From 88c106b5d42982ebb63fa42ca43986b168dd9d7f Mon Sep 17 00:00:00 2001 From: Felipe Freitag Date: Wed, 23 Sep 2026 12:08:32 -0300 Subject: [PATCH] fix(react-email): upgrade chokidar to v5 chokidar 4.0.3 was published without npm provenance, so pnpm with trustPolicy set to no-downgrade refuses to install react-email. chokidar 5.0.0 and its only dependency readdirp 5 both carry provenance. The API used by the hot-reload watcher is unchanged. chokidar 5 requires Node 20.19, so the engines field moves from 20.0.0 to 20.19.0. Node 20 reached end of life on 2026-04-30. Closes #3728 --- .changeset/chokidar-v5-provenance.md | 5 +++++ packages/react-email/package.json | 4 ++-- pnpm-lock.yaml | 22 +++++++++++----------- 3 files changed, 18 insertions(+), 13 deletions(-) create mode 100644 .changeset/chokidar-v5-provenance.md diff --git a/.changeset/chokidar-v5-provenance.md b/.changeset/chokidar-v5-provenance.md new file mode 100644 index 0000000000..d4f5f7ae37 --- /dev/null +++ b/.changeset/chokidar-v5-provenance.md @@ -0,0 +1,5 @@ +--- +"react-email": minor +--- + +Upgrade `chokidar` to v5, which ships with npm provenance, so installs under pnpm's `trustPolicy: no-downgrade` no longer fail. The CLI now needs Node 20.19 or newer. diff --git a/packages/react-email/package.json b/packages/react-email/package.json index cbaca2fe61..ced9f087b1 100644 --- a/packages/react-email/package.json +++ b/packages/react-email/package.json @@ -38,7 +38,7 @@ "email" ], "engines": { - "node": ">=20.0.0" + "node": ">=20.19.0" }, "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc", @@ -48,7 +48,7 @@ "@babel/parser": "catalog:", "@babel/traverse": "catalog:", "@react-email/render": "workspace:>=2.1.0", - "chokidar": "^4.0.3", + "chokidar": "^5.0.0", "commander": "catalog:", "conf": "^15.0.2", "css-tree": "3.2.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a5d3cf29b9..d6b10f71f0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -673,8 +673,8 @@ importers: specifier: workspace:>=2.1.0 version: link:../render chokidar: - specifier: ^4.0.3 - version: 4.0.3 + specifier: ^5.0.0 + version: 5.0.0 commander: specifier: 'catalog:' version: 13.1.0 @@ -4995,9 +4995,9 @@ packages: resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==} engines: {node: '>= 8.10.0'} - chokidar@4.0.3: - resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==} - engines: {node: '>= 14.16.0'} + chokidar@5.0.0: + resolution: {integrity: sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==} + engines: {node: '>= 20.19.0'} chownr@1.1.4: resolution: {integrity: sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==} @@ -7858,9 +7858,9 @@ packages: resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==} engines: {node: '>=8.10.0'} - readdirp@4.0.2: - resolution: {integrity: sha512-yDMz9g+VaZkqBYS/ozoBJwaBhTbZo3UNYQHNRw1D3UFQB8oHB4uS/tAODO+ZLjGWmUbKnIlOWO+aaIiAxrUWHA==} - engines: {node: '>= 14.16.0'} + readdirp@5.1.1: + resolution: {integrity: sha512-Kko+Y5XQ6fM+Ce3dq3m9YGxnacYZYl9cA1wZjaF3Vbry2L3i1qVg8+CAgNPsXRArPMUMCaOR7oa9Nqntc43JKA==} + engines: {node: '>= 20.19.0'} recma-build-jsx@1.0.0: resolution: {integrity: sha512-8GtdyqaBcDfva+GUKDr3nev3VpKAhup1+RvkMvUxURHpW7QyIvk9F5wz7Vzo06CEMSilw6uArgRqhpiUcWp8ew==} @@ -13558,9 +13558,9 @@ snapshots: optionalDependencies: fsevents: 2.3.3 - chokidar@4.0.3: + chokidar@5.0.0: dependencies: - readdirp: 4.0.2 + readdirp: 5.1.1 chownr@1.1.4: optional: true @@ -17028,7 +17028,7 @@ snapshots: dependencies: picomatch: 2.3.2 - readdirp@4.0.2: {} + readdirp@5.1.1: {} recma-build-jsx@1.0.0: dependencies: