Skip to content

[No QA] Upgrade Node to 26.5.0 and npm to 11.17.0#96205

Draft
NicolasBonet wants to merge 11 commits into
mainfrom
nicolas-node26-upgrade
Draft

[No QA] Upgrade Node to 26.5.0 and npm to 11.17.0#96205
NicolasBonet wants to merge 11 commits into
mainfrom
nicolas-node26-upgrade

Conversation

@NicolasBonet

@NicolasBonet NicolasBonet commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Explanation of Change

Upgrades Node from 20.20.2 to 26.5.0 and npm from 10.8.2 to 11.17.0 (the npm version bundled with Node 26.5.0, so nvm use gives the right npm with no extra steps), as part of a coordinated Node 26 upgrade across all Expensify repos.

Changes:

  • .nvmrc and package.json engines bumped to Node 26.5.0 / npm 11.17.0.
  • package-lock.json regenerated with npm 11. The previous lock was missing the @img/sharp-* platform-specific optional dependency entries, which npm 11's stricter npm ci sync validation rejects; regenerating restores them.

No runtime code changes — build/tooling only.

Fixed Issues

Proposal: https://expensify.slack.com/archives/C03TQ48KC/p1784011015927039

MOBILE-EXPENSIFY: https://github.com/Expensify/Mobile-Expensify/pull/14015

Tests

  1. Run nvm install 26.5.0 && nvm use 26.5.0.
  2. Run npm ci and verify it completes without errors.
  3. Run npm run typecheck-tsgo and verify it passes.
  4. Run npx jest tests/unit and verify results match main (20 pre-existing date-related failures occur identically on Node 20.20.2 and are unrelated to this change).
  • Verify that no errors appear in the JS console

Offline tests

None — tooling-only change with no runtime behavior.

QA Steps

// TODO: These must be filled out, or the issue title must include "[No QA]."

  • Verify that no errors appear in the JS console

PR Author Checklist

  • I linked the correct issue in the ### Fixed Issues section above
  • I wrote clear testing steps that cover the changes made in this PR
    • I added steps for local testing in the Tests section
    • I added steps for the expected offline behavior in the Offline steps section
    • I added steps for Staging and/or Production testing in the QA steps section
    • I added steps to cover failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
    • I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
    • I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).
  • I included screenshots or videos for tests on all platforms
  • I ran the tests on all platforms & verified they passed on:
    • Android: Native
    • Android: mWeb Chrome
    • iOS: Native
    • iOS: mWeb Safari
    • MacOS: Chrome / Safari
  • I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
  • I followed proper code patterns (see Reviewing the code)
    • I verified that comments were added to code that is not self explanatory
    • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
    • I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
  • If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
  • I followed the guidelines as stated in the Review Guidelines
  • I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
  • If a new CSS style is added I verified that:
    • A similar style doesn't already exist
    • The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))
  • If new assets were added or existing ones were modified, I verified that:
    • The assets are optimized and compressed (for SVG files, run npm run compress-svg)
    • The assets load correctly across all supported platforms.
  • If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
  • If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
  • If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
  • If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
  • If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
    • I verified that all the inputs inside a form are aligned with each other.
    • I added Design label and/or tagged @Expensify/design so the design team can review the changes.
  • I added unit tests for any new feature or bug fix in this PR to help automatically prevent regressions in this user flow.
  • If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.

Screenshots/Videos

Android: Native

No UI change — tooling only.

Android: mWeb Chrome

No UI change — tooling only.

iOS: Native

No UI change — tooling only.

iOS: mWeb Safari

No UI change — tooling only.

MacOS: Chrome / Safari

No UI change — tooling only.

@NicolasBonet
NicolasBonet requested a review from a team as a code owner July 15, 2026 18:42
@melvin-bot
melvin-bot Bot requested review from carlosmiceli and removed request for a team July 15, 2026 18:43
@melvin-bot

melvin-bot Bot commented Jul 15, 2026

Copy link
Copy Markdown

@carlosmiceli Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

@NicolasBonet NicolasBonet changed the title [No QA] Upgrade Node to 26.5.0 and npm to 11.17.0 [No QA] Upgrade Node to 26.5.0 Jul 15, 2026
@NicolasBonet NicolasBonet changed the title [No QA] Upgrade Node to 26.5.0 [No QA] Upgrade Node to 26.5.0 and npm to 11.17.0 Jul 15, 2026
@NicolasBonet
NicolasBonet marked this pull request as draft July 15, 2026 19:20
@codecov

codecov Bot commented Jul 15, 2026 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
see 35 files with indirect coverage changes

