From 46b5b9699e72ba1c029bc0eabfb6aac126b91418 Mon Sep 17 00:00:00 2001
From: zaniebot <zaniebot@accounts.zanie.blue>
Date: Thu, 20 Aug 2026 10:36:55 -0500
Subject: [PATCH] Enforce the npm version floor with legacy clients (#411)

`devEngines` is ignored by npm releases such as `10.8.2`, so those
clients can install dependencies without applying the seven-day
`min-release-age` setting added in #401. Declare the same minimum in
`engines.npm` and enable `engine-strict` to make that legacy installer
requirement fatal. Keep `devEngines` for its earlier checks on newer npm
versions, and pin the build and checksum workflows to Node.js `24.19.0`
so their bundled `npm` supports the policy.

Related: astral-sh/setup-uv#1026 and astral-sh/ruff#27844 enforce the
same legacy-aware `npm` version floor. astral-sh/ruff-action#400 covers
Dependabot's update cooldown, and astral-sh/ruff-action#402 separately
verifies registry signatures and available provenance.

---------

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
---
 .npmrc            | 1 +
 .nvmrc            | 2 +-
 package-lock.json | 3 +++
 package.json      | 3 +++
 4 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/.npmrc b/.npmrc
index c2ec5e6..a22c5b4 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1,2 +1,3 @@
+engine-strict = true
 ignore-scripts = true
 min-release-age = 7
diff --git a/.nvmrc b/.nvmrc
index a45fd52..60ade1a 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-24
+24.19.0
diff --git a/package-lock.json b/package-lock.json
index d661a05..b1f989a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -31,6 +31,9 @@
         "js-yaml": "^4.1.1",
         "ts-jest": "^29.4.6",
         "typescript": "^5.9.3"
+      },
+      "engines": {
+        "npm": ">=11.10.0"
       }
     },
     "node_modules/@actions/core": {
diff --git a/package.json b/package.json
index 9acfbdc..025398d 100644
--- a/package.json
+++ b/package.json
@@ -5,6 +5,9 @@
   "type": "module",
   "description": "A GitHub Action to run Ruff, an extremely fast Python linter and code formatter.",
   "main": "dist/ruff-action/index.cjs",
+  "engines": {
+    "npm": ">=11.10.0"
+  },
   "devEngines": {
     "packageManager": {
       "name": "npm",