I read 65 CI files from 30 popular npm packages. 13 still run an end‑of‑life Node

说明与用途

作者检查了30个热门npm包的65个CI文件，发现其中13个仍在使用已停止支持的Node版本，可能导致安全和兼容性问题。

问题

Many popular npm packages still run tests on deprecated Node versions, misleading CI badge green status.

结果

Out of 65 CI files, 13 still run tests on Node versions that are no longer supported, exposing potential security and compatibility risks.

工作流

• 1. Clone or fetch .github/workflows/*.yml from target repos
• 2. Parse YAML to extract Node matrix entries
• 3. Compare each Node version against current LTS support
• 4. Detect obsolete or invalid entries (e.g., missing matrix rows, wrong locale names)
• 5. Report findings with actionable suggestions

证据

Thirteen of those 65 files execute at least one end‑of‑life Node somewhere.

来源

Both files still call actions/checkout@v2 and actions/setup-node@v2. The current major is v7.

来源