Update dependency node-gyp to v13

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
node-gyp	^12.0.0 → ^13.0.0

---

Release Notes

nodejs/node-gyp (node-gyp)

v13.1.0

Compare Source

Features

• update gyp-next to v0.22.3 (#​3361) (729bfb8)

Bug Fixes

• accept --msvs_version as the README documents it (#​3364) (8cca9c9)
• add Python 3.15 and update OS versions in tests.yml (#​3369) (03c7b3b)
• let --loglevel on the command line override npm_config_loglevel (#​3384) (2275aa9)

Core

• deps-dev: bump eslint to 10 and neostandard to 0.14.0-next.1 (#​3374) (d389298)

Tests

• fix missing cb in fs.unlink (#​3368) (e91cd76)
• fix non-ASCII addon cache path (#​3370) (e6f699f)

Doc

• use Visual Studio 2026 in Windows setup instructions (#​3367) (20bd442)

Miscellaneous

• deps: upgrade tar to 7.5.7 to address CVE-2026-24842 (#​3375) (79048c9)
• use Visual Studio 2026 on windows-11-arm (#​3380) (6feed93)

v13.0.2

Compare Source

Bug Fixes

• ci: add zizmor security linter for github actions (#​3358) (8466166)
• ci: do not ruff format gyp example code in markdown (#​3357) (4a74fbe)
• fall back gracefully when build symlink creation fails (#​3339) (eae161f)

Core

• deps: bump actions/checkout from 6 to 7 (#​3335) (353050b)
• deps: bump actions/setup-node from 6 to 7 (#​3348) (005a7c5)
• deps: bump actions/setup-python from 6 to 7 (#​3349) (42367da)
• deps: bump astral-sh/ruff-action from 4.0.0 to 4.1.0 (#​3342) (ef586e1)

Tests

• fix undici 8.7.0 compatibility (#​3345) (a2f8b6a)
• log MSBuild output on Windows build failures (#​3328) (3c38cec)

v13.0.1

Compare Source

Core

• deps: bump undici from 6.26.0 to 8.4.1 (#​3330) (2c95a19)

Miscellaneous

• fix windows vs2026 version (#​3338) (5a835ea)

v13.0.0

Compare Source

⚠ BREAKING CHANGES

• node-gyp now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• bump to new node engine range (b792b8e)

Bug Fixes

• ci: update ruff-action version to v4.0.0 (#​3324) (f089669)
• disable LTO for addon builds on Windows (#​3331) (d30bb6e)

Core

• deps: bump actions/github-script from 8 to 9 (#​3297) (f6a5e45)
• deps: bump googleapis/release-please-action from 4 to 5 (#​3307) (b2cde80)
• nopt@​10.0.0 (327424a)
• proc-log@​7.0.0 (f6c296b)
• which@​7.0.0 (11a8b10)

Miscellaneous

• add commit-lint (#​3325) (6fb6c11)

v12.4.0

Compare Source

Features

• update gyp-next to v0.22.2 (#​3316) (8ea71e5)

Bug Fixes

• retry downloads on retryable errors (#​3308) (0793489)
• stop testing end-of-life Node.js v20 (#​3315) (5c0ec47)
• test on Node.js v26 (#​3314) (0e65639)

Miscellaneous

• add workflow_dispatch trigger to tests workflow (#​3299) (b2fcdcd)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fossabot]

[fossabot]

Needs Review

I recommend reviewing this upgrade before merging because it introduces a hard runtime incompatibility: node-gyp now requires Node ^22.22.2 || ^24.15.0 || >=26.0.0, but the project's package.json declares engines.node: >=20, meaning any developer or CI environment running Node 20 will encounter an engine constraint failure. This is the most critical blocker and requires explicitly raising the project's engines.node minimum and updating all CI, Docker, and local development environments to Node 22 LTS or higher. A changelog-confirmed breaking change also removes support for the python npm config setting — while no .npmrc file using this setting was found in the repository, any developer who set this via their global npm config to point Python at a custom path will see breakage. On the positive side, this upgrade resolves a high-severity vulnerability in node-gyp's bundled tar dependency, delivers 12 new features and 6 bug fixes, adds retry logic for failed downloads, replaces deprecated APIs, and adds Visual Studio 2026 support for native module compilation.

Tip: Comment @​fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 4 fixable issues in this upgrade.

• Update engines.node in package.json from '>=20' to '>=22.22.2' to match node-gyp 13.0.0's engine requirement of '^22.22.2 || ^24.15.0 || >=26.0.0'. This is a breaking change for the project — all CI environments, Docker images, and developer machines must be updated to Node 22.22.2+ before or alongside this change. Verify that all other dependencies are compatible with dropping Node 20 support.
  Files: package.json
• Update all CI workflow files and Dockerfiles to use Node 22 LTS (>=22.22.2) instead of Node 20. Search for any references to 'node-version: 20' or 'NODE_VERSION: 20' or 'node:20' in .github/workflows/ and Dockerfile* and update them accordingly. This must be done after the decision to raise the minimum Node version.
  Files: .github/workflows/
• Search for any .npmrc files or npm config references to 'python=' setting in the repository. Run: grep -r 'python=' .npmrc .github/ Dockerfile* || echo 'No python config found'. If found, remove the 'python' config line — node-gyp 13.0.0 no longer supports the 'python' npm config setting. The replacement is to set the PYTHON environment variable or use the --python command-line flag instead.
  Run: grep -rn 'python=' .npmrc .github/ Dockerfile* 2>/dev/null || echo 'No python npm config setting found in repository'
  Files: .npmrc
• Verify whether node-gyp is actually needed as a direct devDependency. Search for direct invocations: grep -rn 'node-gyp' package.json scripts/ Makefile* binding.gyp *.gyp 2>/dev/null. The impact analysis notes that @​abandonware/bluetooth-hci-socket bundles its own node-gyp 10.3.1. If the top-level node-gyp is not directly invoked in any build script or binding.gyp file at the project root, it may be removable as a direct devDependency (npm will use the bundled version for native addon compilation).
  Run: grep -rn 'node-gyp\|binding\.gyp' package.json Makefile* *.gyp scripts/ 2>/dev/null; find . -maxdepth 1 -name 'binding.gyp' 2>/dev/null || echo 'No direct node-gyp usage found at project root'
  Files: package.json

AI Assistant Prompt

Copy prompt for AI assistant

# Fix Dependency Upgrade Issues: node-gyp 13.0.0 (PR #176)

This PR upgrades `node-gyp` to 13.0.0 in the `minidrone-js` repository. The upgrade includes security fixes (high-severity `tar` vulnerability), 12 new features, and 6 bug fixes — but it introduces **2 breaking changes** that need to be addressed.

## Context
- **node-gyp 13.0.0** now requires Node `^22.22.2 || ^24.15.0 || >=26.0.0`
- The project currently declares `engines.node: >=20` in `package.json`
- The `python` npm config setting is no longer supported (replaced by `PYTHON` env var or `--python` CLI flag)
- The sub-dependency `@​abandonware/bluetooth-hci-socket` bundles its own `node-gyp@​10.3.1`

---

## Task 1: Determine if node-gyp is actually needed as a direct devDependency

Before making any other changes, check whether `node-gyp` is directly used:

1. Search for direct invocations:
   ```
   grep -rn 'node-gyp' package.json
   ```
   Check the `scripts` section of `package.json` for any `node-gyp` commands.

2. Check for native addon build files:
   ```
   ls binding.gyp *.gyp 2>/dev/null
   ```

3. Check Makefile or other build configs:
   ```
   grep -rn 'node-gyp' Makefile* scripts/ 2>/dev/null
   ```

**If node-gyp is NOT directly invoked** (no `binding.gyp` at project root, no npm scripts calling it), it may be removable as a direct devDependency since `@​abandonware/bluetooth-hci-socket` bundles its own copy. In that case, consider removing it from `devDependencies` in `package.json` and skip the remaining tasks.

**If node-gyp IS directly needed**, proceed with the fixes below.

---

## Task 2: Update `engines.node` in `package.json`

**File:** `package.json`

Change the `engines.node` field from `>=20` to `>=22.22.2` to match node-gyp 13.0.0's minimum requirement.

```json
"engines": {
  "node": ">=22.22.2"
}
```

⚠️ This is a breaking change for the project — it drops Node 20 support.

