Roll Node.js floor back to >= 24 (Active LTS) — closes #7779 (#7781)

* Roll Node.js floor back to >= 24 (Active LTS)

Closes #7779.

#7779 originally proposed bumping past the Node 25 stop-gap to Node 26.
After re-checking the release schedule, the cleaner LTS target is
actually Node 24:

- Node 24 (Krypton) is currently in Active LTS, supported until ~May 2028.
- Node 25 hit end-of-life on April 10 2026 — the floor merged in
  #7752 / #7749 / #7754 a day ago ships an already-EOL major.
- Node 26 was released May 5 2026 and does not enter Active LTS until
  October 2026.

So this PR reverts the Node 25 ratchet from those three PRs and lands
on Node 24 — Etherpad's runtime floor stays on a supported LTS for the
next ~2 years.

Runtime / infra
- `package.json` + `src/package.json`: `engines.node` `>=25.0.0` -> `>=24.0.0`
- `bin/functions.sh`, `bin/installer.sh`, `bin/installer.ps1`:
  `REQUIRED_NODE_MAJOR` 25 -> 24
- `Dockerfile`: `node:25-alpine` -> `node:24-alpine` (both stages).
  Corepack-via-npm workaround is intentionally kept: it works on
  Node 24 (which still ships corepack) and on Node 25+ (which doesn't),
  so the same recipe survives the next LTS bump without churn. Comments
  reworded accordingly.
- `snap/snapcraft.yaml`: pinned `NODE_VERSION` 25.9.0 -> 24.15.0; design
  notes + corepack comment adjusted
- `packaging/nfpm.yaml`: `nodejs (>= 25)` -> `nodejs (>= 24)` in
  top-level depends + deb/rpm overrides
- `packaging/bin/etherpad`: comment matches the new pin
- `packaging/README.md`: build prereqs + apt install snippet point at
  `node_24.x`; the long-stale "engines.node floor is 20" line is fixed
  while we're here
- `.github/workflows/*.yml`: setup-node `node-version` 25 -> 24 across
  every workflow; backend / frontend-admin / upgrade matrices
  `[25]` -> `[24]`
- `.github/workflows/deb-package.yml`: `NODE_MAJOR=25` + `node_25.x`
  smoke-test installer -> 24
- `bin/plugins/lib/npmpublish.yml`: 25 -> 24 (template propagates to
  the ~80 ether/* plugins via update-plugins workflow)

Docs
- `README.md`: install one-liner + Requirements -> Node.js >= 24
- `doc/npm-trusted-publishing.md`: runner requirement -> Node 24
- `doc/plugins.md` / `doc/plugins.adoc`: plugin metadata example
  `engines.node` -> `">=24.0.0"`

@types/node is left at ^25.8.0 — newer type definitions cover Node 24
runtime fine and avoid an unnecessary lockfile churn.

Companion homepage one-liner change to follow on ether/ether.github.com.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(plugins): example engines.node = ">=22.0.0", not core's floor

Plugin code is overwhelmingly ace-hook glue and rarely uses Node-version-
specific APIs, so plugin engines.node should reflect the plugin's own
requirements, not track core. Showing core's 24-floor in the example
encouraged plugin authors to blindly copy a tighter pin than necessary
and locked plugins out of being installable on older Etherpad/Node
deployments. Use the most-recent Node LTS that has actually reached EOL
(20 -> EOL April 2026) as the example floor, i.e. >=22.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
John McLear 2026-05-16 13:07:59 +01:00 committed by GitHub
parent 79f525b0a7
commit 04045fe532
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
30 changed files with 78 additions and 76 deletions

View file

@ -27,8 +27,8 @@ jobs:
strategy:
fail-fast: false
matrix:
# Etherpad requires Node >= 25 (see package.json engines.node).
node: ${{ fromJSON('[25]') }}
# Etherpad requires Node >= 24 (see package.json engines.node).
node: ${{ fromJSON('[24]') }}
steps:
-
name: Checkout repository
@ -101,7 +101,7 @@ jobs:
strategy:
fail-fast: false
matrix:
node: ${{ fromJSON('[25]') }}
node: ${{ fromJSON('[24]') }}
steps:
-
name: Checkout repository
@ -179,8 +179,8 @@ jobs:
strategy:
fail-fast: false
matrix:
# Etherpad requires Node >= 25 (see package.json engines.node).
node: ${{ fromJSON('[25]') }}
# Etherpad requires Node >= 24 (see package.json engines.node).
node: ${{ fromJSON('[24]') }}
name: Windows without plugins
runs-on: windows-latest
steps:
@ -247,8 +247,8 @@ jobs:
strategy:
fail-fast: false
matrix:
# Etherpad requires Node >= 25 (see package.json engines.node).
node: ${{ fromJSON('[25]') }}
# Etherpad requires Node >= 24 (see package.json engines.node).
node: ${{ fromJSON('[24]') }}
name: Windows with Plugins
runs-on: windows-latest

