feat(dependency-audit): support Node >=20.19 with a 20/24/26 CI matrix

[manzoorwanijk]

What

Widen @mawesome/dependency-audit's supported Node range from >=24.12.0 to ^20.19.0 || >=22.9.0, and add a CI compat matrix that tests the package on Node 20, 24, and 26 (each resolved to the latest minor/patch).

Why

Nothing in the published artifact actually needs Node 24 — the old engines value mirrored the monorepo's toolchain floor (internal .ts scripts rely on native type stripping), not the package's real runtime floor. The real floor is set by:

• pacote / npm-packlist declaring engines: ^20.17.0 || >=22.9.0 (hence the disjoint range — Node 21 and 22.0–22.8 stay excluded), and
• the CLI's styleText(..., { stream }), whose options argument landed in Node 20.18.

The monorepo root intentionally keeps engines/devEngines at >=24.12.0; it is private and never published, so the root constraint only governs developing the repo.

How

• packages/dependency-audit/package.json — engines.node → ^20.19.0 || >=22.9.0.
• tsdown.config.ts — target: 'node24' → 'node20.19' in all three build configs, so emitted syntax can never silently exceed the engines floor.
• test/cli.test.ts — the CLI tests spawned node src/cli.ts, which requires native type stripping (unavailable on Node 20) — the only real Node 20 breakage. They now spawn the TS source when process.features.typescript is truthy and fall back to the built dist/cli.js otherwise.
• .github/workflows/verify.yml — new node-compat job: matrix [20, 24, 26] with check-latest: true, fail-fast: false. It installs and builds on Node 24 (the toolchain floor), switches to the matrix Node, runs vitest directly (pnpm enforces the root engines on every pnpm run, so it cannot run on Node 20), then smoke-tests the built CLI (--version + a self-audit of the package directory).
• Changeset — minor bump.

Testing

• Full test suite (222 tests) and a CLI self-audit pass locally on Node 20.20.2, 24.15.0, and 26.3.0 (via nvm).
• Full pnpm verify gate passes on Node 24.

[cloudflare-workers-and-pages]

Deploying mawesome with    Cloudflare Pages

Latest commit:	beb40c6
Status:	✅  Deploy successful!
Preview URL:	https://3f67e115.mawesome.pages.dev
Branch Preview URL:	https://feat-node-20-support.mawesome.pages.dev

View logs

[Copilot]

Pull request overview

This PR widens the supported Node.js runtime range for @mawesome/dependency-audit to include Node 20 (from 20.19+) while keeping the monorepo’s development/tooling floor at Node >=24.12, and adds CI coverage to validate the package across supported Node lines.

Changes:

• Broaden packages/dependency-audit runtime engines.node to ^20.19.0 || >=22.9.0.
• Lower build output target to node20.19 so emitted syntax aligns with the package’s engines floor.
• Add a CI “node-compat” matrix job (Node 20/24/26) and adjust CLI tests to run from dist when native TS type-stripping isn’t available.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
packages/dependency-audit/tsdown.config.ts	Lowers build target to node20.19 to match the widened runtime floor.
packages/dependency-audit/test/cli.test.ts	Switches CLI invocation to TS source only when native type-stripping is available; otherwise uses built JS.
packages/dependency-audit/package.json	Widens engines.node to include Node 20.19+ and 22.9+.
.github/workflows/verify.yml	Adds a Node compatibility CI job testing Node 20/24/26 by running vitest directly and smoke-testing the built CLI.
.changeset/node-20-support.md	Adds a changeset for a minor release documenting the widened Node support range.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.