---

## Task 3: Update CI workflows to use Node 22 LTS

**Files:** `.github/workflows/` (all workflow YAML files)

Search for and update any Node version references:
- `node-version: 20` → `node-version: 22`
- `node-version: '20'` → `node-version: '22'`
- `NODE_VERSION: 20` → `NODE_VERSION: 22`

Also check for Node version matrices and update them to only include supported versions (`22`, `24`, etc.).

Run this to find all references:
```
grep -rn 'node.*20\|NODE.*20' .github/workflows/
```

---

## Task 4: Update Dockerfiles (if any)

Search for and update any Docker Node image references:
```
grep -rn 'node:20' Dockerfile*
```

Change `node:20` images to `node:22` (e.g., `node:22-slim`, `node:22-alpine`).

---

## Task 5: Check for `python` npm config usage

The `python` npm config setting was removed in node-gyp 13.0.0.

Search the repo:
```
grep -r 'python=' .npmrc .github/ Dockerfile* 2>/dev/null
```

If any `python=` config is found in `.npmrc` files, remove it and replace with either:
- Setting the `PYTHON` environment variable, or
- Using the `--python` command-line flag

---

## Summary of Changes Needed
| File | Change |
|------|--------|
| `package.json` | Update `engines.node` to `>=22.22.2`; possibly remove `node-gyp` from devDependencies if unused |
| `.github/workflows/*.yml` | Update Node version from 20 to 22 |
| `Dockerfile*` (if exists) | Update Node base image to 22 |
| `.npmrc` (if exists) | Remove `python=` config if present |

Please make these changes and show me the diffs.

What we checked

• Project declares engines.node: >=20, which conflicts with node-gyp 13.0.0's requirement of ^22.22.2 || ^24.15.0 || >=26.0.0. Any environment running Node 20 will fail engine constraint checks. Fix: update this to >=22.22.2 (or a more precise range) and realign all CI/Docker environments. ^[1]
• node-gyp is declared as a devDependency at ^13.0.0. It is used indirectly to compile native addons — notably @​abandonware/bluetooth-hci-socket (a transitive dep via @​abandonware/noble) which is a native module requiring a C++ build step. ^[2]
• Lockfile confirms node-gyp 13.0.0 is resolved at the top-level node_modules/node-gyp. A separate older node-gyp 10.3.1 is also present as a pinned dep of @​abandonware/bluetooth-hci-socket at line 73, meaning native addon compilation for that sub-package uses the older version — reducing (but not eliminating) the engine constraint impact for native builds. ^[3]
• Official release notes confirm the primary breaking change in this upgrade: the Node.js engine range is narrowed to ^22.22.2 || ^24.15.0 || >=26.0.0, dropping Node 18 and Node 20 (both still LTS at the time of this analysis). This is a hard compatibility break for any developer on Node 20. ^[4]
• CHANGELOG confirms python is no longer a valid npm config setting as of this upgrade (introduced in the 12.1.0–12.2.0 range). Core transitive dependencies were also bumped: nopt@​10.0.0, proc-log@​7.0.0, and which@​7.0.0. Projects pinning any of these at older versions may see resolution conflicts. ^[5]
• This upgrade disables Link-Time Optimization (LTO) for native addon builds on Windows. While introduced to fix a build failure, teams depending on LTO-optimized Windows native addon performance should evaluate whether this affects their runtime characteristics. ^[6]

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

Changes

This update affects 1 dependency. ⚠️ Contains 2 breaking changes and 3 security fixes that require attention.

