Package.json declares "node": ">=16.0.0", but the README states "Node 20+ (CI builds on Node 24)" and .node-version pins 24.13.1. This creates a version contract mismatch — developers may build with Node 16 locally and create binaries incompatible with CI/production (which runs on Node 24).
How to trigger
Running npm ci with Node 16 or 18 will succeed but may hide subtle runtime differences (e.g. in V8 built-in behavior, path resolution, or module loader quirks).
Suggested fix
Update package.json engines.node to ">=20.0.0" to match the README and reflect CI reality. Consider adding engine-strict=true to .npmrc to enforce the minimum during npm install.
Also add an .nvmrc mirroring .node-version (24.13.1) so nvm users auto-switch.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** medium · **Type:** tech-debt · **Confidence:** high
**Location:** `package.json:8`, `README.md:~156`, `.node-version:1`
### Problem
Package.json declares `"node": ">=16.0.0"`, but the README states "Node 20+ (CI builds on Node 24)" and `.node-version` pins 24.13.1. This creates a version contract mismatch — developers may build with Node 16 locally and create binaries incompatible with CI/production (which runs on Node 24).
### How to trigger
Running `npm ci` with Node 16 or 18 will succeed but may hide subtle runtime differences (e.g. in V8 built-in behavior, path resolution, or module loader quirks).
### Suggested fix
Update package.json `engines.node` to `">=20.0.0"` to match the README and reflect CI reality. Consider adding `engine-strict=true` to `.npmrc` to enforce the minimum during `npm install`.
Also add an `.nvmrc` mirroring `.node-version` (24.13.1) so nvm users auto-switch.
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:51:16 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: medium · Type: tech-debt · Confidence: high
Location:
package.json:8,README.md:~156,.node-version:1Problem
Package.json declares
"node": ">=16.0.0", but the README states "Node 20+ (CI builds on Node 24)" and.node-versionpins 24.13.1. This creates a version contract mismatch — developers may build with Node 16 locally and create binaries incompatible with CI/production (which runs on Node 24).How to trigger
Running
npm ciwith Node 16 or 18 will succeed but may hide subtle runtime differences (e.g. in V8 built-in behavior, path resolution, or module loader quirks).Suggested fix
Update package.json
engines.nodeto">=20.0.0"to match the README and reflect CI reality. Consider addingengine-strict=trueto.npmrcto enforce the minimum duringnpm install.Also add an
.nvmrcmirroring.node-version(24.13.1) so nvm users auto-switch.Filed from the September 2026 client audit (branch
lotus@4bea4895).