Skip to content

Update: Node engine requirements bumped to >=18 and some optionalDependencies packages bumped for security patches #3713

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

cahirodoherty-learningpool
Copy link
Contributor

@cahirodoherty-learningpool cahirodoherty-learningpool commented Aug 13, 2025

Fixes #3712

Update

  • Node engine requirements bumped to >=18
  • optionalDependencies packages bumped for security patches

…pendencies packages bumped for security patches
Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates the Node.js engine requirement from >=16 to >=18 and bumps several optional imagemin dependencies to address security vulnerabilities. The changes also update the module import statements to use ES6 dynamic imports instead of CommonJS require statements.

  • Node.js engine requirement increased to >=18 (breaking change)
  • Updated four imagemin-related optional dependencies to newer major versions
  • Modified import statements to use ES6 dynamic imports for imagemin packages

Reviewed Changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File Description
package.json Updates Node.js engine requirement and bumps imagemin optional dependencies
grunt/tasks/compress.js Changes require statements to ES6 dynamic imports for imagemin modules

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

@cahirodoherty-learningpool
Copy link
Contributor Author

@oliverfoster The Breaking key word here will bump the package by a major version. This is the correct semantic approach in my opinion (as the underlying node engine requirement will potentially force client environment upgrades)
Previous references to "V6" will be outdated, but these seem to have stalled somewhat in any case. Any thought on this?

@oliverfoster
Copy link
Member

oliverfoster commented Aug 13, 2025

image

https://docs.npmjs.com/cli/v11/configuring-npm/package-json#engines

I don't think it is necessary, unless the user has engine-strict enabled.

(v6 as it was, the bower > npm stuff is progressing, albeit slowly)

@cahirodoherty-learningpool cahirodoherty-learningpool changed the title Breaking: Node engine requirements bumped to >=18 and some optionalDependencies packages bumped for security patches Update: Node engine requirements bumped to >=18 and some optionalDependencies packages bumped for security patches Aug 14, 2025
@cahirodoherty-learningpool cahirodoherty-learningpool moved this from New to Needs Reviewing in adapt_framework: The TODO Board Aug 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Needs Reviewing
Development

Successfully merging this pull request may close these issues.

Some package updates required to combat security vulnerabilities
4 participants