Skip to content

chore: drop Node 20, target ES2022 and build packages as ESM-only - #273

Closed
ulissesferreira wants to merge 3 commits into
mainfrom
feat/node22-es2022-esm-only
Closed

chore: drop Node 20, target ES2022 and build packages as ESM-only#273
ulissesferreira wants to merge 3 commits into
mainfrom
feat/node22-es2022-esm-only

Conversation

@ulissesferreira

Copy link
Copy Markdown
Contributor

Explanation

Following the same changes happening in MetaMask/core (#9976, #10019, #9536):

Drop Node 20

  • Node 18 and 20 are EOL. engines.node is now ^22.14.0 || ^24 in the root and all packages, enforced by the Yarn constraints, and the CI test matrix now runs on 22.x and 24.x only.

ES2022

  • The shared TypeScript target and lib settings are bumped from ES2020 to ES2022.

ESM-only

  • @metamask/snap-networks-utils is now built as ESM-only with tsc --build, replacing the dual CommonJS/ESM build produced by ts-bridge. Published artifacts are dist/index.js and dist/index.d.ts.
  • lodash is replaced with lodash-es, and relative imports use explicit .js extensions (required for Node16 ESM resolution).
  • The library template and the Yarn constraints are updated to match.

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've communicated my changes to consumers by updating changelogs for packages I've changed
  • I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

@ulissesferreira
ulissesferreira requested review from a team as code owners September 4, 2026 12:57
@socket-security

socket-security Bot commented Sep 4, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​types/​lodash-es@​4.17.121001007680100
Addedlodash-es@​4.18.11001007986100
Updated@​types/​lodash@​4.17.24 ⏵ 4.17.2510010080 +185100

View full report

@socket-security

socket-security Bot commented Sep 4, 2026

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

  • lodash-es@4.18.1

View full report

@ulissesferreira
ulissesferreira force-pushed the feat/node22-es2022-esm-only branch from 45ceeb7 to f806c43 Compare September 4, 2026 12:58
@ulissesferreira
ulissesferreira force-pushed the feat/node22-es2022-esm-only branch 3 times, most recently from f6c2506 to d9ef6b0 Compare September 4, 2026 13:17
@ulissesferreira ulissesferreira changed the title chore: drop Node 20, target ES2022, and build packages as ESM-only chore: drop Node 20, target ES2022 and build packages as ESM-only Sep 4, 2026
Ulisses Ferreira added 2 commits September 4, 2026 14:41
- Require Node.js ^22.14.0 || ^24 everywhere (engines, yarn constraints,
  CI matrix); Node 18 and 20 are EOL.
- Bump the shared TypeScript target and lib from ES2020 to ES2022.
- Replace the dual CommonJS/ESM ts-bridge build with an ESM-only build
  using tsc --build. Packages now ship dist/index.js and
  dist/index.d.ts; lodash is replaced with lodash-es.
- Update the library template and yarn constraints accordingly.
Jest's CommonJS runtime cannot require the now ESM-only
`@metamask/snap-networks-utils`, so map it to its uncompiled source in
each snap's Jest configuration (along with the source's Node16-style
`.js` specifiers and `lodash-es`). Also dedupe `@types/lodash` in the
lockfile.
@ulissesferreira
ulissesferreira force-pushed the feat/node22-es2022-esm-only branch from 7ca777d to fae75e6 Compare September 4, 2026 13:44
@ulissesferreira

Copy link
Copy Markdown
Contributor Author

@SocketSecurity ignore npm/lodash-es@4.18.1

Reviewed: lodash-es is a well-established, widely used utility library; the flag stems from its optional _.template evaluate/interpolate code-generation features, which we do not use in this repo. Deemed an acceptable risk.

},
"engines": {
"node": ">=20"
"node": "^22.14.0 || ^24"

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Matches Core's

},
"engines": {
"node": ">=20"
"node": "^22.14.0 || ^24"

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Matches Core's

},
"engines": {
"node": ">=20"
"node": "^22.14.0 || ^24"

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Matches Core's

},
"engines": {
"node": ">=20"
"node": "^22.14.0 || ^24"

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Matches Core's

},
"engines": {
"node": ">=20"
"node": "^22.14.0 || ^24"

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Matches Core's

@ulissesferreira
ulissesferreira force-pushed the feat/node22-es2022-esm-only branch from fae75e6 to 5130520 Compare September 4, 2026 15:53
@sonarqubecloud

sonarqubecloud Bot commented Sep 4, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
54.5% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

@stanleyyconsensys stanleyyconsensys left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Personal interest

i understand why we drop Node 20

but not sure the intension to use

ES2022 and build packages as ESM-only

as this result 2 style on the mono-repo, while core they are aligned in 1?

on share library, we do
import module from "xxx.js"

on snap , we do
import module from "xxx"

@ulissesferreira

Copy link
Copy Markdown
Contributor Author

After a conversation with @stanleyyconsensys, we have decided to deprecate this PR in favor of a smaller one where we just deprecate Node 20 from our pipelines and bump the target compiled TypeScript / JavaScript because we are unsure if we will be able to support moving UI jsx or tsx elements to the shared package if it's ESM only.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants