chore!: drop support for Node.js 18 and 20 - #422
Merged
Conversation
Bump the minimum supported Node.js version to 22, matching the current MetaMask module template. This is required before adopting action-npm-publish@v6 (which requires Node >= 22.14.0). - engines.node: ^18.18 || ^20.14 || >=22 -> ^22 || ^24 || >=26 - .nvmrc: v18 -> lts/* - CI test matrix: 18.x/20.x/22.x -> 22.x/24.x/26.x - README: Node 18 -> 22
OGPoyraz
commented
Aug 25, 2026
Comment on lines
+8
to
+10
| ### Changed | ||
| - **BREAKING**: Drop support for Node.js versions 18 and 20 ([#422](https://github.com/MetaMask/eth-sig-util/pull/422)) | ||
| - The minimum supported Node.js version is now 22. |
Member
Author
There was a problem hiding this comment.
9.0.0 never released, I will leave this here and adjust the real 9.0.0 release.
Member
Author
There was a problem hiding this comment.
👍 will create PR before triggering a release
OGPoyraz
marked this pull request as ready for review
August 25, 2026 10:39
Mrtenz
approved these changes
Aug 25, 2026
OGPoyraz
added a commit
that referenced
this pull request
Aug 26, 2026
…e template (#421) ## What is the current state of things and why does it need to change? `@metamask/eth-sig-util`'s CI/publish setup had drifted from the [metamask-module-template](https://github.com/MetaMask/metamask-module-template): - npm publishing used `MetaMask/action-npm-publish@v1` (token-based) with no `id-token: write`, so it could not use OIDC. Core Platform is enforcing [trusted publishing via OIDC](https://docs.npmjs.com/trusted-publishers) and [staged publishing](https://docs.npmjs.com/staged-publishing/), and non-staged publishes will be rejected. - The workflows used manual `checkout` / `corepack enable` / `setup-node` / `yarn install` boilerplate instead of the shared `action-checkout-and-setup` action and the reusable `main.yml` orchestrator pattern. - `packageManager: yarn@3.2.2` was below what `action-npm-publish@v6` requires. > **Note:** The required Node.js bump (Node >= 22.14.0) landed separately in #422 and is already on `main`. ## What is the solution your changes offer and how does it work? Aligns the GitHub Actions setup with the module template and adopts OIDC trusted publishing: - **Adopt OIDC trusted publishing**: upgrade `action-npm-publish` `@v1` → `@v6` (dry-run + publish), add `id-token: write`, and make `NPM_TOKEN` optional (only needed for the first publish, then deleted from the `npm-publish` environment). - **Switch Yarn to Corepack**: bump `packageManager` to `yarn@4.16.0` (integrity hash), remove `yarnPath` and the committed `.yarn/releases` binary. - **Restructure workflows to match the template**: add a `main.yml` orchestrator (runs `check-workflows` + `build-lint-test` on push/PR, gates the release via `is-release` → `publish-release`); convert `build-lint-test.yml` and `publish-release.yml` to reusable `workflow_call` workflows using `MetaMask/action-checkout-and-setup@v3` and artifact-based build/publish; update `create-release-pr.yml` (`action-create-release-pr@v5`), `publish-docs.yml`, and `publish-rc-docs.yml`. - **Bump `@metamask/auto-changelog`** `^3.1.0` → `^6.2.1` so `auto-changelog validate` works on the Node 22/24/26 CI matrix. - Regenerate `yarn.lock` in the Yarn 4 format. No dependency versions changed beyond `auto-changelog`. ### Intentional adaptations (vs a literal template copy) - Keep the existing standalone `security-code-scanner.yml` (not folded into `main.yml`). - Keep `GITHUB_TOKEN` for docs deploys (no `PUBLISH_DOCS_TOKEN` dependency). - Omit the Slack integration (the repo has no `SLACK_WEBHOOK_URL` secret). - Use `auto-changelog` for changelog validation (no `lint:changelog` script). - Keep a plain-string `release-type` input (no `type: choice`), which avoids needing an `actionlint.yml` config file. Once merged, trusted publishing must be configured for `@metamask/eth-sig-util` on the NPM side (via [@metamask-npm-publishers](https://consensys.slack.com/?subteam=S042S7RE4AE)) before the next release. ## References - Prerequisite (merged): #422 (drop Node.js 18/20) - Reference diff: [metamask-module-template@193ed00](MetaMask/metamask-module-template@193ed00) - [NPM trusted publishing docs](https://docs.npmjs.com/trusted-publishers), [staged publishing docs](https://docs.npmjs.com/staged-publishing/) <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **High Risk** > Changes npm publish flow (OIDC, artifacts, job ordering) and release gating on main, so a misconfiguration could block or mishandle releases. > > **Overview** > Replaces the monolithic **Build, Lint, and Test** workflow with a **`main.yml` orchestrator** on push/PR