View file

@ -56,11 +56,11 @@ jobs:
with:
run_install: false
# Pin Node so the build does not silently fall back to whatever the
# runner image ships with. The repo declares engines.node >=25.0.0.
# runner image ships with. The repo declares engines.node >=24.0.0.
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
cache: pnpm
- name: Setup Pages
if: github.event_name == 'push'

View file

@ -53,7 +53,7 @@ jobs:
- name: Setup Node
uses: actions/setup-node@v6
with:
node-version: '25'
node-version: '24'
cache: pnpm
- name: Resolve version
@ -128,16 +128,16 @@ jobs:
run: |
set -eux
# Ubuntu's default apt nodejs is 18 — too old for our
# `Depends: nodejs (>= 25)`. Add NodeSource's apt repo
# `Depends: nodejs (>= 24)`. Add NodeSource's apt repo
# explicitly (key + sources.list) instead of `curl | sudo bash`
# so we don't execute network-fetched code as root.
NODE_MAJOR=25
NODE_MAJOR=24
# GitHub runner images often ship a NodeSource node_20.x list
# preinstalled (sometimes as a .sources deb822 file). Wipe any
# existing nodesource entries so the only Node candidate apt sees
# is our node_25.x repo. Otherwise `apt-get install -y nodejs`
# is our node_24.x repo. Otherwise `apt-get install -y nodejs`
# picks the higher-version 20.x build that's already cached and
# `dpkg -i` then fails on `Depends: nodejs (>= 25)`.
# `dpkg -i` then fails on `Depends: nodejs (>= 24)`.
sudo rm -f /etc/apt/sources.list.d/nodesource.list \
/etc/apt/sources.list.d/nodesource.sources \
/etc/apt/preferences.d/nodesource \
@ -147,7 +147,7 @@ jobs:
| sudo gpg --dearmor --yes -o "${KEYRING}"
echo "deb [signed-by=${KEYRING}] https://deb.nodesource.com/node_${NODE_MAJOR}.x nodistro main" \
| sudo tee /etc/apt/sources.list.d/nodesource.list
# Pin nodejs to the 25.x line so neither Ubuntu's noble-updates
# Pin nodejs to the 24.x line so neither Ubuntu's noble-updates
# 20.x nor any leftover NodeSource cache can win the resolver.
printf 'Package: nodejs\nPin: version %s.*\nPin-Priority: 1001\n' "${NODE_MAJOR}" \
| sudo tee /etc/apt/preferences.d/nodesource >/dev/null

View file

@ -59,7 +59,7 @@ jobs:
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
cache: pnpm
cache-dependency-path: etherpad/pnpm-lock.yaml
-

View file

@ -21,8 +21,8 @@ jobs:
strategy:
fail-fast: false
matrix:
# Etherpad requires Node >= 25 (see package.json engines.node).
node: ${{ fromJSON('[25]') }}
# Etherpad requires Node >= 24 (see package.json engines.node).
node: ${{ fromJSON('[24]') }}
steps:
-

View file

@ -42,7 +42,7 @@ jobs:
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
cache: pnpm
-
name: Install all dependencies and symlink for ep_etherpad-lite
@ -114,7 +114,7 @@ jobs:
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
cache: pnpm
- name: Install all dependencies and symlink for ep_etherpad-lite
run: pnpm install --frozen-lockfile
@ -190,7 +190,7 @@ jobs:
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
cache: pnpm
- name: Install all dependencies and symlink for ep_etherpad-lite
run: pnpm install --frozen-lockfile
@ -291,7 +291,7 @@ jobs:
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
cache: pnpm
- name: Install all dependencies and symlink for ep_etherpad-lite
run: pnpm install --frozen-lockfile

View file

@ -42,7 +42,7 @@ jobs:
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
cache: pnpm
- name: Install all dependencies and symlink for ep_etherpad-lite
run: pnpm install --frozen-lockfile

View file

@ -42,7 +42,7 @@ jobs:
- uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
- name: Pre-install pnpm (avoid sudo prompt in the installer)
run: npm install -g pnpm
@ -104,7 +104,7 @@ jobs:
- uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
- name: Pre-install pnpm
run: npm install -g pnpm

