From e424b91040f28b104da54266d9a1c0d3a4ebdd55 Mon Sep 17 00:00:00 2001
From: Laith Al-Saadoon <9553966+theagenticguy@users.noreply.github.com>
Date: Thu, 28 May 2026 23:05:26 -0500
Subject: [PATCH] =?UTF-8?q?fix(deps):=20downgrade=20write-file-atomic=208.?=
 =?UTF-8?q?0.0=E2=86=927.0.1=20to=20match=20supported=20node=20range?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

write-file-atomic@8.0.0 requires node ^22.22.2 || ^24.15.0 || >=26.0.0, which
excludes node 20 and node 22.0-22.22.1 — contradicting the repo's declared
engines (root >=22.0.0, cli >=20.0.0) and the Verify Global Install matrix
(node 20/22/24). With engineStrict: true this surfaces as EBADENGINE on
npm install -g and a hard failure on the node-20 leg.

7.0.1 supports ^20.17.0 || >=22.9.0, covering the full matrix. API usage
(wfa(path, content), {raw:true}) is unchanged since v4; @types/write-file-atomic@4.0.3
still applies. write-file-atomic became 8.0.0 via Dependabot consolidation #91,
not a deliberate security bump; no advisories on the package.

Pinned in cli, analysis, ingestion, wiki.
---
 packages/analysis/package.json  |  2 +-
 packages/cli/package.json       |  2 +-
 packages/ingestion/package.json |  2 +-
 packages/wiki/package.json      |  2 +-
 pnpm-lock.yaml                  | 26 +++++++++++++-------------
 5 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/packages/analysis/package.json b/packages/analysis/package.json
index e4174be..1a2aade 100644
--- a/packages/analysis/package.json
+++ b/packages/analysis/package.json
@@ -42,7 +42,7 @@
     "@opencodehub/sarif": "workspace:*",
     "@opencodehub/storage": "workspace:*",
     "@opencodehub/wiki": "workspace:*",
-    "write-file-atomic": "8.0.0"
+    "write-file-atomic": "7.0.1"
   },
   "devDependencies": {
     "@types/node": "25.9.1",
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 4c4fad0..026aed6 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -53,7 +53,7 @@
     "commander": "14.0.3",
     "envinfo": "7.21.0",
     "listr2": "10.2.1",
-    "write-file-atomic": "8.0.0",
+    "write-file-atomic": "7.0.1",
     "yaml": "2.9.0"
   },
   "devDependencies": {
diff --git a/packages/ingestion/package.json b/packages/ingestion/package.json
index 51fed06..6441218 100644
--- a/packages/ingestion/package.json
+++ b/packages/ingestion/package.json
@@ -58,7 +58,7 @@
     "snyk-nodejs-lockfile-parser": "2.7.1",
     "spdx-correct": "^3.2.0",
     "web-tree-sitter": "0.26.9",
-    "write-file-atomic": "8.0.0"
+    "write-file-atomic": "7.0.1"
   },
   "devDependencies": {
     "@types/node": "25.9.1",
diff --git a/packages/wiki/package.json b/packages/wiki/package.json
index 4d5aca4..cf9c9e1 100644
--- a/packages/wiki/package.json
+++ b/packages/wiki/package.json
@@ -41,7 +41,7 @@
     "@opencodehub/core-types": "workspace:*",
     "@opencodehub/storage": "workspace:*",
     "@opencodehub/summarizer": "workspace:*",
-    "write-file-atomic": "8.0.0"
+    "write-file-atomic": "7.0.1"
   },
   "devDependencies": {
     "@types/node": "25.9.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b8e0c14..9deafd4 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -78,8 +78,8 @@ importers:
         specifier: workspace:*
         version: link:../wiki
       write-file-atomic:
-        specifier: 8.0.0
-        version: 8.0.0
+        specifier: 7.0.1
+        version: 7.0.1
     devDependencies:
       '@types/node':
         specifier: 25.9.1
@@ -145,8 +145,8 @@ importers:
         specifier: 10.2.1
         version: 10.2.1
       write-file-atomic:
-        specifier: 8.0.0
-        version: 8.0.0
+        specifier: 7.0.1
+        version: 7.0.1
       yaml:
         specifier: 2.9.0
         version: 2.9.0
@@ -318,8 +318,8 @@ importers:
         specifier: 0.26.9
         version: 0.26.9
       write-file-atomic:
-        specifier: 8.0.0
-        version: 8.0.0
+        specifier: 7.0.1
+        version: 7.0.1
     devDependencies:
       '@types/node':
         specifier: 25.9.1
@@ -551,8 +551,8 @@ importers:
         specifier: workspace:*
         version: link:../summarizer
       write-file-atomic:
-        specifier: 8.0.0
-        version: 8.0.0
+        specifier: 7.0.1
+        version: 7.0.1
     devDependencies:
       '@types/node':
         specifier: 25.9.1
@@ -5800,9 +5800,9 @@ packages:
   wrappy@1.0.2:
     resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
 
-  write-file-atomic@8.0.0:
-    resolution: {integrity: sha512-dYwyZredl67GyLLIHJnRM3h2PcOmN5SkcgC7eM5DPDEOEl6dLFqVrMg3F1Ea32usj4VSVZtd2H4MtKTNOf6nPg==}
-    engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0}
+  write-file-atomic@7.0.1:
+    resolution: {integrity: sha512-OTIk8iR8/aCRWBqvxrzxR0hgxWpnYBblY1S5hDWBQfk/VFmJwzmJgQFN3WsoUKHISv2eAwe+PpbUzyL1CKTLXg==}
+    engines: {node: ^20.17.0 || >=22.9.0}
 
   xml-naming@0.1.0:
     resolution: {integrity: sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw==}
@@ -11872,7 +11872,7 @@ snapshots:
 
   wrappy@1.0.2: {}
 
-  write-file-atomic@8.0.0:
+  write-file-atomic@7.0.1:
     dependencies:
       signal-exit: 4.1.0
 
@@ -11976,6 +11976,6 @@ time:
   tsx@4.22.3: '2026-05-19T09:53:00.670Z'
   typescript@6.0.3: '2026-04-16T23:38:27.905Z'
   web-tree-sitter@0.26.9: '2026-05-19T18:12:46.154Z'
-  write-file-atomic@8.0.0: '2026-05-08T18:30:27.965Z'
+  write-file-atomic@7.0.1: '2026-02-26T21:57:55.279Z'
   yaml@2.9.0: '2026-05-11T10:16:24.045Z'
   zod@4.4.3: '2026-05-04T07:06:40.819Z'