chore(deps): bump sanitize-html to 2.17.7 and move to node 24 - #784
Closed
rickstaa wants to merge 1 commit into
Closed
chore(deps): bump sanitize-html to 2.17.7 and move to node 24#784rickstaa wants to merge 1 commit into
rickstaa wants to merge 1 commit into
Conversation
sanitize-html 2.17.7 loads the ESM-only htmlparser2 v12 from CommonJS, which failed at runtime on the Vercel 22.x functions and broke every ENS lookup. Node 24 is Vercel's current default and runs the route, so align engines, .nvmrc, .tool-versions, CI and the Dockerfile with it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
It changes the production runtime baseline (Node upgrade + ESM dependency chain) and should be manually validated on the Vercel preview per the PR’s deployment checklist.
Pull request overview
This PR re-lands the sanitize-html upgrade (to 2.17.7) and resolves the prior Vercel runtime ERR_REQUIRE_ESM failure by moving all Node.js pins in the repo to Node 24, aligning with Vercel’s current default runtime.
Changes:
- Bump
sanitize-htmlto^2.17.7(bringing inhtmlparser2@12, which is ESM-only). - Update all Node version pins to Node 24 across
package.jsonengines, local dev version files, CI workflows, and Docker images.
File summaries
| File | Description |
|---|---|
| pnpm-lock.yaml | Updates lockfile to sanitize-html@2.17.7 and new transitive dependencies (including htmlparser2@12). |
| package.json | Bumps sanitize-html dependency and sets engines.node to 24.x (affects Vercel runtime selection). |
| Dockerfile | Switches builder and runtime images from node:22 to node:24. |
| .tool-versions | Updates asdf Node pin to 24.11.0. |
| .nvmrc | Updates nvm Node major to 24. |
| .github/workflows/lighthouse-vercel-preview.yml | Updates CI setup-node version from 22 to 24 for Lighthouse preview job. |
| .github/workflows/ci.yml | Updates CI setup-node version from 22 to 24 for lint/typecheck/test. |
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
- Files reviewed: 6/7 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This was referenced Sep 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-lands #777, which was reverted in #782.
sanitize-html 2.17.7 depends on htmlparser2 v12, which is ESM-only. Loading it from CommonJS failed at runtime on the Vercel 22.x function runtime, so
/api/ens-data/[address]returned 500 and search stopped working. Node 24 runs it fine, and it is Vercel's current default, so this moves every Node pin to 24:engines,.nvmrc,.tool-versions, both CI workflows, and the Dockerfile. Sinceenginesoverrides the Vercel project setting, this is what actually switches the runtime.Before merging, open the Vercel preview and check
/api/ens-data/0x597ad7f7a1c9f8d0121a9e949cca7530f2b25ef6returns JSON and that search works. Production stays on 22 until this merges.Verified locally on Node 24.11: production build, then
GET /api/ens-dataand/api/ens-data/[address]on the built server return 200 with sanitized payloads; 363 jest tests and typecheck pass.