View file

@ -39,7 +39,7 @@ jobs:
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
cache: pnpm
-
name: Install all dependencies and symlink for ep_etherpad-lite
@ -77,7 +77,7 @@ jobs:
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
cache: pnpm
-
name: Install etherpad-load-test
@ -140,7 +140,7 @@ jobs:
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
cache: pnpm
-
name: Install all dependencies and symlink for ep_etherpad-lite

View file

@ -39,7 +39,7 @@ jobs:
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
cache: pnpm
- name: Install all dependencies and symlink for ep_etherpad-lite
run: pnpm install --frozen-lockfile

View file

@ -42,7 +42,7 @@ jobs:
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
cache: pnpm
-

View file

@ -64,7 +64,7 @@ jobs:
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
cache: pnpm
cache-dependency-path: etherpad/pnpm-lock.yaml
- name: Install dependencies ether.github.com

View file

@ -17,8 +17,8 @@ jobs:
- uses: actions/setup-node@v6
with:
# OIDC trusted publishing needs npm >= 11.5.1, which requires
# Node >= 22.9.0. Node 25 satisfies that and matches the rest of CI.
node-version: 25
# Node >= 22.9.0. Node 24 satisfies that and matches the rest of CI.
node-version: 24
registry-url: https://registry.npmjs.org/
- name: Upgrade npm to >=11.5.1 (required for trusted publishing)
run: npm install -g npm@latest

View file

@ -26,7 +26,7 @@ jobs:
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 25
node-version: 24
- name: Install bin dependencies
working-directory: ./bin

View file

@ -27,8 +27,8 @@ jobs:
strategy:
fail-fast: false
matrix:
# Etherpad requires Node >= 25 (see package.json engines.node).
node: ${{ fromJSON('[25]') }}
# Etherpad requires Node >= 24 (see package.json engines.node).
node: ${{ fromJSON('[24]') }}
steps:
-
name: Check out latest release

View file

@ -9,12 +9,13 @@ ARG BUILD_ENV=git
ARG PnpmVersion=11.0.6
FROM node:25-alpine AS adminbuild
# Node 25 no longer ships corepack at all, so install pnpm directly via
# npm. The node:25-alpine image also bundles yarn; remove it first to
# avoid leaving an unused binary on PATH. Drop bundled npm afterwards
# — its older transitives (picomatch, brace-expansion) carry CVEs we
# don't otherwise need.
FROM node:24-alpine AS adminbuild
# Install pnpm directly via npm (rather than via corepack) so the same
# image recipe keeps working on Node 25+, where corepack has been
# dropped from the distribution. The node:24-alpine image also bundles
# yarn; remove it first to avoid leaving an unused binary on PATH.
# Drop bundled npm afterwards — its older transitives (picomatch,
# brace-expansion) carry CVEs we don't otherwise need.
RUN rm -f /usr/local/bin/yarn /usr/local/bin/yarnpkg && \
npm install -g pnpm@${PnpmVersion} && \
rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
@ -24,7 +25,7 @@ RUN pnpm install
RUN pnpm run build:ui
FROM node:25-alpine AS build
FROM node:24-alpine AS build
LABEL maintainer="Etherpad team, https://github.com/ether/etherpad"
# Set these arguments when building the image from behind a proxy
@ -99,7 +100,8 @@ RUN groupadd --system ${EP_GID:+--gid "${EP_GID}" --non-unique} etherpad && \
ARG EP_DIR=/opt/etherpad-lite
RUN mkdir -p "${EP_DIR}" && chown etherpad:etherpad "${EP_DIR}"
# Node 25 dropped corepack; install pnpm directly via npm, then drop
# Install pnpm directly via npm (rather than via corepack) so the same
# recipe stays valid on Node 25+, which dropped corepack. Then drop
# both npm and the pre-bundled yarn binary to keep the runtime image
# free of unused tooling and known-CVE transitives.
#

View file

@ -64,7 +64,7 @@ For more than a decade, Etherpad has quietly underpinned the documents that matt
### Quick install (one-liner)
The fastest way to get Etherpad running. Requires `git` and Node.js >= 25.
The fastest way to get Etherpad running. Requires `git` and Node.js >= 24.
**macOS / Linux / WSL:**
@ -158,7 +158,7 @@ volumes:
### Requirements
[Node.js](https://nodejs.org/) >= 25.
[Node.js](https://nodejs.org/) >= 24.
### Windows, macOS, Linux

