[Alex Olea (linuxoptics)]

Summary

Hold newly published dependency versions for 2 days before npm will resolve them, and make the repository's Node pin match what CI actually runs.

Description

• Add min-release-age=2 to .npmrc. npm then resolves only versions that have been published for at least 2 days, which gives the ecosystem time to detect and pull a compromised release before it reaches a development machine. The setting needs npm 11.10 or newer; older npm ignores it.
• Change .nvmrc from v18 to v26.13.0. It had not changed since 2023, and every workflow already runs Node 26 (node-version: '26'), which bundles npm 11. A full version is used because a floating major cannot tell tooling which npm it brings.
• Add --min-release-age=2 to every npm install -g npm@latest step in the workflows (7 of them). npm install -g ignores the project .npmrc, which I checked: with a 100-year hold in .npmrc, npm install -g npm@latest still installed the newest npm. These steps are the only places in the workflows that resolve a fresh version, because npm ci installs exactly what package-lock.json pins. The flag lets them take the newest npm that is at least 2 days old.
• Update the Node row in CONTRIBUTING.md, which said CI runs Node 24.
• engines (node: ">=18") is unchanged, so nothing changes for consumers of the package, and the build output is not affected.

I did not touch test/output-integration/*. Those two sub-projects install with npm ci from their own lockfiles, so the setting would have no effect there.

Motivation and Context

Newly published versions of popular packages are sometimes malicious and are usually found and removed within hours or days. Holding new releases for a short time avoids most of that exposure at little cost. The workflows' unpinned npm install -g npm@latest was the one step that still took a brand-new version with no delay.

How it was tested

On Node 26.13.0 (bundled npm 11.20.0), from a clean install: the global install with the new flag, npm ci, npm run build, npm run lint, npm run prettier:check, npm run test:unit, npm run test:types and npm run test:integration all pass. With a 2-day hold, npm install -g npm@latest --min-release-age=2 picked npm 12.2.2, which was published 7 days earlier. The workflow files parse; this PR's own checks are the first run of the edited steps.

PR Checklist

• I have read the CONTRIBUTING.md file
• All commits follow conventional commits
• Documentation is updated (if necessary)
• PR doesn't contain any sensitive information
• There are no breaking changes

Summary by Bito

This PR adds a delay before npm resolves newly published versions, including during CI's global npm installation steps. It also aligns the repository's Node.js version pin and contributor documentation with the Node 26 version used in CI.

Detailed Changes

• Adds a two-day release-age limit in .npmrc and passes the equivalent flag to global npm installations in build.yaml, check.yaml, and release.yaml, covering installs that do not use the project configuration.
• Changes .nvmrc from a floating Node 18 version to the explicit 26.13.0 pin; the contributor guidance continues to state that local development supports Node 18+.
• Updates CONTRIBUTING.md to document that CI runs Node 26 and that .nvmrc pins version 26.13.0.

[bito-code-review]

Interaction Diagram by Bito

sequenceDiagram
participant Dev as Developer
participant CI as CI Workflow
participant Build as Build Workflow<br/>🔄 Updated | ●●○ Medium
participant Checks as Check Workflow<br/>🔄 Updated | ●●○ Medium
participant Release as Release Workflow<br/>🔄 Updated | ●●○ Medium
participant Npm as npm CLI
participant Config as .npmrc<br/>🟩 Added | ●●○ Medium
participant Registry as npm Registry
Dev->>CI: Push change or open pull request
CI->>Build: Run build workflow
Build->>Npm: Install npm@latest with a 2-day release-age floor
Npm->>Config: Read project minimum release age
Npm->>Registry: Resolve eligible npm version
Registry-->>Npm: Return eligible package version
Build->>Npm: Run npm ci for project dependencies
Npm->>Registry: Fetch eligible project dependencies
Registry-->>Npm: Return dependency packages
Npm-->>Build: Complete dependency installation
Build-->>CI: Return build result
CI->>Checks: Run check workflow after build
Checks->>Npm: Install latest npm and install dependencies
Npm->>Registry: Resolve eligible npm and project packages
Registry-->>Npm: Return eligible packages
Npm-->>Checks: Provide installed tools for checks
alt Push to master or next
CI->>Release: Run release workflow
Release->>Npm: Install npm and project dependencies using age policy
else Other event or branch
CI-->>Dev: Skip release workflow
  end

Loading

---

Critical path: Developer ->CI Workflow ->Build Workflow (MODIFIED) ->npm CLI ->npm Registry

Note: This MR updates the CI build, check, and release workflows with a two-day minimum release age for npm installation, adds the project npm configuration policy, and pins local Node.js to 26.13.0 with updated contributor guidance. CI orchestration applies that policy when the npm CLI integrates with the npm registry; the change affects dependency resolution rather than the SDK runtime or published API. Cross-repository dependency analysis was unavailable, so organization-wide consumer impact could not be verified.

If the interaction diagram doesn't appear, refresh the page to render it.

You can disable interaction diagrams by customizing agent settings. Refer to documentation.

[bito-code-review]

Changelist by Bito

This pull request implements the following key changes.

Key Change	Files Impacted	Summary
Other Improvements - Delay installation of newly published npm versions	.npmrc, build.yaml, check.yaml, release.yaml	Adds a two-day minimum release age for npm dependency resolution and applies the same delay to global installs of the latest npm in the build, check, and release workflows.
Other Improvements - Align the local Node.js pin and contributor guidance with CI	.nvmrc, CONTRIBUTING.md	Pins the repository's Node.js version to 26.13.0 and updates contributor guidance to state that CI runs Node 26 while local development supports Node 18+.

[bito-code-review]

Code Review Agent Run #ef22e0

Actionable Suggestions - 2

• .nvmrc - 1

  • Node version sources can drift · Line 1-1
• CONTRIBUTING.md - 1

  • Docs omit npm requirement · Line 49-49

Review Details

• Files reviewed - 6 · Commit Range: cb7d7a8..cb7d7a8

  • .github/workflows/build.yaml
  • .github/workflows/check.yaml
  • .github/workflows/release.yaml
  • .npmrc
  • .nvmrc
  • CONTRIBUTING.md
• Files skipped - 0
• Tools

  • Copy/Paste Detector (Copy/Paste Detector) - ✔︎ Successful
  • Secret Scanner (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers an incremental AI Review.

• /review full - Manually triggers a full AI Review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[bito-code-review]

Docs omit npm requirement

This row now documents Node 26 for CI, but the PR's new .npmrc min-release-age=2 is silently ignored by npm < 11.10.0 — which is what Node 18 (still advertised here as "local dev works on 18+") bundles. A contributor on 18 gets no release-age protection. Please note the npm >= 11.10.0 requirement and align the npm row with the workflows' --min-release-age=2.

Suggested based on your custom review guideline "Repo Truth And Alignment"

Code Review Run #ef22e0

---

Should Bito avoid suggestions like this for future reviews? (Manage Rules)

• Yes, avoid them

[bito-code-review]

✅ Review Settings Overridden

Status: Overridden Successfully

Accepted settings

• exclude_draft_pr
• exclude_files
• linters_feedback
• post_changelist
• post_description
• repo_level_guidelines_enabled
• secret_scanner_feedback
• sequence_diagram_enabled
• suggestion_mode

Custom guidelines
General:

• Review Posture
• Repo Truth And Alignment
• Domain Invariants

Only the first 3 general and 1 per-language guideline are processed, and guidelines are read from the source branch.