AntFleet

Disagreement · 3376e50a-anthropic-1

Non-existent @types/node major version pinned in devDependencies

mismatch
repo 53606958·PR #4·reviewed 1 week ago

Primary finding

Non-existent @types/node major version pinned in devDependencies

highbuild-releasehigh
  • package.json:18
`@types/node` follows Node's major version line; the highest published majors at the time of this PR are in the low-20s (matching Node 20/22/24). `^25.6.0` does not exist on npm, so `npm install` will fail with ETARGET. Combined with the engines field declaring `node >=20.0.0`, the intended target is Node 20+, for which `@types/node@^20` or `^22` is appropriate.

Recommendation

Pin `@types/node` to a range that actually exists and matches the supported Node engine, e.g. `^20.11.0` or `^22.0.0`.

Counterpart finding

Engines allow Node 20.0.0, but scripts require `--import` which may not be supported in earliest 20.x

mediumbuild-releasemedium
  • package.json:15
  • package.json:8
The `--import` flag used in scripts relies on Node ESM hooks support that was stabilized in later 20.x releases. On the earliest Node 20.0.0 versions, `--import` may be unsupported, causing script failures even though it satisfies the engines constraint.

Recommendation

Either tighten `engines.node` to a minimal version known to support `--import` (e.g., ">=20.6.0" after verifying), or adjust scripts to avoid `--import` by invoking tsx directly, e.g., `"harness:tick": "tsx harness/index.ts"` and `"lint:identity": "tsx scripts/lint-identity.ts"`.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →

From the same review

These findings passed the unanimous gate on the same PR review. The disagreement above was filtered out; the findings below were posted.