BREAKING: Bump Yarn to v4, min Node to 22, dev Node to 26

.github/workflows/build-lint-test.yml

@@ -14,6 +14,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v3
+      - run: corepack enable
       - name: Use Node.js
         uses: actions/setup-node@v3
         with:
@@ -51,9 +52,10 @@ jobs:
       - prepare
     strategy:
       matrix:
-        node-version: [16.x, 18.x, 20.x]
+        node-version: [22.x, 24.x, 26.x]
     steps:
       - uses: actions/checkout@v3
+      - run: corepack enable
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v3
         with:
@@ -76,9 +78,10 @@ jobs:
       - prepare
     strategy:
       matrix:
-        node-version: [16.x, 18.x, 20.x]
+        node-version: [22.x, 24.x, 26.x]
     steps:
       - uses: actions/checkout@v3
+      - run: corepack enable
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v3
         with:
@@ -108,10 +111,10 @@ jobs:
       - prepare
     strategy:
       matrix:
-        node-version: [16.x, 18.x, 20.x]
+        node-version: [22.x, 24.x, 26.x]
     steps:
       - uses: actions/checkout@v3
-
+      - run: corepack enable
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v3
         with:

.github/workflows/create-release-pr.yml

@@ -29,6 +29,7 @@ jobs:
           # We check out the specified branch, which will be used as the base
           # branch for all git operations and the release PR.
           ref: ${{ github.event.inputs.base-branch }}
+      - run: corepack enable
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:

.github/workflows/publish-release.yml

@@ -17,6 +17,7 @@ jobs:
       - uses: actions/checkout@v3
         with:
           ref: ${{ github.sha }}
+      - run: corepack enable
       - name: Setup Node.js
         uses: actions/setup-node@v3
         with:

.nvmrc

@@ -1 +1 @@
-v18
+v26.13.0

.yarnrc.yml

@@ -1,15 +1,43 @@
+# Allowlist for Git repositories that can be used as dependencies. We set it to
+# an empty array to disallow all Git dependencies, as we don't use any and they
+# can be a security risk.
+approvedGitRepositories: []
+
+compressionLevel: mixed
+
+enableGlobalCache: false
+
+# Enable hardened mode to validate lockfile content against remote registries.
+enableHardenedMode: true
+
+# Disable Yarn's mirror feature to avoid writing to the global cache.
+enableMirror: false
+
 enableScripts: false
 
-enableTelemetry: 0
+enableTelemetry: false
+
+# Despite `enableGlobalCache` and `enableMirror` being `false`, Yarn is still
+# writing to the global folder.
+globalFolder: .yarn/global
 
 logFilters:
   - code: YN0004
     level: discard
 
 nodeLinker: node-modules
 
+# Configure the NPM minimal age gate to 3 days, meaning packages must be at
+# least 3 days old to be installed.
+npmMinimalAgeGate: 4320 # 3 days (in minutes)
+
+# Override the minimal age gate, allowing certain packages to be installed
+# regardless of their publish age.
+npmPreapprovedPackages:
+  - "@metamask/*"
+  - "@metamask-previews/*"
+  - "@lavamoat/*"
+
 plugins:
   - path: .yarn/plugins/@yarnpkg/plugin-allow-scripts.cjs
     spec: "https://raw.githubusercontent.com/LavaMoat/LavaMoat/main/packages/yarn-plugin-allow-scripts/bundles/@yarnpkg/plugin-allow-scripts.js"
-
-yarnPath: .yarn/releases/yarn-3.4.1.cjs

CHANGELOG.md

@@ -5,6 +5,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Changed
+- **BREAKING:** Drop support for Node < 22; add support for Node 22, 24, and 26
 
 ## [5.1.0]
 ### Changed

package.json

@@ -35,12 +35,13 @@
     "@babel/core": "^7.22.15",
     "@babel/preset-env": "^7.22.15",
     "@babel/preset-typescript": "^7.22.15",
-    "@lavamoat/allow-scripts": "^3.0.4",
-    "@metamask/auto-changelog": "^3.4.3",
+    "@lavamoat/allow-scripts": "^5.1.0",
+    "@lavamoat/preinstall-always-fail": "^2.0.0",
+    "@metamask/auto-changelog": "^7.1.0",
     "@metamask/eslint-config": "^9.0.0",
     "@metamask/eslint-config-nodejs": "^9.0.0",
     "@metamask/eslint-config-typescript": "^9.0.1",
-    "@playwright/test": "~1.44.1",
+    "@playwright/test": "^1.64.1",
     "@types/node": "^14.18.58",
     "@types/punycode": "^2.1.0",
     "@typescript-eslint/eslint-plugin": "^4.33.0",
@@ -57,16 +58,16 @@
     "fs-extra": "^11.1.1",
     "http-server": "^14.1.1",
     "minify-stream": "^2.1.0",
-    "playwright": "~1.44.1",
+    "playwright": "^1.64.1",
     "prettier": "^2.6.2",
     "prettier-plugin-packagejson": "^2.2.17",
     "ts-node": "^10.7.0",
     "typescript": "~4.4.4",
     "workbox-build": "^6.6.0"
   },
-  "packageManager": "yarn@3.4.1",
+  "packageManager": "yarn@4.18.0+sha256.fb8b1d20be72a0b544a35bcec4c7ed0ff55a9b173c01f191b02ba164b2051db5",
   "engines": {
-    "node": "^16.20 || ^18.16 || >=20"
+    "node": "^22 || ^24 || >=26"
   },
   "publishConfig": {
     "access": "public",