NicolasBonet
NicolasBonet commented Jul 16, 2026
View reviewed changes
Comment thread .github/workflows/lint.yml
Comment on lines +54 to +58
env:
# See the runs-on comment: each worker needs ~12GB of heap on a cold cache, so run
# 2 workers with a 14GB cap instead of ESLint's defaults (4 workers, 8GB cap).
ESLINT_CONCURRENCY: 2
NODE_OPTIONS: --max_old_space_size=14336

@NicolasBonet NicolasBonet Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This might be a temporal fix as right now ESLint's result cache hashes ${eslintVersion}_${nodeVersion}_${config} (node_modules/eslint/lib/cli-engine/lint-result-cache.js:50);, so the migration Node 20 → node 26 invalidates every cache entry forcing a lint of the entire repo, verified empirically: warm cache re-lint 5s on same Node, 62s (full) when Node 26 reads Node 20's cache.

We might be able to reverse this part when we start to cache under the new nodeVersion

NicolasBonet and others added 10 commits July 16, 2026 17:03
@NicolasBonet
Patch yargs to expose a .cjs entry for Node 26
cc583e3 
Node 26 applies the nearest package.json "type" to extensionless files, so requiring the extensionless yargs/yargs file (package has type: module) now fails in ESM scope. The patch points the ./yargs subpath require condition at a .cjs copy.
@NicolasBonet
Upgrade Node to 26.5.0 and npm to 11.17.0
fe76b42
@NicolasBonet
Keep npm at 10.8.2, pinning it in CI, and only upgrade Node
18c2867
@NicolasBonet
Revert "Keep npm at 10.8.2, pinning it in CI, and only upgrade Node"
7457f1b 
This reverts commit b639c1a.
@NicolasBonet
Move yargs patch into per-package directory with details.md
4570391
@NicolasBonet
Allow Node 20.20.2 or 26.5.0 during the upgrade transition
953ebcf 
HybridApp builds couple App and Mobile-Expensify: App CI builds from the Mobile-Expensify submodule and Mobile-Expensify CI installs App from main, so exact engine pins on either side cannot merge in any order. Both repos accept both versions until the upgrade lands everywhere, then a follow-up tightens the pins.
@NicolasBonet @claude
Bump Mobile-Expensify to allow Node 26.5.0 during the upgrade transition
5a0afbb 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@NicolasBonet @claude
Run ESLint on an 8vcpu runner so cold-cache lint fits in worker heaps
ea9c8f1 
ESLint's result cache hashes the Node version, so the Node 26 upgrade
invalidates every cache entry and forces a full-repo relint. On a 4vcpu
runner --concurrency=auto spawns only 2 workers, and half the repo of
type-aware linting exceeds each worker's 8GB heap cap, failing with
ERR_WORKER_OUT_OF_MEMORY. With 4 workers the full lint peaks around
25GB total, which fits on the 8vcpu (32GB) runner.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@NicolasBonet @claude
Pin ESLint CI to 2 workers with a 14GB heap cap
a8aeb9e 
ESLint's result cache hashes the Node version, so the Node 26 upgrade
invalidates every cache entry and forces a full-repo relint. Type-aware
linting loads the full TypeScript program in every worker (~12GB of heap
each, regardless of how files are split), so any worker count dies at
the default 8GB cap. Two workers with a 14GB cap complete a cold-cache
lint in ~6 minutes and fit within the 8vcpu runner's 32GB of memory.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@NicolasBonet @claude
Write version.json to the compiler output path
f234a2f 
Node 26 loads the rsbuild TS config as native ESM, where CommonJS
globals like __dirname don't exist, so the dev server crashed with
'ReferenceError: __dirname is not defined' when resolving the dist
directory. Resolve it from compiler.outputPath instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@NicolasBonet
NicolasBonet force-pushed the nicolas-node26-upgrade branch from 83f1031 to f234a2f Compare July 16, 2026 23:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@carlosmiceli carlosmiceli Awaiting requested review from carlosmiceli

At least 1 approving review is required to merge this pull request.

Assignees

@NicolasBonet NicolasBonet

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@NicolasBonet