feat: drop Node 18 support and fix security alerts (#542)

- Update package.json "engines" to requiring Node >=20.0.0.
- Update .github/workflows/ci.yaml to remove Node 18 from the test matrix and bump other jobs to Node 20.
- Add package.json overrides for `diff` and `serialize-javascript` to resolve Dependabot alerts.

This prepares the workspace for secure dependencies that require Node 20+ runtimes and ensures CI status checks pass.

The mocha package (in devDependencies) is strictly locked on old versions of these dependencies. Since no newer stable Mocha release is available to bumped them naturally, overrides are used to force the upgrades.

Author: codyoss

.github/workflows/ci.yaml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node: [18, 20]
+        node: [20]
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
@@ -36,7 +36,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
         with:
-          node-version: 18
+          node-version: 20
       - run: npm install --engine-strict
       - run: npm test
         env:
@@ -47,7 +47,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
         with:
-          node-version: 18
+          node-version: 20
       - run: npm install
       - run: npm run lint
   docs:
@@ -56,7 +56,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
         with:
-          node-version: 18
+          node-version: 20
       - run: npm install
       - run: npm run docs
       - uses: JustinBeckwith/linkinator-action@v1

package-lock.json

@@ -5,7 +5,7 @@
   "license": "Apache-2.0",
   "author": "Google LLC",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   },
   "bin": {
     "code-suggester": "./build/src/bin/code-suggester.js"
@@ -67,6 +67,8 @@
     "webpack-cli": "^5.0.0"
   },
   "overrides": {
-    "tmp": "0.2.5"
+    "tmp": "0.2.5",
+    "diff": "^8.0.3",
+    "serialize-javascript": "^7.0.4"
   }
 }