create-node-lib 2.19.0 → 2.19.2

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [2.19.2](https://github.com/lirantal/create-node-lib/compare/v2.19.1...v2.19.2) (2026-05-15)
+
+
+### Bug Fixes
+
+* descriptions for npmrc file ([dce8594](https://github.com/lirantal/create-node-lib/commit/dce8594d4d5a14b1f14e2ac39745de6d64aaf97c))
+
+## [2.19.1](https://github.com/lirantal/create-node-lib/compare/v2.19.0...v2.19.1) (2026-05-15)
+
+
+### Bug Fixes
+
+* move package manager constraints to engines ([#48](https://github.com/lirantal/create-node-lib/issues/48)) ([f39e97e](https://github.com/lirantal/create-node-lib/commit/f39e97efad3b5e76babaeb7febbdd54182c4988e))
+
 # [2.19.0](https://github.com/lirantal/create-node-lib/compare/v2.18.0...v2.19.0) (2026-05-15)
 
 

package/__tests__/generator.test.js

@@ -75,6 +75,9 @@ describe('all the template files are accountable for', () => {
     expect(pkg.author.email).toBe(mockUserEmail)
     expect(pkg.homepage).toBe(mockProjectRepository)
     expect(pkg.keywords).toEqual(mockProjectKeywords)
+    expect(pkg.engines.pnpm).toBe('>=10.26.0')
+    expect(pkg.engines.npm).toBeUndefined()
+    expect(pkg.packageManager).toBeUndefined()
     // Testing only variable scripts
     expect(pkg.scripts['lint:lockfile']).toEqual(mockScripts['lint:lockfile'])
   })
@@ -116,6 +119,9 @@ describe('all the template files are accountable for', () => {
     const pkg = JSON.parse(await stream.readFile('package.json'))
     // Testing only variable scripts
     expect(pkg.scripts['lint:lockfile']).toEqual(mockScripts['lint:lockfile'])
+    expect(pkg.engines.npm).toBe('>=11.10.0')
+    expect(pkg.engines.pnpm).toBeUndefined()
+    expect(pkg.packageManager).toBeUndefined()
   })
 
   test('Generator creates package.json with prepare script for husky', async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-node-lib",
-  "version": "2.19.0",
+  "version": "2.19.2",
   "description": "Scaffolding out a Node.js library module",
   "bin": "./bin/cli.js",
   "engines": {

package/saofile.js

@@ -1,7 +1,11 @@
 'use strict'
 const validateNpmPackageName = require('validate-npm-package-name')
 
-const SUPPORTED_NPM_CLIENTS = ['pnpm', 'npm']
+const PACKAGE_MANAGER_ENGINES = {
+  pnpm: '>=10.26.0',
+  npm: '>=11.10.0'
+}
+const SUPPORTED_NPM_CLIENTS = Object.keys(PACKAGE_MANAGER_ENGINES)
 
 module.exports = {
   description: 'Scaffolding out a node library.',
@@ -100,12 +104,10 @@ module.exports = {
             'lint:lockfile'
           ] = `lockfile-lint --path ${lockfile} --validate-https --allowed-hosts npm`
           data.scripts['lint'] = `eslint . && ${npmClient} run lint:lockfile && ${npmClient} run lint:markdown`
+          data.engines[npmClient] = PACKAGE_MANAGER_ENGINES[npmClient]
           data['lint-staged'] = {
             '**/*.{js,json}': [`${npmClient} run lint:fix`]
           }
-          if (npmClient !== 'pnpm') {
-            delete data.packageManager
-          }
           return data
         }
       },

package/template/npmrc

@@ -1,11 +1,20 @@
 # npm security best practices
 # Source: https://github.com/lirantal/npm-security-best-practices
 
-# Do not run any lifecycle hook scripts such as postinstall for packages
+# SECURITY: do not run any lifecycle scripts (preinstall, install,
+# postinstall, etc.) for dependencies. Postinstall scripts are the
+# classic malware delivery vector — a transitive dep can execute
+# arbitrary code on your machine during `npm install` without you
+# ever running its code at runtime.
 ignore-scripts=true
 
-# Do not allow Git / GitHub related sources for packages
+# SECURITY: reject git-source dependencies (git+ssh://, github:owner/repo,
+# etc.). Git deps can ship their own .npmrc that overrides the path to
+# the npm binary, achieving arbitrary code execution at install time —
+# bypassing ignore-scripts entirely. This will be the default in npm 12.
 allow-git=none
 
-# Require at least 30 days since package release
+# SECURITY: refuse to install package versions younger than 30 days.
+# Gives the community time to spot and yank hijacked releases before
+# they reach your install. Value is in days.
 min-release-age=30

package/template/package.json

@@ -28,7 +28,6 @@
   "engines": {
     "node": ">=24.0.0"
   },
-  "packageManager": "pnpm@10.31.0",
   "files": [
     "dist",
     "src",