feat!: drop support for Node 18 and 20 - #324
Merged
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
cryptodev-2s
force-pushed
the
migrate/pr2j-drop-node-18-20
branch
from
September 7, 2026 12:31
9118100 to
8f5fc35
Compare
cryptodev-2s
force-pushed
the
migrate/pr2j-drop-node-18-20
branch
2 times, most recently
from
September 8, 2026 12:39
8f5fc35 to
a3e25e3
Compare
cryptodev-2s
added a commit
that referenced
this pull request
Sep 10, 2026
Replaces #324, which GitHub auto-closed as merged during a stack reorder when its head briefly became an ancestor of its base. The changes never reached `main`; this carries the same two commits. Mirrors [MetaMask/core#9976](MetaMask/core#9976), the bottom of core's foundational stack. | | Before | After | | --- | --- | --- | | `engines.node` | `^18.18 \|\| ^20.14 \|\| >=22` | `^22.14.0 \|\| ^24` | | `@types/node` | `~18.18.14` | `^22.13.14` | | CI matrix | 18, 20, 22 | 22, 24 | `constraints.pro` is updated so `yarn constraints` enforces the new range. Core makes the `@types/node` bump in this same PR rather than with its TypeScript change, since the types track the supported runtime. ## Position in the stack This now sits **below** the ESM conversion (#323), so everything up to and including this PR is still a hybrid CJS/ESM build: ``` main → … → #322 → this → #323 (ESM only) → #325 (TypeScript) ``` That matters for testing. A preview build from here still resolves through `main: ./dist/index.cjs` with the `require` condition intact, so it can be consumed by `metamask-extension` as-is. Everything below the ESM cut can therefore be verified against a real downstream consumer before the breaking change lands. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Semver-breaking runtime requirement may block consumers still on Node 18 or 20; in-repo changes are mostly policy, CI, and test cleanup with limited logic impact. > > **Overview** > **Breaking:** supported Node is now `^22.14.0 || ^24` instead of 18/20/22. That is enforced in `package.json`, `constraints.pro`, and documented under Unreleased in `CHANGELOG.md`. > > CI **prepare**, **test**, and **compatibility-test** jobs now run on Node **22.x** and **24.x** only (18 and 20 dropped from the matrix). Dev typings move from `@types/node` ~18 to **^22.13.14**, with matching `yarn.lock` updates. > > Test and lint tooling align with the new floor: ESLint comments for `n/no-unsupported-features/node-builtins` reflect that global `crypto` is expected on 22+, and `hashing.test.ts` drops the Node 18 `webcrypto` polyfill/`beforeEach` setup—tests assume `globalThis.crypto.subtle` exists. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit ba81eca. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
cryptodev-2s
added a commit
that referenced
this pull request
Sep 10, 2026
Top of stack #315, on #324. Mirrors [MetaMask/core#9518](MetaMask/core#9518). | | Before | After | | --- | --- | --- | | `packageManager` | `yarn@4.16.0` | `yarn@4.17.1` | | `typescript` | `~5.3.3` | `npm:@typescript/typescript6@^6.0.2` | | `@typescript/native` | — | `npm:typescript@^7.0.2` | ## Why not just bump to TypeScript 7 I tried that first. It fails for two independent reasons: **1. Yarn.** 4.16.0 auto-applies a builtin `compat/typescript` patch targeting `lib/_tsc.js`. That file doesn't exist in TS 7, which is the native port with a different layout, so the install fails outright: ``` typescript@patch:typescript@npm%3A7.0.2#optional!builtin<compat/typescript> ENOENT: no such file or directory, lstat '.../typescript/lib/_tsc.js' ``` Yarn 4.17.1 resolves it, which is why core bumps the package manager in the same PR. **2. typescript-eslint.** With the install fixed, linting then hard-errors: ``` typescript-eslint does not support TS 7.0. Please see ... to run typescript-eslint using the TS 6 API. ``` Tracked upstream at [typescript-eslint#10940](typescript-eslint/typescript-eslint#10940). So the aliases aren't incidental overhead. Resolving `typescript` to the **TS 6 API** is what keeps `typescript-eslint`, `ts-jest` and `typedoc` working, while TS 7 sits alongside as `@typescript/native`. Compilation runs on 6.0.3; nothing in the toolchain can consume 7 yet. Same position core is in. ## Source changes Two, both from `Uint8Array` becoming generic: - **`hashing.ts`** — `crypto.subtle.digest` takes a `BufferSource`, which no longer accepts a plain `Uint8Array` because the buffer could be a `SharedArrayBuffer`. Asserted at the three call sites rather than narrowing the exported signatures, which would break callers. - **`errors.ts`** — `no-base-to-string` now sees that `String(error)` can produce `[object Object]`. That is the documented fallback of `getErrorMessage`, so it's suppressed with a reason. ## Not carried over Core's third entry, `@typescript/old`, is a patched 6.0.3 pointing at a patch file in core's own `.yarn/patches`. Nothing here needs it and its contents aren't reproducible from outside that repo. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Toolchain-wide TypeScript/Yarn changes can surface build or lint regressions; hashing changes touch crypto paths but preserve digest output via the noble fallback. > > **Overview** > Aligns the repo with MetaMask core’s **TypeScript 6 + native TS 7** setup: **`typescript`** resolves to **`@typescript/typescript6@^6.0.2`** (so **typescript-eslint**, **ts-jest**, and **typedoc** keep working), adds **`@typescript/native`** (TS 7) alongside, bumps **Yarn** to **4.17.1**, and refreshes the lockfile. > > **Jest/ts-jest** gets **`ignoreDeprecations: '6.0'`** so test compilation can keep **`moduleResolution: 'Node'`** under TS 6 without noise. > > Two small **source** fixes for stricter TS 6 types: **`hashing.ts`** only calls **`crypto.subtle.digest`** when input bytes are backed by an **`ArrayBuffer`** (otherwise **noble**), avoiding runtime errors on **`SharedArrayBuffer`** views while keeping public APIs unchanged. **`getErrorMessage`** adds a targeted **`no-base-to-string`** suppression for the intentional **`String(error)`** fallback. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit aac3fa4. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Top of stack #315, on #323. Mirrors MetaMask/core#9976, the bottom of core's foundational stack.
Breaking
engines.node^18.18 || ^20.14 || >=22^22.14.0 || ^24constraints.prois updated to match, soyarn constraintsenforces the new range.Why this one before TypeScript and target/lib
Core sequenced its stack Node → ESM → TypeScript → target/lib, and that order is a dependency chain rather than an arbitrary grouping. Raising the runtime floor first is what justifies each step above it, and bumping the emit target is only defensible once the floor guarantees the runtime supports it.
The remaining two land in that order after this.
Note
Medium Risk
Breaking runtime contract for all consumers and CI; no application logic changes, but anyone on Node 18/20 must upgrade before adopting this release.
Overview
Breaking: This PR raises the minimum supported Node version and aligns CI with that floor, mirroring MetaMask/core’s foundational stack ordering.
engines.nodeis now^22.14.0 || ^24(Node 18 and 20 are no longer supported). The same range is enforced viaconstraints.pro, soyarn constraintskeeps workspace packages consistent. GitHub Actionsbuild-lint-testnow runs on 22.x and 24.x instead of 18, 20, and 22. The unreleased CHANGELOG entry documents the breaking change.Reviewed by Cursor Bugbot for commit a3e25e3. Bugbot is set up for automated code reviews on this repo. Configure here.