Skip to content

ci: bump Node to 26 and consolidate dev dependency updates - #240

Merged
kellenmurphy merged 3 commits into
mainfrom
chore/node-26-and-dep-bumps
Jul 28, 2026
Merged

ci: bump Node to 26 and consolidate dev dependency updates#240
kellenmurphy merged 3 commits into
mainfrom
chore/node-26-and-dep-bumps

Conversation

@kellenmurphy

Copy link
Copy Markdown
Owner

Consolidates the four open Dependabot PRs (#236, #237, #238, #239) with the Node bump they depend on.

Why these ship together

jsdom 30 declares node: ^22.22.2 || ^24.15.0 || >=26.0.0, dropping Node 20. CI pinned node-version: 20, so #237 went red — all 14 test files failed before running:

[vitest-pool]: Failed to start forks worker for src/lib/saml.test.ts
Caused by: TypeError: webidl.util.markAsUncloneable is not a function

The 0% coverage on that run was a symptom of nothing executing, not a real regression. Neither change is green alone, so they land as one PR.

Changes

.github/workflows/ci.ymlnode-version: 2026 in all three jobs (test, security-audit, deploy).

Node 26 over LTS 24 because the repo already depends on @types/node ^26, so 20 left types describing APIs the runtime lacked. 26 also matches local development. Tradeoff: Node 26 is Current, not Active LTS until ~October 2026.

package.json / package-lock.json

Package From To
jsdom 29.1.1 30.0.0
@types/node 26.1.1 26.1.2
globals 17.7.0 17.8.0
svelte-check 4.7.3 4.7.4

CLAUDE.md — corrects the deployment section. It described Pages as git-connected; the project settings show no git repository and no build configuration, so Cloudflare never builds. The deploy job builds and direct-uploads via wrangler pages deploy. That makes the Actions node-version the toolchain producing the production artifact, which is worth stating plainly.

Verification

Run locally on Node 26.5.0:

Check Result
npx tsc --noEmit exit 0
npx eslint . --quiet exit 0
npm run coverage 14 files, 382 tests, 100% stmts/branches/funcs/lines
npm run check 0 errors, 4 warnings (unchanged baseline)
npm run build exit 0
npm audit 0 vulnerabilities

Notes

jsdom 30 requires node ^22.22.2 || ^24.15.0 || >=26.0.0, so the Node 20
runners fail to start Vitest's fork workers with "webidl.util.markAsUncloneable
is not a function" once jsdom is upgraded.

Node 26 rather than 24 so the runner matches @types/node ^26, which the repo
already depends on, and local development. Note this also changes the toolchain
that builds the production artifact: the deploy job uploads what Actions builds,
since the Pages project is direct-upload and never builds on Cloudflare's side.
Consolidates dependabot PRs #236, #237, #238 and #239:

  jsdom          29.1.1 -> 30.0.0
  @types/node    26.1.1 -> 26.1.2
  globals        17.7.0 -> 17.8.0
  svelte-check    4.7.3 -> 4.7.4

jsdom 30 is a major bump that drops Node 20; it is landed together with the
Node 26 runner bump because neither is green without the other.
The Pages project is not connected to this repo. Its settings show no git
repository and no build configuration, so Cloudflare never runs a build; the
deploy job in ci.yml builds and direct-uploads via wrangler on push to main.

Describing it as git-connected implies a Cloudflare-side build that would need
its own Node version and would install devDependencies. No such build exists.
@kellenmurphy
kellenmurphy merged commit 2922f65 into main Jul 28, 2026
9 checks passed
@codecov

codecov Bot commented Jul 28, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant