chore(deps): bump js-yaml and @changesets/cli - #489
Found 1 finding within acceptable thresholds
Review Status
✅ Passed
Findings
| Severity | Count |
|---|---|
| 🟡 Medium | 1 |
Review effort: 1/5 (Trivial)
Details
This is a clean Dependabot PR that upgrades @changesets/cli from 2.x to 3.0.0 and drops the now-unused js-yaml transitive dependency. The lockfile diff is consistent with what the upstream release notes describe, and no changeset is needed (dev-only tooling change per AGENTS.md rules).
Findings
package.json — engines.node out of sync with @changesets/cli 3.0.0 (medium)
File: package.json
@changesets/cli 3.0.0 raised its own supported Node range to ^22.11 || ^24 || >=26. The project's engines.node field still reads >=20.0.0. Any developer or CI runner on Node 20 or 21 will hit a hard failure when running changeset commands (the binary itself enforces its own engines constraint), while package.json falsely advertises those versions as supported.
Suggested fix — update package.json:
"engines": {
"node": "^22.11 || ^24 || >=26"
}If the runtime code genuinely needs to support Node 20 (separate from dev tooling), use a devEngines field (npm ≥ 10.9 supports this) to express the stricter requirement for contributors without narrowing the published runtime range.
Note: Claude suggested: APPROVE_WITH_COMMENTS. Final status determined by severity thresholds.