From 21c03e3efd855d1b3d20f876998a0f109f10fb6f Mon Sep 17 00:00:00 2001 From: Mitch Allen Date: Tue, 11 Aug 2026 06:58:30 -0400 Subject: [PATCH] Document the Node 26 LTS hold on the base-image bump Dependabot PR #71 bumps the Dockerfile base image from 24-alpine to 26-alpine. It is being left open and unmerged until Node 26 actually enters LTS on 2026-10-28. The existing "stay on LTS Node" note only described odd-numbered current releases (Node 25, declined in #60), which made an even major like 26 look like it qualified. Reword it to the real rule -- a major counts once it has entered LTS, not when it is merely released -- and point at nodejs/Release/schedule.json so the dates get checked rather than assumed. Also record that #71 is parked rather than stalled, and note parking-open as the alternative to closing for a version we do eventually want. Co-Authored-By: Claude Opus 5 (1M context) --- CLAUDE.md | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index fca6bd2..bc04f90 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -71,13 +71,26 @@ Run `gh issue list` for the current state. the problem: `swagger-jsdoc → glob: ^13.0.6` exists solely to silence a deprecation warning, and is safe because glob v13 still exports the `.sync` swagger-jsdoc calls and the `apis` entries are literal paths, not patterns. -- **Docker base image: stay on LTS Node.** Dependabot will propose odd-numbered - current releases (Node 25 was declined in #60); take a major only when the - next LTS ships. The `Dockerfile` pins the floating `24-alpine` tag, so - patch/minor Node updates already arrive at build time with no PR. +- **Docker base image: stay on LTS Node.** Take a major only once it has + actually *entered* LTS — not when it's merely released. Dependabot proposes + both odd-numbered current releases (Node 25, declined in #60) and even majors + that are still in their pre-LTS "Current" phase (Node 26 released 2026-05-05 + but isn't LTS until **2026-10-28**). The `Dockerfile` pins the floating + `24-alpine` tag, so patch/minor Node updates already arrive at build time with + no PR. Check the real dates against + rather than + assuming an even major is LTS. +- **PR #71 (`24-alpine` → `26-alpine`) is intentionally parked**, not stalled. + Leave it open and unmerged until 2026-10-28, then re-check CI and merge. Its + `test` and `docker` checks already pass, so the image does build on 26 — the + hold is purely about the LTS date. Node 24 is in active LTS until 2026-10-20 + and supported through 2028-04-30, so there's no urgency. - **Closing a Dependabot PR** stops it re-proposing *that* version but not future ones — it opens a fresh PR when a newer version appears. That's why - #60 was closed without an `ignore` rule: Node 26 LTS should still get a PR. + #60 was closed without an `ignore` rule, and it worked: Node 26 duly got its + own PR (#71). Parking a PR open, as with #71, is the alternative when the + version is one you *do* eventually want — it keeps the reminder visible + instead of waiting on Dependabot to re-propose. - **Keep install output warning-free.** A cold `npm ci` currently emits **zero** `npm warn deprecated` lines; keep it that way. Warnings that always appear and never matter train you to skip the output, so a real one gets missed. Fix the