View file

@ -1,5 +1,5 @@
# minimum required node version
REQUIRED_NODE_MAJOR=25
REQUIRED_NODE_MAJOR=24
REQUIRED_NODE_MINOR=0
# minimum required npm version

View file

@ -38,7 +38,7 @@ function Test-Cmd([string]$name) {
$EtherpadDir = if ($env:ETHERPAD_DIR) { $env:ETHERPAD_DIR } else { 'etherpad-lite' }
$EtherpadBranch = if ($env:ETHERPAD_BRANCH) { $env:ETHERPAD_BRANCH } else { 'master' }
$EtherpadRepo = if ($env:ETHERPAD_REPO) { $env:ETHERPAD_REPO } else { 'https://github.com/ether/etherpad.git' }
$RequiredNodeMajor = 25
$RequiredNodeMajor = 24
Write-Step 'Etherpad installer'

View file

@ -34,7 +34,7 @@ is_cmd() { command -v "$1" >/dev/null 2>&1; }
ETHERPAD_DIR="${ETHERPAD_DIR:-etherpad-lite}"
ETHERPAD_BRANCH="${ETHERPAD_BRANCH:-master}"
ETHERPAD_REPO="${ETHERPAD_REPO:-https://github.com/ether/etherpad.git}"
REQUIRED_NODE_MAJOR=25
REQUIRED_NODE_MAJOR=24
step "Etherpad installer"

View file

@ -21,9 +21,9 @@ jobs:
- uses: actions/setup-node@v6
with:
# OIDC trusted publishing needs npm >= 11.5.1, which requires
# Node >= 22.9.0. Use Node 25 to match the rest of CI and the
# Node >= 22.9.0. Use Node 24 to match the rest of CI and the
# Etherpad core minimum.
node-version: 25
node-version: 24
registry-url: https://registry.npmjs.org/
- name: Upgrade npm to >=11.5.1 (required for trusted publishing)
run: npm install -g npm@latest

View file

@ -85,9 +85,9 @@ If a package previously had an `NPM_TOKEN` secret in CI:
## Requirements
- **Node.js**: >= 25 on the runner. `setup-node@v6 with version: 25`
resolves to the latest 25.x. The project's `engines.node` requires
`>=25.0.0`.
- **Node.js**: >= 24 on the runner. `setup-node@v6 with version: 24`
resolves to the latest 24.x. The project's `engines.node` requires
`>=24.0.0`.
- **npm CLI**: >= 11.5.1. The publish workflow runs `npm install -g npm@latest`
before publishing so the bundled npm version doesn't matter.
- **Runner**: must be a GitHub-hosted (cloud) runner. Self-hosted runners are

View file

@ -231,7 +231,7 @@ publish your plugin.
"author": "USERNAME (REAL NAME) <MAIL@EXAMPLE.COM>",
"contributors": [],
"dependencies": {"MODULE": "0.3.20"},
"engines": {"node": ">=25.0.0"}
"engines": {"node": ">=22.0.0"}
}
----

