fix(ci): pin Node to exact 24.16.0 to dodge node-fetch break#5
Merged
Conversation
Node's recent security release (in 24.17.0 and 22.23.0) surfaces a node-fetch@2 false-positive ERR_STREAM_PREMATURE_CLOSE, which breaks @changesets/get-github-info's GitHub API call during `changeset version`. A floating major pin does not help: .node-version "22" resolves to 22.23.0, which is broken — that's why #4 still failed. Pin an exact pre-regression patch instead. Verified in the actual runner with a matrix probe (8 GraphQL requests each): 24.17.0 -> 0/8, 22.23.0 -> 1/8 (broken); 24.16.0 -> 8/8, 24.13.0 -> 8/8, 22.20.0 -> 8/8 (good). Pin to 24.16.0, the newest pre-regression patch. Temporary until changesets moves off node-fetch@2. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Contributor
Preview releaseLatest commit: Some packages have been released:
Note Use the PR number as tag to install any package. For instance: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause (verified in the runner)
Node's recent security release — present in 24.17.0 and 22.23.0 — surfaces a long-standing
node-fetch@2defect that throws a false-positiveERR_STREAM_PREMATURE_CLOSEon keep-alive socket closures (nodejs/node#63989).@changesets/get-github-info(used bychangelog-github) still shipsnode-fetch@2, so its GitHub GraphQL call dies duringchangeset version→ the release fails.Pinning the major doesn't help:
.node-version: 22resolves to the latest22.x=22.23.0, which is broken — that's why #4 still failed.Evidence — matrix probe run in the actual GitHub runner
Each leg fired the same
node-fetch@2GraphQL request 8×:.node-version: 22resolved toThe pre-regression versions pass deterministically in the runner; the post-regression ones fail.
Fix
Pin to the exact
24.16.0(newest patch before the regression) in.node-versionandmise.toml.Follow-up
Temporary workaround. Once
changesetsmoves offnode-fetch@2(or if we switch to the basic@changesets/cli/changelog), the pin can return to a floating major.🤖 Generated with Claude Code