fix: keep rechoir on v0.8 for Node.js 20 support by alexander-akait · Pull Request #4875 · webpack/webpack-cli

alexander-akait · 2026-10-16T15:56:10Z

Summary

This PR reverts the rechoir 1.0 update from #4873, as CodeRabbit flagged in its review.

rechoir@1.0.0 declares node >= 22.15.0, but webpack-cli supports >=20.9.0. On Node 20, installs fail under strict engine checks (Yarn 1, npm engine-strict).

Changes:

packages/webpack-cli/package.json: rechoir goes from ^1.0.0 back to ^0.8.0, and the lockfile is updated to match.
.changeset/update-rechoir-v1.md is deleted. It hasn't been released, so v1 never reaches the changelog.
The tsx loader comment in webpack-cli.ts goes back to describing rechoir 0.8's resolver.

ejs 7 and every other change from #4873 stay as they are.

Test plan

npm run build, npm run lint, prettier --check .
test/build/config, test/build/config-format and test/build/config-lookup, which cover the rechoir code path:
- Node 22: 141/141
- Node 20: 139 passed, 2 skipped

🤖 Generated with Claude Code

https://claude.ai/code/session_01KbymRVCYb4Cyn9e5vCaU8n

Generated by Claude Code

Summary by CodeRabbit

Chores
- Adjusted the CLI’s compatibility requirements for module loading.
- Clarified guidance about a limitation affecting package export maps. Runtime behavior is unchanged.

rechoir 1.0 declares `node >= 22.15.0`, while webpack-cli supports `>=20.9.0`, so installs on Node.js 20 with strict engine checks (Yarn 1, `engine-strict`) would fail. Go back to rechoir 0.8 and drop the unreleased v1 changeset, until webpack-cli raises its own Node.js floor. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KbymRVCYb4Cyn9e5vCaU8n

linux-foundation-easycla · 2026-10-16T15:56:17Z

✅ Unknown (f9f6eba)
❌ - login: @claude / name: Claude. The commit (f9f6eba) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please visit our EasyCLA portal and chat with our support bot.

One or more co-authors of this pull request were not found. You must specify co-authors in commit message trailer via:

Co-authored-by: name <email>

Supported Co-authored-by: formats include:

Anything <id+login@users.noreply.github.com> - it will locate your GitHub user by id part.
Anything <login@users.noreply.github.com> - it will locate your GitHub user by login part.
Anything <public-email> - it will locate your GitHub user by public-email part. Note that this email must be made public on Github.
Anything <other-email> - it will locate your GitHub user by other-email part but only if that email was used before for any other CLA as a main commit author.
login <any-valid-email> - it will locate your GitHub user by login part, note that login part must be at least 3 characters long.

Alternatively, if the co-author should not be included, remove the Co-authored-by: line from the commit message.

Please update your commit message(s) by doing git commit --amend and then git push [--force] and then request re-running CLA check via commenting on this pull request:

/easycla

changeset-bot · 2026-10-16T15:56:21Z

⚠️ No Changeset found

Latest commit: f9f6eba

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-10-16T15:56:42Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rechoir@1.0.0 ⏵ 0.8.0	⁺¹		^-4	⁺⁷

View full report

alexander-akait · 2026-10-16T15:56:46Z

Two notes on the checks:

EasyCLA is red because the commit author is Claude <noreply@anthropic.com>, and that identity can't sign the CLA. A code change won't clear it. chore(deps): update dependencies, rechoir v1 and ejs v7; harden stderr assertions #4873 had the same status before it was squash-merged.
No changeset is intentional. This PR only removes the rechoir v1 changeset, which was never released, so published packages have no net change to version.

Generated by Claude Code

github-actions · 2026-10-16T15:59:56Z

This PR is packaged and the instant preview is available (66ef3ef).

Install it locally:

npm

npm i -D create-webpack-app@https://pkg.pr.new/create-webpack-app@66ef3ef webpack-cli@https://pkg.pr.new/webpack-cli@66ef3ef

yarn

yarn add -D create-webpack-app@https://pkg.pr.new/create-webpack-app@66ef3ef webpack-cli@https://pkg.pr.new/webpack-cli@66ef3ef

pnpm

pnpm add -D create-webpack-app@https://pkg.pr.new/create-webpack-app@66ef3ef webpack-cli@https://pkg.pr.new/webpack-cli@66ef3ef

coderabbitai · 2026-10-16T16:00:41Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: adb3cf46-e8e4-4d8f-8146-bd598d98bc3c

📥 Commits

Reviewing files that changed from the base of the PR and between 9def039 and f9f6eba.

⛔ Files ignored due to path filters: 1

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing: 3

.changeset/update-rechoir-v1.md
packages/webpack-cli/package.json
packages/webpack-cli/src/webpack-cli.ts

💤 Files with no reviewable changes: 1

.changeset/update-rechoir-v1.md

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The rechoir dependency range changes from ^1.0.0 to ^0.8.0. The comment about the tsx/cjs loader fallback now states that the rechoir resolver does not support package exports maps, without limiting the claim to versions below 1. The Changeset entry for the rechoir v1 update is removed. Runtime behavior is unchanged.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to f9f6e

The dependency range returns to 0.8.x, matching the stated Node 20 compatibility goal; no actionable merge risk is evident in the supplied changes.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: keeping rechoir at v0.8 to preserve Node.js 20 support.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-10-16T16:01:53Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.96%. Comparing base (9def039) to head (f9f6eba).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4875      +/-   ##
==========================================
+ Coverage   94.87%   94.96%   +0.08%     
==========================================
  Files          14       14              
  Lines        5637     5637              
  Branches      846      848       +2     
==========================================
+ Hits         5348     5353       +5     
+ Misses        288      283       -5     
  Partials        1        1

Files with missing lines	Coverage Δ
packages/webpack-cli/src/webpack-cli.ts	`96.73% <100.00%> (-0.03%)`	⬇️

... and 2 files with indirect coverage changes

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9def039...f9f6eba. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

alexander-akait merged commit 66ef3ef into main Oct 16, 2026
34 of 35 checks passed

alexander-akait deleted the fix/revert-rechoir-v1 branch October 16, 2026 20:13

Navigation Menu

Repository navigation

fix: keep rechoir on v0.8 for Node.js 20 support - #4875

fix: keep rechoir on v0.8 for Node.js 20 support#4875
alexander-akait merged 1 commit into
mainfrom
fix/revert-rechoir-v1

alexander-akait commented Oct 16, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

linux-foundation-easycla Bot commented Oct 16, 2026

Uh oh!

changeset-bot Bot commented Oct 16, 2026

Uh oh!

socket-security Bot commented Oct 16, 2026

Uh oh!

alexander-akait commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 16, 2026

Uh oh!

codecov Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

alexander-akait commented Oct 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

linux-foundation-easycla Bot commented Oct 16, 2026

Uh oh!

changeset-bot Bot commented Oct 16, 2026

⚠️ No Changeset found

Uh oh!

socket-security Bot commented Oct 16, 2026

Uh oh!

alexander-akait commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 16, 2026

Walkthrough

Uh oh!

codecov Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

alexander-akait commented Oct 16, 2026 •

edited by coderabbitai Bot

Loading

github-actions Bot commented Oct 16, 2026 •

edited

Loading

codecov Bot commented Oct 16, 2026 •

edited

Loading