PFM-ISSUE-34453 - github-actions: correct the node-version claim (most branches are on npm 11) - #171
Open
Kaltenbach wants to merge 1 commit into
Open
Conversation
…st branches are on npm 11 Wording and documentation only; no predicate, exit code or control flow changes. bats 74/74, shellcheck clean. The previous correction (#164) said "runners pinned to node 18.19.1 are on npm 10" and "nothing fails in CI today". That generalised from release/25.2 - the branch checked out at the time - and from cplace-paw-fe, whose pipelines pin 25.2. Measured from the workflow files themselves: release/25.2 node 18.19.1 npm 10 release/25.3 25.4 26.1 26.2 26.3 master node 22.15.0 npm 11 So six of the seven branches were on the npm that drops the registry's path prefix, and un-normalized lockfiles there were failing - which is what design.md's Dimension 9 claimed in the first place. cplace-vwg-ptm-fe run 31167462200 is the report: E404 on update-browserslist-db, inside the composite's own npm ci, on node 22.15.0, against release/26.2. The advisory's job summary, the README, design.md and both overview editions now carry the per-branch table rather than a single sentence, so the fact cannot be generalised wrongly again. design.md keeps both corrections visible: the original claim, the over-correction, and this one. Verified after the rollout on the branches that run npm 11: cplace-paw-fe snapshot runs on release/25.4 (added 542 packages) and release/26.1 (added 558 packages), node 22.15.0, zero npm errors. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 14, 2026
Open
Open
Open
Open
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wording and documentation only — no predicate, exit code or control flow changed. bats 74/74, shellcheck clean.
What was wrong
#164 said "runners pinned to node 18.19.1 are on
npm 10" and "nothing fails in CI today". That generalised from
release/25.2— the branch checked out at the time— and from
cplace-paw-fe, whose pipelines pin25.2. Read from the workflow files themselves:release/25.2release/25.3,25.4,26.1,26.2,26.3,masterSix of seven branches were on the npm that drops the registry's path prefix, so un-normalized lockfiles there were
failing — which is what
design.md's Dimension 9 claimed before #164 over-corrected it. The report that started thisticket is the proof:
cplace-vwg-ptm-ferun 31167462200 failed with
E404 … update-browserslist-dbinside the composite's ownnpm ci, on node 22.15.0, againstrelease/26.2.What changes
The advisory's job summary,
README.md,design.mdand bothovervieweditions now carry the per-branch tableinstead of a single sentence, so the fact cannot be generalised wrongly a third time.
design.mdkeeps the wholetrail visible — the original claim, the over-correction, and this correction.
Verification
Post-rollout snapshot runs on the branches that actually run npm 11, no re-pinning:
release/25.4— run 31803700050, node 22.15.0,added 542 packages, 0 npm errorsrelease/26.1— run 31803711077, node 22.15.0,added 558 packages, 0 npm errorsReplicated to the other six branches in the same pass, so the byte-identity digest stays uniform.