Skip to content

feat!: drop support for Node 18 and 20 - #324

Open
cryptodev-2s wants to merge 2 commits into
migrate/pr2i-esm-onlyfrom
migrate/pr2j-drop-node-18-20
Open

feat!: drop support for Node 18 and 20#324
cryptodev-2s wants to merge 2 commits into
migrate/pr2i-esm-onlyfrom
migrate/pr2j-drop-node-18-20

Conversation

@cryptodev-2s

@cryptodev-2s cryptodev-2s commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Top of stack #315, on #323. Mirrors MetaMask/core#9976, the bottom of core's foundational stack.

Breaking

Before After
engines.node ^18.18 || ^20.14 || >=22 ^22.14.0 || ^24
CI matrix 18, 20, 22 22, 24

constraints.pro is updated to match, so yarn constraints enforces the new range.

Why this one before TypeScript and target/lib

Core sequenced its stack Node → ESM → TypeScript → target/lib, and that order is a dependency chain rather than an arbitrary grouping. Raising the runtime floor first is what justifies each step above it, and bumping the emit target is only defensible once the floor guarantees the runtime supports it.

The remaining two land in that order after this.


Note

Medium Risk
Breaking semver change drops Node 18/20 for all consumers; runtime library code is unchanged, so risk is mainly adoption and CI coverage on 24.x.

Overview
Breaking: Supported Node versions are narrowed from ^18.18 || ^20.14 || >=22 to ^22.14.0 || ^24, aligned with MetaMask core.

package.json engines.node and constraints.pro enforce the new range via yarn constraints. Dev typings move from @types/node ~18 to ^22.13.14 (lockfile updates undici-types accordingly). CI prepare, test, and compatibility-test matrices now run on 22.x and 24.x only (18 and 20 removed). The unreleased changelog documents the breaking change.

Reviewed by Cursor Bugbot for commit 8f5fc35. Bugbot is set up for automated code reviews on this repo. Configure here.

@socket-security

socket-security Bot commented Sep 5, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​types/​node@​18.18.14 ⏵ 22.20.1100 +121008196100

View full report

Mirrors MetaMask/core#9976, the bottom of core's foundational stack.

BREAKING: the supported range moves from ^18.18 || ^20.14 || >=22 to
^22.14.0 || ^24, the same range core adopts. The CI matrix drops to 22 and
24, and constraints.pro is updated to match.

This lands before the TypeScript and target/lib changes on purpose. Core
sequenced its stack Node, then ESM, then TypeScript, then target/lib, and
that order is a dependency chain rather than an arbitrary grouping: raising
the runtime floor first is what justifies each step above it, and emitting
a higher target is only defensible once the floor guarantees it.
Follows from the runtime floor moving to Node 22. Core makes the same bump
in the same PR as its Node drop (MetaMask/core#9976), rather than alongside
the TypeScript change, since the types track the supported runtime.
@cryptodev-2s
cryptodev-2s force-pushed the migrate/pr2j-drop-node-18-20 branch from 9118100 to 8f5fc35 Compare September 7, 2026 12:31
@cryptodev-2s
cryptodev-2s force-pushed the migrate/pr2j-drop-node-18-20 branch from 9118100 to 8f5fc35 Compare September 7, 2026 12:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant