fix:Align runtime to Node 20 LTS and enforce version by BMJ-075 · Pull Request #1183 · cowprotocol/token-lists

BMJ-075 · 2025-10-14T09:53:42Z

Align runtime to Node.js 20 LTS and enforce versions to avoid Corepack/Yarn issues and improve reproducibility.

Changes:

Add .nvmrc (20.19.0) and .npmrc (engine-strict=true).
Add engines to package.json (node >=20.18 <21, yarn >=4 <5).
Update README.md to require Node 20 and add Corepack + nvm setup.
Commit Yarn Berry config: .yarnrc.yml and .yarn/install-state.gz.

Testing:

With Node 20.19.0 / Yarn 4.9.4:
yarn install --immutable OK
yarn test → 24/24 passed
yarn validate → OK

Note: One peer warning (@cowprotocol/cow-sdk → ethers), non-blocking.

Summary by CodeRabbit

Documentation
- Updated prerequisites to require Node.js 20 LTS (recommended 20.19.0).
- Added setup steps for enabling corepack, installing Node via nvm, and verifying Yarn.
- Refreshed installation guidance to align with the new Node 20 setup.
Chores
- Enforced strict engine checks during package operations.
- Standardized Node.js version to 20.19.0 for local development.
- Configured Yarn to use the node-modules linker.
- Declared supported Node and Yarn versions and specified the package manager version.

…rc; update README

coderabbitai · 2025-10-14T09:53:52Z

Walkthrough

Updates project runtime/tooling configuration to Node.js 20 LTS. Adds strict engine enforcement for npm, configures Yarn to node-modules linker, pins Node version via .nvmrc, sets engines and packageManager in package.json, and adjusts README prerequisites and setup steps accordingly.

Changes

Cohort / File(s)	Summary
Runtime/Engines Configuration `package.json`, `.npmrc`, `.nvmrc`, `.yarnrc.yml`	Add engines (Node 20, Yarn) and packageManager (Yarn 4.9.4) to package.json; enable npm engine-strict; add .nvmrc with Node 20.19.0; configure Yarn nodeLinker: node-modules.
Documentation `README.md`	Update prerequisites to Node.js 20 LTS (Iron), recommend v20.19.0; add setup steps using corepack and nvm; include Yarn version sanity check.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related issues

Align runtime to Node 20 LTS and enforce version via engines/.nvmrc; update README #1182 — Mirrors these Node/Yarn config updates and README setup alignment.

Suggested reviewers

shoom3301
alfetopito

Poem

Little paws tap npm drums, hop-hop—strict and neat,
Yarn rolls out tidy balls, node-modules at my feet.
Iron moons of Node 20 glow, steady as can be,
nvm burrows version snug: 20.19.0 for me.
With corepack carrots cached, I ship—bugs flee! 🥕🐇

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title succinctly captures the core update of aligning the project’s runtime to Node 20 LTS and enforcing version constraints, directly reflecting the main change introduced by the pull request.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2025-10-14T09:53:52Z

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

I have read the CLA Document and I hereby sign the CLA

_{You can retrigger this bot by commenting recheck in this Pull Request.}_{Posted by the CLA Assistant Lite bot.}

socket-security · 2025-10-14T09:54:08Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality
	unique-slug@5.0.0
	unique-filename@4.0.0
	abbrev@3.0.1
	strip-ansi@7.1.2
	@isaacs/cliui@8.0.2
	@isaacs/fs-minipass@4.0.1
	package-json-from-dist@1.0.1
	minipass-sized@1.0.3
	minipass-flush@1.0.5
	eastasianwidth@0.2.0
	minipass-collect@2.0.1
	minipass-pipeline@1.2.4
	tinyglobby@0.2.15
	encoding@0.1.13
	isexe@3.1.1
	env-paths@2.2.1
	@pkgjs/parseargs@0.11.0
	retry@0.12.0
	http-proxy-agent@7.0.2
	path-scurry@1.11.1
	ip-address@10.0.1
	smart-buffer@4.2.0
	p-map@7.0.3
	https-proxy-agent@7.0.6
	minimatch@9.0.5
	minipass-fetch@4.0.1
	signal-exit@4.1.0
	agent-base@7.1.4
	jackspeak@3.4.3
	glob@10.4.5
	socks-proxy-agent@8.0.5
	cross-spawn@7.0.3 ⏵ 7.0.6	⁺¹	⁺²²	^-2
	socks@2.8.7
See 22 more rows in the dashboard