that runs **actionlint** (new matcher + config, including an ignore for intentional empty `release-type`), a **reusable security scan** (replacing the standalone scanner workflow), and a **`workflow_call` build/lint/test** pipeline using **`MetaMask/action-checkout-and-setup@v3`**. Build and lint now run on **Node 26.x** only (tests still matrix 22/24/26), and a new **compatibility-test** job reinstalls deps without the lockfile before restoring it. > > **Release publishing** is no longer triggered directly from `publish-release.yml` on `main` pushes; **`main.yml`** gates **`is-release`** → **`publish-release.yml`** (now callable). That workflow **builds once, uploads artifacts**, runs **npm dry-run + publish via `action-npm-publish@v6`** with **`id-token: write`**, optional **`NPM_TOKEN`**, then docs deploys and a separate **`action-publish-release@v3`** GitHub release step. **`create-release-pr`** moves to the shared checkout action and **`action-create-release-pr@v5`**, with **`release-type` as a choice** (including empty). Docs publishing adds **`github-pages` environment**, shared checkout/setup, and bumps **peaceiris/actions-gh-pages**. Adds **`.github/zizmor.yml`** for workflow lint policy tweaks. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 8b88ff0. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
OGPoyraz
added a commit
that referenced
this pull request
Aug 26, 2026
## Explanation The `9.0.0` release ([#420](#420)) was tagged but **never published to npm** — the team decided to migrate publishing to OIDC trusted publishing ([#421](#421)) before cutting the release. This PR un-releases `9.0.0` so it can be re-cut cleanly on top of the OIDC migration. ## Changes - **`package.json`**: `9.0.0` → `8.2.0`. - **`CHANGELOG.md`**: - Remove the `## [9.0.0]` section heading and fold its entries back under `## [Unreleased]`: - **BREAKING**: Reject ambiguous `bool` values in `signTypedData` ([#419](#419)) - Add additional validation to EIP7702 methods ([#410](#410)) - Reset the `[Unreleased]` compare link to `v8.2.0...HEAD` and drop the `[9.0.0]` link. The Node.js 18/20 drop entry ([#422](#422)), which was added after `9.0.0` was cut, is preserved under `[Unreleased]`. ## Follow-ups (not in this PR) - The existing `v9.0.0` **git tag** (`646b724`) will be deleted separately before the new `release/9.0.0` PR (npm was never published, so nothing to unpublish). - After this merges, a fresh `release/9.0.0` PR will be created via the standard release workflow. ## References - Reverts the release portion of #420 - Depends on OIDC migration #421 (merged)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is the current state of things and why does it need to change?
@metamask/eth-sig-utilcurrently supports Node.js 18 and 20 (engines.node: ^18.18 || ^20.14 || >=22). Node.js 18 is end-of-life and 20 is entering maintenance, and the current MetaMask module template has moved its baseline to Node.js 22.This bump is also a prerequisite for migrating npm publishing to OIDC trusted publishing via
MetaMask/action-npm-publish@v6, which requires Node.js >= 22.14.0 (see #421). Splitting it out here keeps that breaking, consumer-facing change isolated with its own changelog entry.What is the solution your changes offer and how does it work?
Bump the minimum supported Node.js version to 22, aligning with the module template:
engines.node:^18.18 || ^20.14 || >=22→^22 || ^24 || >=26.nvmrc:v18→lts/*18.x/20.x/22.x→22.x/24.x/26.xThis PR intentionally does not touch the package manager (
yarn@3.2.2) or the publishing workflow; those are handled in the OIDC migration PR (#421), which will rebase on top of this once merged.Are there any smaller changes to this PR that you would like to highlight?
!in the commit and the**BREAKING**changelog entry.References
^22 || ^24 || >=26,.nvmrclts/*)Note
Low Risk
Policy and CI-only changes with no runtime code paths modified; the main impact is consumers still on Node 18 or 20 must upgrade before installing future releases.
Overview
Breaking change: the package no longer supports Node.js 18 or 20. The minimum is Node.js 22, reflected in
package.jsonengines.node(^22 || ^24 || >=26), contributor docs, and a BREAKING[Unreleased]changelog entry.CI prepare, build, and test matrices now run on 22.x / 24.x / 26.x instead of 18.x / 20.x / 22.x. Local dev defaults move from
.nvmrcv18tolts/*. README setup instructions now ask for Node 22.No library source or signing behavior changes—only supported Node versions and how they are validated in CI.
Reviewed by Cursor Bugbot for commit d43ef9c. Bugbot is set up for automated code reviews on this repo. Configure here.