View file

@ -226,7 +226,7 @@ publish your plugin.
"author": "USERNAME (REAL NAME) <MAIL@EXAMPLE.COM>",
"contributors": [],
"dependencies": {"MODULE": "0.3.20"},
"engines": {"node": ">=25.0.0"}
"engines": {"node": ">=22.0.0"}
}
```

View file

@ -42,7 +42,7 @@
"ui": "link:ui"
},
"engines": {
"node": ">=25.0.0",
"node": ">=24.0.0",
"pnpm": ">=11.1.2"
},
"packageManager": "pnpm@11.1.2",

View file

@ -19,7 +19,7 @@ Built artefacts land in `./dist/`.
## Building locally
Prereqs: Node 24 (current LTS; `engines.node` floor is 20), pnpm 10+, nfpm.
Prereqs: Node 24 (current LTS; matches `engines.node` floor), pnpm 11.1.2+, nfpm.
```sh
pnpm install --frozen-lockfile
@ -88,16 +88,15 @@ sudo systemctl start etherpad
curl http://localhost:9001/health
```
`apt` will pull in `nodejs (>= 25)` (matches Etherpad's `engines.node`).
Most distro repos don't yet ship Node.js 25, so on most systems you
will need to add NodeSource's `node_25.x` apt repo before
`apt install`:
`apt` will pull in `nodejs (>= 24)` (matches Etherpad's `engines.node`).
If your distro's repos still ship a pre-Node-24 `nodejs` package, add
NodeSource's `node_24.x` apt repo before `apt install`:
```sh
KEYRING=/usr/share/keyrings/nodesource.gpg
curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
| sudo gpg --dearmor --yes -o "${KEYRING}"
echo "deb [signed-by=${KEYRING}] https://deb.nodesource.com/node_25.x nodistro main" \
echo "deb [signed-by=${KEYRING}] https://deb.nodesource.com/node_24.x nodistro main" \
| sudo tee /etc/apt/sources.list.d/nodesource.list
sudo apt-get update
```

View file

@ -11,7 +11,7 @@ export NODE_ENV
export ETHERPAD_PRODUCTION=true
# Resolve `node` explicitly to the apt-installed binary (the .deb declares
# `Depends: nodejs (>= 25)`, which always lands at /usr/bin/node). Relying
# `Depends: nodejs (>= 24)`, which always lands at /usr/bin/node). Relying
# on PATH would let a stray /usr/local/bin/node — e.g. an older nvm or
# toolcache install — shadow the version we actually require, and the
# server would crash on startup with "Node 20.x is not supported".

View file

@ -20,7 +20,7 @@ homepage: https://etherpad.org
license: Apache-2.0
depends:
- nodejs (>= 25)
- nodejs (>= 24)
- adduser
- ca-certificates
@ -110,11 +110,11 @@ scripts:
overrides:
deb:
depends:
- nodejs (>= 25)
- nodejs (>= 24)
- ca-certificates
rpm:
depends:
- nodejs >= 25
- nodejs >= 24
- shadow-utils
- ca-certificates

View file

@ -1,22 +1,22 @@
# snap/snapcraft.yaml — Snap recipe for Etherpad
#
# Design notes:
# - base: core24 chosen because Etherpad requires Node.js >= 25 and
# - base: core24 chosen because Etherpad requires Node.js >= 24 and
# core24 (Ubuntu 24.04 LTS) ships glibc/OpenSSL versions matching modern
# Node 25 binaries. core22 also works but ships older TLS/CA bundles.
# Node 24 binaries. core22 also works but ships older TLS/CA bundles.
# - confinement: strict. Etherpad is a pure Node.js HTTP service. The only
# native Node module (`rusty-store-kv`) ships as a prebuilt napi-rs
# binary, so no node-gyp compile is performed at install time and
# strict confinement works cleanly.
# - We use `dump` + a manual override-build (rather than the npm plugin)
# because this repo is a pnpm workspace and we pin Node.js 25 manually.
# because this repo is a pnpm workspace and we pin Node.js 24 manually.
name: etherpad
title: Etherpad
summary: Real-time collaborative document editor
description: |
Etherpad is a highly customizable open-source online editor providing
collaborative editing in real-time. This snap bundles Etherpad with a
pinned Node.js 25 runtime. On first launch a default `settings.json`
pinned Node.js 24 runtime. On first launch a default `settings.json`
is copied into `$SNAP_COMMON/etc` where it can be edited. Pad data is
stored in `$SNAP_COMMON/var` and survives snap refreshes.
@ -91,9 +91,9 @@ parts:
override-build: |
set -eu
# -- 1. Install Node.js 25 from the official tarball. Node 25 is the
# -- 1. Install Node.js 24 from the official tarball. Node 24 is the
# minimum supported runtime (see package.json engines.node).
NODE_VERSION=25.9.0
NODE_VERSION=24.15.0
ARCH="$(dpkg --print-architecture)"
case "${ARCH}" in
amd64) NODE_ARCH=x64 ;;
@ -109,8 +109,9 @@ parts:
export PATH="${CRAFT_PART_INSTALL}/opt/node/bin:${PATH}"
# -- 2. Install pnpm via corepack. Node 25 distributions no longer
# ship corepack, so install it from npm before activating pnpm.
# -- 2. Install pnpm via corepack. Install corepack from npm rather
# than relying on the bundled copy so the recipe still works on
# Node 25+, where corepack was dropped from the distribution.
"${CRAFT_PART_INSTALL}/opt/node/bin/npm" install \
--prefix "${CRAFT_PART_INSTALL}/opt/node" -g corepack@latest
corepack enable --install-directory "${CRAFT_PART_INSTALL}/opt/node/bin"

View file

@ -138,7 +138,7 @@
"vitest": "^4.1.6"
},
"engines": {
"node": ">=25.0.0",
"node": ">=24.0.0",
"npm": ">=6.14.0",
"pnpm": ">=11.1.2"
},