json — engines.node: >=20 → >=18
mcp/package-lock.json — synced to match

Verification

All 166 tests green on the dev environment (Node 22):

npm test — 114/114 (root)
npm test --prefix cli — 25/25
npm test --prefix mcp — 27/27

Code uses only APIs available in Node 18 (global fetch is experimental in 18, stable in 21 — works in both).

Caveat

c8 v11 (just merged in #9) declares engines: ^20.18.0 || >=22.10.0. It's a dev-only coverage tool, so:

✅ npm test works on Node 18
⚠️ npm run test:coverage will warn and likely fail on Node 18

If full Node 18 parity is desired we could pin c8 to ^10 (loses the minimatch CVE-2026-26996 fix from v11). Open to either direction.

Test plan

All test suites pass on Node 22
Verify npm ci + npm test works on Node 18 in CI (would benefit from a Node-matrix workflow — see also Add Node.js CI workflow #13)

🤖 Generated with Claude Code

Generated by Claude Code

coderabbitai · 2026-05-10T06:29:19Z

Warning

Rate limit exceeded

@amacsmith has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 42 minutes and 48 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 57bbb10a-fcd8-4792-bba1-6804aa10ea50

📥 Commits

Reviewing files that changed from the base of the PR and between 4eef6f2 and 70981b2.

⛔ Files ignored due to path filters (3)

cli/package-lock.json is excluded by !**/package-lock.json
mcp/package-lock.json is excluded by !**/package-lock.json
package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

cli/package.json
mcp/package.json
package.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/check-project-status-LFByh

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

This PR lowers the declared minimum supported Node.js version from Node 20 to Node 18 across the repo’s root package and the cli/ and mcp/ workspaces, aiming to broaden compatibility for contributors and downstream users.

Changes:

Updated engines.node in the root package.json and the cli/ and mcp/ workspace package.json files to require Node >=18.
Updated mcp/package-lock.json to reflect the new engines.node value.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 5 comments.

File	Description
package.json	Lowers the root package’s declared Node engine requirement to `>=18.0.0`.
cli/package.json	Lowers the CLI package’s declared Node engine requirement to `>=18.0.0`.
mcp/package.json	Lowers the MCP package’s declared Node engine requirement to `>=18`.
mcp/package-lock.json	Syncs MCP lockfile metadata to the lowered Node engine requirement.

Files not reviewed (1)

mcp/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  },
  "type": "module",
-  "engines": { "node": ">=20.0.0" },
+  "engines": { "node": ">=18.0.0" },


  "engines": {
-    "node": ">=20.0.0"
+    "node": ">=18.0.0"
  },


  },
  "type": "module",
-  "engines": { "node": ">=20.0.0" },
+  "engines": { "node": ">=18.0.0" },


  "type": "module",
  "engines": {
-    "node": ">=20"
+    "node": ">=18"


  "engines": {
-    "node": ">=20"
+    "node": ">=18"
  },


socket-security · 2026-05-10T06:35:40Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@types/node@20.19.39 ⏵ 18.19.130

View full report

Updates engines from >=20.0.0 to >=18.0.0 across root, cli, and mcp packages to broaden contributor and user reach. All 166 tests pass on the existing Node 22 dev environment. Note: c8 v11 (dev-only, used by 'test:coverage') still requires Node 20+; contributors on Node 18 can run 'npm test' but not 'npm run test:coverage'.

- Sync engines metadata in package-lock.json (root + cli) to match the lowered package.json minimum (>=18.0.0). - Use full semver '>=18.0.0' in mcp/package.json for consistency with root and cli (was '>=18'). - Lower @types/node to ^18.19.0 in mcp to match the runtime minimum, preventing accidental use of Node 20-only APIs in TypeScript. - All 27 mcp tests still pass.

amacsmith · 2026-05-10T06:40:56Z

Triage of the 5 Copilot review comments — 4 addressed in 70981b2, 1 is intentional policy:

