Dependency minimatch@10 does not support Node 18, so it is wrong for this package to claim to

[DavidAnson]

Environment

Node version: 18
npm version: N/A
ESLint version: N/A
eslint-plugin-n version: Multiple
Operating System: N/A

Engines:

eslint-plugin-n/package.json

Line 6 in 90de242

"node": "^18.18.0 || ^20.9.0 || >=21.1.0"

Dependency:

eslint-plugin-n/package.json

Line 27 in 90de242

"minimatch": "^9.0.5",

Dependency engines:
https://github.com/isaacs/minimatch/blob/346685ced5203464bb10fd3d4dfa6964f6102ede/package.json#L53

What rule do you want to report?

N/A

Link to Minimal Reproducible Example

N/A

What did you expect to happen?

npm install for a package using this one should succeed when engine-strict=true instead of failing: https://github.com/DavidAnson/markdownlint/actions/runs/13622041054/job/38073048229#step:4:1

Participation

• I am willing to submit a pull request for this issue.

Additional comments

N/A

[DavidAnson]

Actually, caret versioning above for v9 should not use v10, so maybe this is a transitive dependency? The problem reveals itself in a Dependabot update of this package from 17.5.1 to 17.6.1: DavidAnson/markdownlint#1526

[DavidAnson]

I can provide more info later if needed, but not from my phone.

[scagood]

It looks to be transitive from ts-declaration-location@1.0.5

PR cause: #392

---

I wonder if CI run passed because we used the --force flag

[ghiscoding]

I got the same engine error when using Yarn 1.x (legacy),

I could also confirm the same as above that ts-declaration-location seems the dependency, and only one dep, causing the minimatch@10 breaking change.

With Yarn it simply won't let me install it and will throw the error shown, I could use yarn install --ignore-engines to install it, which I did to run the yarn why minimatch command which is showing the result above.

[DavidAnson]

@scagood If you are worried about also seeing markdownlint-cli in your output above (I was! :) ), that engines problem was fixed in release 0.44.0 by downgrading the two relevant dependencies: igorshubovych/markdownlint-cli@fc06ac9

[scagood]

@RebeccaStevens Would it be possible to resolve the minimatch version in RebeccaStevens/ts-declaration-location?

[RebeccaStevens]

@scagood It looks like v10 of minimatch is the same as v9 minus the support for node 18. I should be able to just switch to using v9.

As an alternative, in this package you could add an override. This will prevent this issue arising again if another package upgrade minimatch to v10 or newer:

// package.json
{
    // ...
    "overrides": {
        "minimatch": "^9.0.5"
    },
}

Note: I haven't confirmed whether or not consuming packages will respect this override or not.

[scagood]

I don't think overrides cascade to which ever package imports eslint-plugin-n 🤔

[ghiscoding]

I don't think overrides cascade to which ever package imports eslint-plugin-n 🤔

it worked for me with yarn resolutions, though I really think ts-declaration-location should downgrade its minimatch version to v9 since v10 was a breaking version and it should be reflected accordingly (it wasn't tagged as a breaking version when bumped in ts-declaration-location but I think it should have been, there's still time to correct it though)

"resolutions": {
  "minimatch": "^9.0.5"
}

[RebeccaStevens]

ts-declaration-location 1.0.6 now uses minimatch: ^9.0.5