ep_desktop_notifications 11.0.31 → 11.0.32

package/.github/workflows/backend-tests.yml

@@ -26,11 +26,11 @@ jobs:
         with:
           repository: ether/etherpad-lite
           path: etherpad-lite
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         name: Install Node.js
         with:
           node-version: 25
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         name: Install pnpm
         with:
           package_json_file: ./etherpad-lite/package.json

package/.github/workflows/codeql.yml

@@ -27,15 +27,15 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.38.1
         with:
           languages: ${{ matrix.language }}
           queries: +security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@v4.38.1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.38.1
         with:
           category: "/language:${{ matrix.language }}"

package/.github/workflows/frontend-tests.yml

@@ -16,11 +16,11 @@ jobs:
         with:
           repository: ether/etherpad-lite
           path: etherpad-lite
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         name: Install Node.js
         with:
           node-version: 25
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         name: Install pnpm
         with:
           package_json_file: ./etherpad-lite/package.json

package/.github/workflows/lint.yml

@@ -0,0 +1,39 @@
+name: Lint
+
+on:
+  workflow_call:
+
+jobs:
+  lint:
+    name: ESLint
+    runs-on: ubuntu-latest
+    # `eslint .` executes .eslintrc.cjs and every installed ESLint plugin, so
+    # don't hand it the caller's contents:write / id-token:write token.
+    permissions:
+      contents: read
+    steps:
+      - name: Check out plugin repository
+        uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        name: Install Node.js
+        with:
+          node-version: 25
+      - uses: pnpm/action-setup@v6.1.0
+        name: Install pnpm
+        with:
+          version: 10
+          run_install: false
+      - name: Get pnpm store directory
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+      - uses: actions/cache@v6
+        name: Setup pnpm cache
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+      - name: Install dependencies
+        run: pnpm install --ignore-scripts
+      - name: Run ESLint
+        run: pnpm run lint

package/.github/workflows/npmpublish.yml

@@ -18,20 +18,24 @@ jobs:
       contents: write   # for the atomic version-bump push (branch + tag)
       id-token: write   # for npm OIDC trusted publishing
     steps:
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
-          # OIDC trusted publishing needs npm >= 11.5.1, which requires
-          # Node >= 20.17.0. setup-node's `20` resolves to the latest
-          # 20.x, which satisfies that.
-          node-version: 25
+          # OIDC trusted publishing needs npm >= 11.5.1. Node 24 is an LTS
+          # line that every npm 11.x and 12.x supports; Node 25 is not —
+          # npm 12 requires ^22.22.2 || ^24.15.0 || >=26.0.0, so on Node 25
+          # the upgrade step below died with EBADENGINE and no plugin could
+          # publish.
+          node-version: 24
           registry-url: https://registry.npmjs.org/
+        # Pinned to a range rather than @latest: the next npm major dropping
+        # this Node line would silently break publishing fleet-wide again.
       - name: Upgrade npm to >=11.5.1 (required for trusted publishing)
-        run: npm install -g npm@latest
+        run: npm install -g npm@^11.5.1
       - name: Check out Etherpad core
         uses: actions/checkout@v7
         with:
           repository: ether/etherpad-lite
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         name: Install pnpm
         with:
           run_install: false
@@ -73,7 +77,7 @@ jobs:
           # `pnpm version patch` bumps package.json, makes a commit, and creates
           # a `v<new-version>` tag. Capture the new tag name from package.json
           # rather than parsing pnpm's output, which has historically varied.
-          # Bump the patch component directly with Node. pnpm/action-setup@v6
+          # Bump the patch component directly with Node. pnpm/action-setup@v6.0.10
           # sometimes installs pnpm 11 pre-releases even when version: 10.x is
           # requested (pnpm/action-setup#225); those pre-releases either skip
           # the git commit/tag or reject --no-git-tag-version as unknown.

package/.github/workflows/test-and-release.yml

@@ -14,6 +14,9 @@ permissions:
   id-token: write
 
 jobs:
+  lint:
+    uses: ./.github/workflows/lint.yml
+    secrets: inherit
   backend:
     uses: ./.github/workflows/backend-tests.yml
     secrets: inherit
@@ -23,6 +26,7 @@ jobs:
   release:
     if: ${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' }}
     needs:
+      - lint
       - backend
       - frontend
     permissions:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ep_desktop_notifications",
-  "version": "11.0.31",
+  "version": "11.0.32",
   "keywords": [
     "desktop",
     "notifications",
@@ -20,7 +20,7 @@
     "url": "https://github.com/ether/ep_desktop_notifications.git"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.0.0"
   },
   "funding": {
     "type": "individual",
@@ -28,8 +28,8 @@
   },
   "devDependencies": {
     "eslint": "^8.57.1",
-    "eslint-config-etherpad": "^4.0.5",
-    "typescript": "^6.0.3"
+    "eslint-config-etherpad": "^5.0.0",
+    "typescript": "~6.0.3"
   },
   "scripts": {
     "lint": "eslint .",

package/pnpm-workspace.yaml

@@ -0,0 +1,10 @@
+# js-yaml and brace-expansion arrive only as transitive dev dependencies (via
+# eslint and minimatch@3), so `pnpm update` cannot move them. The selectors are
+# scoped to the affected major line: an unbounded range would drag minimatch@3
+# onto brace-expansion 5.x and eslint onto js-yaml 5.x.
+#
+# pnpm 11 no longer reads `pnpm.overrides` from package.json — these must live
+# here or the lockfile and the install disagree (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH).
+overrides:
+  js-yaml@4: '^4.3.2'
+  brace-expansion@1: '^1.1.16'