• python is no longer a valid npm config setting (#3258) (c7c678f) (v12.1.0-12.2.0, changelog)
• Node.js version requirement changed from ^20.17.0 || >=22.9.0 to ^22.22.2 || ^24.15.0 || >=26.0.0. Versions below 22.22.2 are no longer supported. (v13.0.0, package source)
• deps: upgrade tar to 7.5.4 to address [REDACTED-CVE] (#3271) (7bf371c) (v12.1.0-12.2.0, changelog)

View 112 more changes

• correct typos (#3269) (0f2bc7d) (v12.1.0-12.2.0, changelog)
• Switch to URL instead of url.resolve (#3256) (#3263) (46d7576) (v12.2.0-12.3.0, changelog)
• add workflow_dispatch trigger to tests workflow (#3299) (b2fcdcd) (v12.3.0-12.4.0, changelog)
• remove obsolete Microsoft Node.js Guidelines link (#3268) (30cda26) (v12.1.0-12.2.0, changelog)
• Add support for Visual Studio 2026 (18.x) (69e5fd2) (v12.0.0-12.1.0, changelog)
• add a note about changes in gyp folder (#3259) (a52bc81) (v12.1.0-12.2.0, changelog)
• improve Add-Type with -IgnoreWarnings (#3280) (1381458) (v12.2.0-12.3.0, changelog)
• bump to new node engine range (b792b8e) (v12.4.0-13.0.0, changelog)
• disable LTO for addon builds on Windows (#3331) (d30bb6e) (v12.4.0-13.0.0, changelog)
• add commit-lint (#3325) (6fb6c11) (v12.4.0-13.0.0, changelog)
• Support for Visual Studio 2026 (18.x) (69e5fd2) (v12.0.0-12.1.0, changelog)
• include built package version in error logs (#3254) (ee9cbdd) (v12.1.0-12.2.0, changelog)
• update gyp-next to v0.21.1 (#3273) (888ff2c) (v12.1.0-12.2.0, changelog)
• cpu concurrency detection on some platforms (#3255) (f15b79a), closes #3191 (v12.1.0-12.2.0, changelog)
• Switch to URL instead of url.parse (#3256) (3f81949) (v12.1.0-12.2.0, changelog)
• Test Windows on Python 3.14, not 3.13 (#3262) (7b4f315) (v12.1.0-12.2.0, changelog)
• deps: bump actions/checkout from 5 to 6 (#3248) (db5385c) (v12.1.0-12.2.0, changelog)
• update Python manual install instructions for Windows (#3265) (0407877) (v12.1.0-12.2.0, changelog)
• python is no longer a valid npm config setting (#3258) (c7c678f) (v12.2.0, changelog)
• add a note about changes in gyp folder (#3259) (a52bc81) (v12.2.0, changelog)
• correct typos (#3269) (0f2bc7d) (v12.2.0, changelog)
• remove obsolete Microsoft Node.js Guidelines link (#3268) (30cda26) (v12.2.0, changelog)
• deps: upgrade tar to 7.5.4 to address [REDACTED-CVE] (#3271) (7bf371c) (v12.2.0, changelog)
• replace make-fetch-happen with built-in fetch (#3302) (393ec2b) (v12.2.0-12.3.0, changelog)
• update gyp-next to v0.22.1 (#3295) (f4242fb) (v12.2.0-12.3.0, changelog)
• deps-dev: bump neostandard from 0.12.2 to 0.13.0 (#3289) (19da158) (v12.2.0-12.3.0, changelog)
• Switch to URL instead of url.resolve (#3256) (#3263) (46d7576) (v12.3.0, changelog)
• improve Add-Type with -IgnoreWarnings (#3280) (1381458) (v12.3.0, changelog)
• update gyp-next to v0.22.2 (#3316) (8ea71e5) (v12.3.0-12.4.0, changelog)
• retry downloads on retryable errors (#3308) (0793489) (v12.3.0-12.4.0, changelog)
• stop testing end-of-life Node.js v20 (#3315) (5c0ec47) (v12.3.0-12.4.0, changelog)
• test on Node.js v26 (#3314) (0e65639) (v12.3.0-12.4.0, changelog)
• add workflow_dispatch trigger to tests workflow (#3299) (b2fcdcd) (v12.4.0, changelog)
• node-gyp now supports node ^22.22.2 || ^24.15.0 || >=26.0.0 (v12.4.0-13.0.0, changelog)
• ci: update ruff-action version to v4.0.0 (#3324) (f089669) (v12.4.0-13.0.0, changelog)
• deps: bump actions/github-script from 8 to 9 (#3297) (f6a5e45) (v12.4.0-13.0.0, changelog)
• deps: bump googleapis/release-please-action from 4 to 5 (#3307) (b2cde80) (v12.4.0-13.0.0, changelog)
• nopt@​10.0.0 (327424a) (v12.4.0-13.0.0, changelog)
• proc-log@​7.0.0 (f6c296b) (v12.4.0-13.0.0, changelog)
• which@​7.0.0 (11a8b10) (v12.4.0-13.0.0, changelog)
• bump to new node engine range (b792b8e) (v13.0.0, changelog)
• disable LTO for addon builds on Windows (#3331) (d30bb6e) (v13.0.0, changelog)
• add commit-lint (#3325) (6fb6c11) (v13.0.0, changelog)
• Correct typos in readme and documentation (v12.1.0-12.2.0, commit)
• Switch to URL instead of url.resolve (v12.2.0-12.3.0, commit)
• Add workflow_dispatch trigger to tests workflow (v12.3.0-12.4.0, commit)
• Remove obsolete Microsoft Node.js Guidelines link from readme (v12.1.0-12.2.0, commit)
• Add support for Visual Studio 2026 (18.x) (v12.0.0-12.1.0, commit)
• Add note about changes in gyp folder to documentation (v12.1.0-12.2.0, commit)
• Improve Add-Type with -IgnoreWarnings on Windows (v12.2.0-12.3.0, commit)
• Add support for Node.js 26 (v12.3.0-12.4.0, commit)
• Add commit-lint (v12.4.0-13.0.0, commit)
• Disable LTO for addon builds on Windows (v12.4.0-13.0.0, commit)
• Release version 12.1.0 (v12.0.0-12.1.0, commit)
• Revert dependency bump of env-paths from 2.2.1 to 3.0.0 (v12.0.0-12.1.0, commit)
• Release version 12.2.0 (v12.1.0-12.2.0, commit)
• Update gyp-next to v0.21.1 (v12.1.0-12.2.0, commit)
• Update Python manual install instructions for Windows in readme (v12.1.0-12.2.0, commit)
• Switch to URL instead of url.parse (v12.1.0-12.2.0, commit)
• Update Windows test configuration to use Python 3.14 instead of 3.13 (v12.1.0-12.2.0, commit)
• Remove python as a valid npm config setting (v12.1.0-12.2.0, commit)
• Include built package version in error logs (v12.1.0-12.2.0, commit)
• Bump actions/checkout from 5 to 6 (v12.1.0-12.2.0, commit)
• Update gyp-next to v0.22.1 (v12.2.0-12.3.0, commit)
• Replace make-fetch-happen with built-in fetch (v12.2.0-12.3.0, commit)
• Bump neostandard from 0.12.2 to 0.13.0 (v12.2.0-12.3.0, commit)
• Update gyp-next to v0.22.2 (v12.3.0-12.4.0, commit)
• Stop testing end-of-life Node.js v20 (v12.3.0-12.4.0, commit)
• Retry downloads on retryable errors (v12.3.0-12.4.0, commit)
• Release version 13.0.0 (v12.4.0-13.0.0, commit)
• Update ruff-action to v4.0.0 (v12.4.0-13.0.0, commit)
• Upgrade which to v7.0.0 (v12.4.0-13.0.0, commit)
• Upgrade proc-log to v7.0.0 (v12.4.0-13.0.0, commit)
• Upgrade nopt to v10.0.0 (v12.4.0-13.0.0, commit)
• Bump Node engine range (v12.4.0-13.0.0, commit)
• Upgrade googleapis/release-please-action from v4 to v5 (v12.4.0-13.0.0, commit)
• Upgrade actions/github-script from v8 to v9 (v12.4.0-13.0.0, commit)
• Upgraded tar dependency to 7.5.4 to address [REDACTED-CVE] (v12.2.0, package source)
• Replaced deprecated hash algorithms (MD5/SHA-1) with SHA-256 in gyp build generators for improved cryptographic security (v12.2.0, package source)
• Fixed CPU concurrency detection on some platforms (v12.2.0, package source)
• Fixed handling of python npm config setting which is no longer valid in recent npm versions (v12.2.0, package source)
• Replaced deprecated url.parse with URL constructor for improved standards compliance (v12.2.0, package source)
• Switch to built-in URL class instead of deprecated url.resolve for better URL handling (#3256, #3263) (v12.3.0, package source)
• Improve PowerShell Add-Type command with -IgnoreWarnings flag to reduce noise in build output on Windows (#3280) (v12.3.0, package source)
• Retry downloads on retryable errors - Added RetryAgent wrapper with maxRetries: 3 to automatically retry failed downloads in download.js (v12.4.0, package source)
• Disable LTO (Link Time Optimization) for addon builds on Windows to resolve build issues (v13.0.0, package source)
• Update CI: update ruff-action version to v4.0.0 (v13.0.0, package source)
• Added support for Visual Studio 2026 (18.x) for native module compilation (v12.1.0, package source)
• Include built package version (npm_package_name and npm_package_version) in error logs to provide better diagnostic context (v12.2.0, package source)
• Replace make-fetch-happen with built-in fetch implementation for HTTP requests - improves performance and reduces dependencies (#3302) (v12.3.0, package source)
• Update gyp-next to v0.22.1 with ARM64 (Windows on ARM) architecture support for MSVC builds (#3295) (v12.3.0, package source)
• Updated gyp-next to v0.22.2 for improved build system support (v12.4.0, package source)
• Downgraded env-paths dependency from ^3.0.0 to ^2.2.0 for compatibility (v12.1.0, package source)
• Fixed env-paths import pattern in bin/node-gyp.js from destructured default export to direct module export (v12.1.0, package source)
• Updated gyp-next dependency to v0.21.1 (v12.2.0, package source)
• Updated CONTRIBUTING.md with guidelines about changes to gyp folder being automatically synced from gyp-next repository (v12.2.0, package source)
• Updated Python installation instructions for Windows to reference official Python documentation (v12.2.0, package source)

View 15 more changes in the full analysis

References (6)

[1]: Project declares engines.node: >=20, which conflicts with node-gyp 13.0.0's requirement of ^22.22.2 || ^24.15.0 || >=26.0.0. Any environment running Node 20 will fail engine constraint checks. Fix: update this to >=22.22.2 (or a more precise range) and realign all CI/Docker environments.

minidrone-js/package.json

Line 11 in 13a5066

"node": ">=20"

[2]: node-gyp is declared as a devDependency at ^13.0.0. It is used indirectly to compile native addons — notably @​abandonware/bluetooth-hci-socket (a transitive dep via @​abandonware/noble) which is a native module requiring a C++ build step.

minidrone-js/package.json

Line 36 in 13a5066

"node-gyp": "^13.0.0",

[3]: Lockfile confirms node-gyp 13.0.0 is resolved at the top-level node_modules/node-gyp. A separate older node-gyp 10.3.1 is also present as a pinned dep of @​abandonware/bluetooth-hci-socket at line 73, meaning native addon compilation for that sub-package uses the older version — reducing (but not eliminating) the engine constraint impact for native builds.

minidrone-js/package-lock.json

Line 2328 in 13a5066

"node_modules/node-gyp": {

[4]: Official release notes confirm the primary breaking change in this upgrade: the Node.js engine range is narrowed to ^22.22.2 || ^24.15.0 || >=26.0.0, dropping Node 18 and Node 20 (both still LTS at the time of this analysis). This is a hard compatibility break for any developer on Node 20. (source link)

[5]: CHANGELOG confirms python is no longer a valid npm config setting as of this upgrade (introduced in the 12.1.0–12.2.0 range). Core transitive dependencies were also bumped: nopt@​10.0.0, proc-log@​7.0.0, and which@​7.0.0. Projects pinning any of these at older versions may see resolution conflicts. (source link)

[6]: This upgrade disables Link-Time Optimization (LTO) for native addon builds on Windows. While introduced to fix a build failure, teams depending on LTO-optimized Windows native addon performance should evaluate whether this affects their runtime characteristics. (source link)

---

fossabot analyzed this PR using dependency research. View this analysis on the web