Root package-lock.json engines >=20.0.0 → >=18.0.0 — fixed (package-lock.json:18).
cli/package-lock.json engines >=20.0.0 → >=18.0.0 — fixed (cli/package-lock.json:15).
mcp/package.json semver consistency >=18 → >=18.0.0 — fixed (already auto-marked outdated).
mcp @types/node ^20.19.39 → ^18.19.0 — fixed; aligned to minimum supported runtime so TypeScript surfaces accidental Node 20-only API use at compile time. mcp/package-lock.json regenerated; mcp's 27 tests still pass.
"Node 18 reached EOL April 2025" — intentional, not fixed. This PR is about broadening contributor reach and matching the most common third-party CI presets (Node 18 LTS is still the default in many tutorials, GitHub Actions starter workflows, and downstream tooling). This is a registry of pointers — there's no long-running process or attack surface that EOL upstream patches would meaningfully change. Contributors and downstream consumers on Node 20+ get full functionality (including npm run test:coverage); Node 18 users get the test suite + library functionality but c8 v11 will warn (dev-only). Happy to add a one-line note to the README about the Node 18 caveat if useful.

🤖 Claude Code

Generated by Claude Code

@cryptofixyup

* ci: add Node matrix workflow (18.x, 20.x, 22.x) Complements validate.yml (which pins to .nvmrc=20) by smoke-testing 'npm ci && npm test' on the full engine band declared in package.json (>= 18.0.0 after #14). Catches breakage on newer Node versions before downstream users hit it. Originally proposed by @cryptofixyup in #13. Refinements vs the original: - Renamed to node-matrix.yml so the intent is explicit alongside validate.yml, smoke.yml, etc. - Pinned actions to the versions used elsewhere in the repo (checkout@v6, setup-node@v6) per the actions group bump in #11. - Dropped 'npm run build --if-present' (no build script in root). - Added 'permissions: contents: read' to follow the principle of least privilege. - Added concurrency group to cancel superseded runs. - Added 'fail-fast: false' so all matrix legs report independently rather than aborting on the first failure. Co-authored-by: cryptofixyup <199330534+cryptofixyup@users.noreply.github.com> * fix(ci): Node 18/20 glob expansion + add publish-time version regression test - npm test/test:coverage scripts now use bash glob expansion via `bash -c 'shopt -s nullglob; node --test scripts/__tests__/*.test.mjs'` so Node 18/20 (which don't support glob in --test) work alongside Node 22/24. - New scripts/check-versions.mjs runs before each publish workflow (cli, mcp, pysdk) and asserts that the package.json version matches the tag-implied version. Catches the class of bug where a tag like cli-v0.2.0 publishes a 0.1.1 package because version bump was missed. 12 regression tests cover semver malformedness, tag/version mismatch, refs/tags/ prefix tolerance, pyproject.toml read path, and unknown-prefix tolerance. Closes #15. --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: cryptofixyup <199330534+cryptofixyup@users.noreply.github.com>

Copilot AI review requested due to automatic review settings May 10, 2026 06:29

Copilot started reviewing on behalf of amacsmith May 10, 2026 06:29 View session

Copilot AI reviewed May 10, 2026

View reviewed changes

amacsmith mentioned this pull request May 10, 2026

Add Node.js CI workflow #13

Closed

10 tasks

amacsmith force-pushed the claude/check-project-status-LFByh branch from 263c2b8 to 63be57d Compare May 10, 2026 06:35

claude added 2 commits May 10, 2026 06:39

amacsmith force-pushed the claude/check-project-status-LFByh branch from 63be57d to 70981b2 Compare May 10, 2026 06:39

amacsmith merged commit 04a2628 into main May 10, 2026
7 of 8 checks passed

amacsmith mentioned this pull request May 10, 2026

ci: add Node matrix workflow (18.x, 20.x, 22.x) #15

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: lower minimum Node version to 18#14

chore: lower minimum Node version to 18#14
amacsmith merged 2 commits into
mainfrom
claude/check-project-status-LFByh

amacsmith commented May 10, 2026

Uh oh!

coderabbitai Bot commented May 10, 2026 •

edited

Loading

Rate limit exceeded

Uh oh!

Copilot AI left a comment

Uh oh!

socket-security Bot commented May 10, 2026 •

edited

Loading

Uh oh!

amacsmith commented May 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

amacsmith commented May 10, 2026

Summary

Changes

Verification

Caveat

Test plan

Uh oh!

coderabbitai Bot commented May 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

socket-security Bot commented May 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

amacsmith commented May 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented May 10, 2026 •

edited

Loading

socket-security Bot commented May 10, 2026 •

edited

Loading