Skip to content

Add an .npmrc config file #535

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dkotter merged 7 commits into from
May 13, 2026
Merged

Add an .npmrc config file #535

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
42d46c5
Add an npmrc file to set some npm config options
dkotter May 12, 2026
402d773
Bump our minimum versions of node and npm so we support the new min-r…
dkotter May 12, 2026
e64e0c2
Remove then rebuild the package-lock.json file
dkotter May 12, 2026
a4dc9c3
Minor changes to minimum versions
dkotter May 12, 2026
8a85fb4
Revert .nvmrc and package.json back to previous node and npm versions
dkotter May 12, 2026
8ea40d4
Remove save-exact from config
dkotter May 12, 2026
3eac712
Rebuild lock file
dkotter May 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .npmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
engine-strict = true
lockfile-version = 3
min-release-age = 1
prefer-dedupe = true
save-exact = true
Comment thread
dkotter marked this conversation as resolved.
Outdated
2 changes: 1 addition & 1 deletion .nvmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
22
24

@justlevine justlevine May 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm worried about doing this before WordPress/gutenberg#72973 . In general those packages don't have the greatest release hygiene and now that we're using experimental (and fragile) packages like @wordpress/ui , I'd recommend increased care.

Related:

@dkotter dkotter May 12, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair point though two thoughts:

  1. GitHub is switching to Node24 as the default June 2nd so this gets us ahead of that
  2. Is a bit trickier having a newer node version but an older npm version though that's manageable. For instance, with this set to 22, if I run nvm use locally it will automatically pull in npm v10. With this set to 24, it will automatically pull in npm v11 (which is the npm version we want). So anyone developing locally will potentially have to manually install the right npm version

@justlevine justlevine May 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GitHub is switching to Node24 as the default June 2nd so this gets us ahead of that

My understanding is this is only affects the runner (and actions themselves), but anything that uses our .nvmrc will still work as intended. (If it didn't we'd be seeing deprecation notices, but I thought we took care of them all in a previous sweep).

If I'm incorrect, then I assume it also will affect the gutenberg repo too though if they still cant hit the deadline, we can also update our workflows with ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true

So anyone developing locally will potentially have to manually install the right npm version

As someone who calls nvm use multiple times an hour this one gives me bigger pause. 🤔

@dkotter - waddya think about us reverting npm to >=10 too, and only committing the new .npmrc (new version props included) in this PR?

It would still allow contributors who are using v11 to benefit from min-release-age, although a better defence for the problem for all versions is to use npm ci unless you're intentionally trying to update the lockfile. And we get all the other .npmrc stuff immediately. It also looks like dependabot doesn't use .nvmrc anyway, so that should benefit from the min-release-age on transient deps immediately too.

Leaving it at >=10 would mean that contributors intentionally changing the lockfile still need to remember to npm i -g npm or nvm install ---latest-npm or whatever the notice says, but that's a much smaller surface area for us to police...🤔

@dkotter dkotter May 12, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reverted back to the existing node and npm versions. I then set my node version to 22.22.2 and npm version to 11.14.1 and re-built the lock file and pushed to this PR, so the only changes now are the new .npmrc file and lock file changes

Loading
Loading