remove node < 20.18 & remove npm < 8.7

.github/workflows/nodejs.yml

@@ -81,16 +81,14 @@ jobs:
         node-version:
           ## action based on https://github.com/actions/node-versions/releases
           ## see also: https://nodejs.org/en/about/releases/
-          - '22'      # Current
-          - '20'      # active LTS
-          - '18'
-          - '16'
-          - '14'
-          - '14.0.0'  # lowest supported
+          - '23'      # Current
+          - '22'      # active LTS
+          - '20'
+          - '20.18.0' # lowest supported
         os:
           - ubuntu-latest
           - windows-latest
-          - macos-13 # macos-latest has issues with node14
+          - macos-latest
     timeout-minutes: 15
     steps:
       - name: Checkout
@@ -108,28 +106,9 @@ jobs:
         shell: bash
         run: |
           set -ex
-          dep_constraints=''
-          dev_requirements='jest jest-junit imurmurhash fast-glob'
-          # as long as npm cannot auto-resolve engine-constraints, we need to help here
-          case '${{ matrix.node-version }}' in
-            '14')
-              dep_constraints='normalize-package-data@^5'
-              ;;
-            '14.0.0')
-              dep_constraints='normalize-package-data@^3'
-              dev_requirements='jest@^26 jest-junit imurmurhash fast-glob'
-              ;;
-          esac
-          ## !! dont install all the dev-packages, especially since some are not runnable on node 14.0.0
-          if [[ -n "$dep_constraints" ]]
-          then
-            npm add --ignore-scripts --omit=dev --only=prod --production --loglevel=silly --save $dep_constraints
-          fi
-          npm i --ignore-scripts --omit=dev --only=prod --production --loglevel=silly
+          npm i --ignore-scripts --loglevel=silly
           ## rebuild deps for which scripts were ignored, or partially installed - since "ignore-scripts" was used
           npm rebuild --loglevel=silly libxmljs2 || npm uninstall --no-save libxmljs2
-          ## install the needed dev-deps
-          npm i --ignore-scripts --loglevel=silly --no-save $dev_requirements
       - name: fetch build artifact
         # see https://github.com/actions/download-artifact
         uses: actions/download-artifact@v4
@@ -180,19 +159,13 @@ jobs:
             node-version: '^22.9'
           - npm-version: '^10'
             ## "node": "^18.17.0 || >=20.5.0"
-            node-version: '^20.5'
+            node-version: '^20.18'
           - npm-version: '^9'
             ## "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-            node-version: '^18'
+            node-version: '^20.18'
           - npm-version: '^8'
             ## "node": "^12.13.0 || ^14.15.0 || >=16"
             # node-version: '^16' ## cannot pin due to https://github.com/npm/cli/issues/6743
-          - npm-version: '^7'
-            ## "node": ">=10"
-            # node-version: '^14'  ## cannot pin due to https://github.com/npm/cli/issues/6743
-          - npm-version: '^6'
-            ## "node": "6 >=6.2.0 || 8 || >=9.3.0"
-            # node-version: '^14'  ## cannot pin due to https://github.com/npm/cli/issues/6743
     env:
       npm_config_engine_strict: true
     timeout-minutes: 10

.github/workflows/npm-ls_demo-results.yml

@@ -19,7 +19,7 @@ jobs:
       fail-fast: false # gather all the results !
       matrix:
         subject:
-          # - deps-from-git
+          - deps-from-git
           - alternative-package-registry
           - bundled-dependencies
           - dev-dependencies
@@ -33,19 +33,15 @@ jobs:
           ## see https://www.npmjs.com/package/npm?activeTab=versions
           ## see also: https://github.com/npm/cli/releases
           - '11'     # Current
-          #- '10'     # Legacy
-          #- '9'      # Legacy
-          #- '8'      # Legacy
-          #- '7'      # Legacy
-          #- '6'      # Legacy
+          - '10'
+          - '9'
+          - '8'      # Lowest supported
         node-version:
           ## action based on https://github.com/actions/node-versions/releases
           ## see also: https://nodejs.org/en/about/releases/
-          - '22'     # Current
-          - '20'     # Active LTS
-          - '18'
-          - '16'
-          - '14'
+          - '23'     # Current
+          - '22'     # Active LTS
+          - '20'
         os:
           - ubuntu-latest
           - windows-latest
@@ -62,44 +58,20 @@ jobs:
             node-version: '22'  # LTS
             os: ubuntu-latest
           - subject: local-workspaces
-            additional_npm-ls_args: '--workspaces'
+            additional_npm-ls_args: '--no-workspaces'
             npm-version: '11'   # Current
             node-version: '22'  # LTS
             os: ubuntu-latest
         exclude:
-          - # macos-latest no longer supports node14
-            os: macos-latest
-            node-version: '14'
-          - # npm11 requires node ^20.17.0 || >=22.9.0
-            npm-version: '11'
-            node-version: '18'
-          - # npm11 requires node ^20.17.0 || >=22.9.0
-            npm-version: '11'
-            node-version: '16'
-          - # npm11 requires node ^20.17.0 || >=22.9.0
-            npm-version: '11'
-            node-version: '14'
-          - # npm10 requires node ^18.17.0 || >=20.5.0
-            npm-version: '10'
-            node-version: '16'
-          - # npm10 requires node ^18.17.0 || >=20.5.0
-            npm-version: '10'
-            node-version: '14'
-          - # npm9 upgrade/install failed on node14
-            npm-version: '9'
-            node-version: '14'
           - # our specific version of juice-shop might not be node22 compatible
             subject: juice-shop
             node-version: '22'
-          - # our specific version of juice-shop might not be node14 compatible
-            subject: juice-shop
-            node-version: '14'
-          - # our specific version of juice-shop might not be npm6 compatible
-            subject: juice-shop
-            npm-version: '6'
-          - # workspaces are a feature of NPM since 7.0
-            subject: local-workspaces
-            npm-version: '6'
+          - # git-foo seams bugged in windows
+            subject: deps-from-git
+            os: windows-latest
+          - # git-foo seams bugged in macos
+            subject: deps-from-git
+            os: macos-latest
     timeout-minutes: 10 # this is a large matrix, just don't waste time!
     steps:
       - name: Checkout

HISTORY.md

@@ -6,6 +6,15 @@ All notable changes to this project will be documented in this file.
 
 <!-- unreleased changes go here -->
 
+
+* BREAKING Changes
+  * Dropped support for `node<20.18.0` ([#1192] via [#1273])
+  * Dropped support for `npm<8` ([#1274] via [#1273])
+
+[#1192]: https://github.com/CycloneDX/cyclonedx-node-npm/issues/1192
+[#1273]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1273
+[#1274]: https://github.com/CycloneDX/cyclonedx-node-npm/issues/1274
+
 ## 2.1.0 - 2025-03-19
 
 * Added

README.md

@@ -24,8 +24,12 @@ and might have properties following [`cdx:npm` Namespace Taxonomy](https://githu
 
 ## Requirements
 
-* `node` >= `14`
-* `npm` in range `6 - 11`
+* `node >= 20.18.0`
+* `npm >= 8.7`
+
+However, there are older versions of this tool that support
+* Node.js v14 or later
+* NPM v6 or later
 
 ## Installation