View full report

BMJ-075 · 2025-10-14T09:55:03Z

I have read the CLA Document and I hereby sign the CLA

BMJ-075 · 2025-10-14T09:57:14Z

closes #1182

coderabbitai

Actionable comments posted: 0

🧹 Nitpick comments (2)

package.json (1)
67-73: Align engines.node with .nvmrc/README for consistency.

Consider requiring >=20.19.0 to match .nvmrc and docs. engines.yarn is optional given packageManager, but fine to keep.

Apply:
   "engines": {
-    "node": ">=20.18.0 <21",
+    "node": ">=20.19.0 <21",
     "yarn": ">=4.0.0 <5"
   },
README.md (1)
57-68: Minor setup clarity: group nvm command; optionally mention nvm install.

Shell clarity/readability:
- nvm use || nvm install 20.19.0 && nvm use 20.19.0
+ nvm use || (nvm install 20.19.0 && nvm use 20.19.0)
Optionally add a note/link to install nvm if the command is missing, and/or run:

corepack use yarn@4.9.4 (not required with packageManager, but makes the step explicit).

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 1603e3d and f0cfba7.

⛔ Files ignored due to path filters (2)

.yarn/install-state.gz is excluded by !**/.yarn/**, !**/*.gz
yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (5)

.npmrc (1 hunks)
.nvmrc (1 hunks)
.yarnrc.yml (1 hunks)
README.md (1 hunks)
package.json (1 hunks)

🔇 Additional comments (3)

.nvmrc (1)

1-2: Pinned Node version looks good.

.npmrc (1)

1-2: No npm usage detected in CI workflows
Verified that GitHub workflows contain no npm install or npm ci invocations; retaining engine-strict=true is safe.

.yarnrc.yml (1)

1-1: LGTM. .gitignore has no .yarn entries, so Yarn metadata won’t be ignored.

BMJ-075 · 2025-10-14T10:00:22Z

recheck

BMJ-075 · 2025-10-14T11:58:52Z

I have read the CLA Document and I hereby sign the CLA

fix:Align runtime to Node 20 LTS and enforce version via engines/.nvm…

f0cfba7

…rc; update README

coderabbitai Bot reviewed Oct 14, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix:Align runtime to Node 20 LTS and enforce version#1183

fix:Align runtime to Node 20 LTS and enforce version#1183
BMJ-075 wants to merge 1 commit intocowprotocol:mainfrom
BMJ-075:main

BMJ-075 commented Oct 14, 2025 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 14, 2025 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 14, 2025

Uh oh!

socket-security Bot commented Oct 14, 2025

Uh oh!

BMJ-075 commented Oct 14, 2025

Uh oh!

BMJ-075 commented Oct 14, 2025

Uh oh!

coderabbitai Bot left a comment

Uh oh!

BMJ-075 commented Oct 14, 2025

Uh oh!

BMJ-075 commented Oct 14, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

BMJ-075 commented Oct 14, 2025 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Suggested reviewers

Poem

Pre-merge checks and finishing touches

Uh oh!

github-actions Bot commented Oct 14, 2025

Uh oh!

socket-security Bot commented Oct 14, 2025

Uh oh!

BMJ-075 commented Oct 14, 2025

Uh oh!

BMJ-075 commented Oct 14, 2025

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

BMJ-075 commented Oct 14, 2025

Uh oh!

BMJ-075 commented Oct 14, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

BMJ-075 commented Oct 14, 2025 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 14, 2025 •

edited

Loading