From f4c02fe155fef7c6d20c4664ca703bde48b1d71c Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Thu, 10 Sep 2026 20:15:13 +1000 Subject: [PATCH 1/2] fix(bundle): declare Node >=20 and install the shipped lockfile with npm ci The release bundle's package.json declared engines.node ">=16" while CONTRIBUTING.md cites that field as evidence for a Node 20 floor; 20 is the honest number (.nvmrc pins 24, the root package.json requires 20, the rendering engine's floor is above 16). And template.yml ran `npm install` although the release asset ships a lockfile (release.yml generates it and `files` lists it), so consumer installs were neither reproducible nor lockfile-preserving. `npm ci` fails without a lockfile, but the only lockfile-less path is a source checkout, which is not a usable template until `make build-theme` has run, and that target installs on its own (#162). The report theme carries the same two lines; its copy of the engines floor was corrected in QuantEcon/quantecon-theme-report.mystmd#12 and the install decision is QuantEcon/quantecon-theme-report.mystmd#13. Co-Authored-By: Claude Fable 5.1 --- template.yml | 8 +++++++- template/package.json | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/template.yml b/template.yml index ec70ed932..eb160fa55 100644 --- a/template.yml +++ b/template.yml @@ -65,7 +65,13 @@ options: Accessible name and tooltip of the language switcher, in the edition's own language ("Switch language" when unset). build: - install: npm install + # `npm ci`, not `npm install`: the release asset ships a lockfile (release.yml + # generates it with `npm install --package-lock-only` and it is in `files` + # below), so consumer installs are reproducible and the lockfile is never + # mutated in place. `npm ci` fails without a lockfile, but the only + # lockfile-less path is a source checkout, which is not a usable template + # until `make build-theme` has run -- and that target installs its own. + install: npm ci start: npm run start files: - server.js diff --git a/template/package.json b/template/package.json index 1423d0266..f7125966c 100644 --- a/template/package.json +++ b/template/package.json @@ -17,6 +17,6 @@ "morgan": "^1.10.0" }, "engines": { - "node": ">=16" + "node": ">=20" } } From 872b7fc0e6bc7910431ff79424ec86ec0378bf78 Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Thu, 10 Sep 2026 20:23:52 +1000 Subject: [PATCH 2/2] docs(changelog): record the bundle-manifest change Copilot review on #191: CONTRIBUTING.md requires every consumer-facing change under Unreleased. Co-Authored-By: Claude Fable 5.1 --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7c5321de0..f313395dc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,6 +20,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Changed +- The release bundle's manifest now declares Node `>=20` (it said `>=16`, + contradicting CONTRIBUTING.md and every real floor in the repo) and installs + the shipped lockfile with `npm ci` instead of `npm install`, so consumer + installs from the release asset are reproducible and never mutate the + lockfile in place ([#162](https://github.com/QuantEcon/quantecon-theme.mystmd/issues/162)). + ## [2.6.1] - 2026-09-10 ### Fixed