Pin npm and node versions to ensure consistent updates with dependabot

[maureenlholland]

One-line summary

Same update as mozilla/bedrock#16906

Significant changes and points to review

Issue / Bugzilla link

Peer fields were added in Dependabot package-lock update: #806
These fields were being removed in local npm install steps. This is likely due to a mismatch in npm versions (although it is hard to diagnose as the peer field is not documented in npm, yet it is in npm GitHub PRs)

Testing

Run npm install locally and confirm the lock file does not add peer: true fields

Node upgrade tests: confirm the following run without error or noise

• make build
• make run

Integration test run 🟢 : https://github.com/mozmeao/springfield/actions/runs/20097490260

Environment details
  node: v24.11.1
  npm: 11.6.2
  yarn: 1.22.22

[janbrasna]

Somewhat surprisingly, here yet another version is being used in the build:

[janbrasna]

Springfield (unlike bedrock's Node 20) builds using Node 22: 🤷

springfield/Dockerfile

Line 24 in 28f9af5

FROM node:22.15.0-slim AS assets

[janbrasna]

The issue is Dependabot started "guessing" npm here as npm@11 after they added its support — and using a version in the middle of their peer prune dumpster fire as its cli to submit PRs, introducing dirty lockfiles:/

This would normally resolve itself over time when they start using the latest patch version, but they're stuck on a few back now:/ however luckily they take the engines field as a hard constraint (unlike your local CLI where it only advises warnings or error messages when consumed as a dependency on an incompatible runtime; but won't enforce any runtime versions on its own…) so either pinning 10.x, 11.5- or 11.6.4+ should do the trick.

[janbrasna]

What I wanted to say is fixing this actual issue is not directly/necessarily related to a Node 24 update, but it's nice to have anyway. (I'll post more details in the upstream review.)

[janbrasna]

I'm also adding more details about the hard pin version rationale in a tracking ticket:

• Node 24 upgrade mozilla/bedrock#16910

[maureenlholland]

mozilla/bedrock#16906 (comment)