Conversation
Contributor
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| }, | ||
| "engines": { | ||
| "node": ">= 20" | ||
| "node": ">= 10" |
Contributor
There was a problem hiding this comment.
Relaxing only the root package to Node 10 leaves every native artifact package at Node 20+, while the WASM artifact requires at least Node 20.19. Because these artifacts are optional dependencies of this package, Node 10–19 installations still receive incompatible-engine warnings or fail when strict engine checks are enabled. Update the artifact package manifests alongside the root manifest so the intended N-API 3 compatibility actually applies.
Knowledge Base Used: Oxide scanner and native bindings
Contributor
WalkthroughThe Priority: ⬇️ Low Merge Risk: 🟡 Moderate · up to The package advertises Node.js versions that may either fail installation or lack the required native API. Align all published engine ranges before merging. 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Advanced
Run ID: 024282b2-5053-4e09-adc4-c6d145722bf6
📒 Files selected for processing (1)
crates/node/package.json
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.
| }, | ||
| "engines": { | ||
| "node": ">= 20" | ||
| "node": ">= 10" |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
sed -n '35,90p' crates/node/package.json
find crates/node/npm -name package.json -maxdepth 3 -print -exec sed -n '1,40p' {} \;
rg -n 'optionalDependencies|oxide-|wasm32|require\(|engines' crates/nodeRepository: tailwindlabs/tailwindcss
Length of output: 14716
🌐 Web query:
npm engine-strict optionalDependencies incompatible engines behavior
💡 Result:
<search_synthesis>
When the engine-strict configuration flag is set to true, npm enforces engines compatibility for all dependencies, including optionalDependencies [1][2]. If a package's engines field is incompatible with the current environment (e.g., Node.js or npm version), the installation will fail with an EBADENGINE error [3][4]. Key behaviors regarding this interaction include: 1. Enforcement: By default, the engines field is advisory and only produces warnings [5][6]. Enabling engine-strict=true changes this behavior, causing npm to refuse to install any package that does not satisfy its declared engine requirements [1][2]. 2. Optional Dependencies: Because optionalDependencies are treated as standard dependencies during the resolution and installation phase, they are subject to the same engine-strict checks as required dependencies [3]. If an optional dependency is incompatible with your environment, engine-strict=true will cause the entire npm install process to fail, even though the dependency is technically "optional" [3]. 3. Overrides: The engine-strict enforcement can be bypassed by using the --force flag [1][2]. When --force is used, npm will allow the installation of packages even if they have incompatible engines declarations [1][2]. 4. Platform vs. Engine: Note that optionalDependencies also have separate mechanisms for platform compatibility (using os, cpu, and libc fields in package.json) [7][8]. These platform-specific checks are distinct from engines version checks and are handled differently by npm's installer [7]. In summary, while optionalDependencies are intended to be non-blocking for installation failures, the engine-strict flag overrides this by making engine compatibility a hard requirement for all packages in the dependency tree [3][1].
</search_synthesis>
<source_evidence>
Citations:
- 1: https://docs.npmjs.com/cli/v12/using-npm/config/
- 2: https://docs.npmjs.com/cli/v9/using-npm/config/
- 3: GitHub issue 6805 in npm/cli (link omitted to avoid creating a cross-reference)
- 4: https://github.com/shalvah/rfcs/blob/package-resolution-nodejs-version/accepted/000-package-resolution-nodejs-version.md
- 5: https://docs.npmjs.com/cli/v12/configuring-npm/package-json/
- 6: https://docs.npmjs.com/cli/v9/configuring-npm/package-json/?v=true
- 7: https://docs.npmjs.com/cli/v12/commands/npm-install/
- 8: GitHub issue 7601 in npm/cli (link omitted to avoid creating a cross-reference)
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- loader and adjacent files ---'
find crates/node -maxdepth 2 -type f \( -name 'index.js' -o -name '*.mjs' -o -name '*.cjs' -o -name 'package.json' \) -print
printf '%s\n' '--- crates/node/index.js ---'
cat -n crates/node/index.js
printf '%s\n' '--- package manifests: engines and platform selectors ---'
python3 - <<'PY'
import json
from pathlib import Path
for p in sorted(Path('crates/node/npm').glob('*/package.json')):
d=json.loads(p.read_text())
print(f"{p}: name={d.get('name')}; engines={d.get('engines')}; os={d.get('os')}; cpu={d.get('cpu')}; libc={d.get('libc')}; main={d.get('main')}")
PY
printf '%s\n' '--- loader references and fallback names ---'
rg -n --glob '!package-lock.json' --glob '!pnpm-lock.yaml' 'oxide-(android|darwin|freebsd|linux|wasm|win32)|require|try|catch|fallback|wasm' crates/node/index.js crates/node/*.js crates/node/*.mjs crates/node/*.cjs crates/node/package.jsonRepository: tailwindlabs/tailwindcss
Length of output: 342
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '--- tracked loader candidates ---'
git ls-files crates/node | rg '(^|/)(index\.(js|cjs|mjs)|package\.json|.*binding.*|.*loader.*|.*wasm.*)$' || true
printf '%s\n' '--- oxide package references outside generated artifacts ---'
rg -n --glob '!node_modules/**' --glob '!target/**' --glob '!dist/**' --glob '!build/**' 'oxide-(android|darwin|freebsd|linux|wasm|win32)|tailwindcss-oxide|wasm32-wasi' crates/node .github package.json pnpm-workspace.yaml 2>/dev/null || true
printf '%s\n' '--- node package tree ---'
git ls-files crates/node | sed -n '1,160p'Repository: tailwindlabs/tailwindcss
Length of output: 10737
Align every published optional package with the root Node.js support range.
The root package advertises Node.js >= 10, but the native platform packages require >= 20, and @tailwindcss/oxide-wasm32-wasi requires ^20.19.0 || ^22.13.0 || >=23.5.0. The WASI package is also an optional dependency without an os or cpu restriction. With engine-strict=true, npm can reject these incompatible optional packages with EBADENGINE before any loader fallback runs. If Node.js 10 remains supported, assign each native package its actual compatible minimum and gate or otherwise constrain the WASI package. Otherwise, raise the root package minimum to >= 20.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
sed -n '1,80p' crates/node/Cargo.toml
rg -n 'napi[0-9]|napi::|#[[:space:]]*\[napi|engines' crates/node --glob '!target/**'Repository: tailwindlabs/tailwindcss
Length of output: 2265
🌐 Web query:
Node.js official Node-API version matrix N-API 4 Node 10.16
💡 Result:
<search_synthesis>
According to the official Node.js Node-API version matrix, Node-API version 4 is supported in Node.js v10.16.0 and all later versions [1][2]. Node.js 10.16.0, which was an LTS release, explicitly introduced support for Node-API version 4 [3]. Node-API versions are additive, meaning that Node.js versions supporting a later Node-API version also support all previous versions [1][2].
</search_synthesis>
<source_evidence>
Citations:
- 1: https://nodejs.org/api/n-api.html
- 2: https://nodejs.org/docs/latest-v26.x/api/n-api.html
- 3: https://nodejs.org/en/blog/release/v10.16.0
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- crates/node/package.json ---'
sed -n '1,70p' crates/node/package.json
printf '%s\n' '--- crates/node/src/lib.rs (annotated) ---'
cat -n crates/node/src/lib.rs | sed -n '1,215p'
printf '%s\n' '--- engine declarations under crates/node ---'
rg -n -C 2 '"node"[[:space:]]*:' crates/node --glob 'package.json'
printf '%s\n' '--- dependency lock entries ---'
rg -n -A 12 -B 2 'name = "(napi|napi-derive|napi-build)"' Cargo.lock crates/node/Cargo.lock 2>/dev/null || trueRepository: tailwindlabs/tailwindcss
Length of output: 13217
🌐 Web query:
napi-rs 3.11.0 napi4 Cargo feature minimum Node-API version generated addon NAPI_VERSION
💡 Result:
<search_synthesis>
In napi-rs, the napi4 Cargo feature corresponds to Node-API version 4 [1][2]. This feature is the default in napi-rs and is required for core functionality including ThreadsafeFunction, deferred/async runtime integration, and cross-thread reference cleanup [1]. Key details regarding the napi4 feature and Node-API versions: 1. Cumulative Features: The napiN features in napi-rs are cumulative [1]. Enabling napi4 automatically enables napi3, napi2, and napi1 [1][2]. 2. Minimum Node-API Version: The selected napiN feature represents the minimum Node-API capability your addon relies on [1]. While napi-rs uses these features to gate specific APIs, the actual runtime compatibility depends on the Node.js version used by the end user [1][3]. 3. Default Status: napi4 is the default feature for napi-rs projects [1][4]. It is required for many common asynchronous operations, such as spawning futures or using tokio_rt [5][6]. 4. Project Configuration: When using the napi-rs CLI (napi new), the tool prompts for a minimum Node-API level, which it then writes to both the Cargo.toml (as a napiN feature) and the package.json (as an engines.node requirement) to ensure consistency [7][8]. While napi-rs provides these feature flags to manage compatibility, you should choose the lowest Node-API level that supports the APIs your addon requires, then test against the oldest Node.js runtime that supports that level [1][7]. Note that some advanced features or integrations may implicitly require a higher Node-API level than napi4 [8].
</search_synthesis>
<source_evidence>
Citations:
- 1: https://napi.rs/docs/concepts/cargo-features
- 2: https://github.com/napi-rs/napi-rs/blob/529a78d15c0c7d6ca6d4a732c5e335f9de701879/crates/napi/Cargo.toml
- 3: https://napi.rs/docs/introduction/getting-started
- 4: https://docs.rs/crate/napi/latest/features
- 5: https://napi.rs/docs/concepts/env
- 6: https://napi.rs/docs/concepts/promise
- 7: https://napi.rs/docs/more/support-compatibility
- 8: https://napi.rs/docs/cli/new
Set the Node.js engine floor to ">= 10.16.0". The napi4 feature requires Node-API 4, which Node.js provides from 10.16.0 onward. No inspected addon code or dependency selects a newer Node-API level, so ">= 20" is not required, and switching to napi3 is unnecessary.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
oxide uses N-API 3, supported since Node.js 10.
Closes #20491