Supported majors
New MNPPI repositories start on the Standard major of each core tool. The
quality audit flags Unsupported majors. Current Quality - Private blocks
non-Standard majors on repositories created on or after blockingFrom.
The quality controls name Prettier,
ESLint, TypeScript, Vite, Astro, React, and Vitest. This page names the major
each high-cost tool may use. Patch and minor lines still move through Renovate
and the org minimumReleaseAge. Do not copy a dated patch pin into this
standard.
Machine-readable source: supported-majors.json in MNPPI/org-standards.
Status definitions
Section titled “Status definitions”| Status | Meaning |
|---|---|
| Standard | New repositories start here. This is the fleet target. allowedForNewRepos is true. |
| Next | A newer major approved for a planned, piloted migration. Renovate must not auto-bump to it. The new-repo gate passes. |
| Transitional | The previous major still has upstream security support. It has a mechanical end date. After that date it is Unsupported. Existing repos get an advisory only. New repos fail without an exception. |
| Allowed | Node.js Maintenance LTS only. Existing repos get no finding. New repos must not start here. |
| Unsupported | Upstream no longer ships security fixes, or the mechanical end date has passed. The audit reports it. |
allowedForNewRepos is false for every line that is not Standard.
New repositories and templates
Section titled “New repositories and templates”New repositories and templates must start on Standard majors. This repository has no package scaffold that pins an older major. If you add a template later, pin Standard only. Do not add a blocking check to the template itself.
A repository is new when its GitHub created_at date (UTC, first ten
characters) is on or after blockingFrom in supported-majors.json. The
current value is 2026-10-23. Every repository already in the fleet was
created before that date, so it stays advisory. Repositories with no
created_at are treated as existing.
Who acts
Section titled “Who acts”Transitional creates no work. Do not open a Cloud Agent for a Transitional finding.
Unsupported, an expired exception, or a missing expiry creates one batched migration item per repository. Standards runs one Cloud Agent per repository. This is not a recurring nag.
Promotion rule
Section titled “Promotion rule”Standard is the newest major that meets all three:
- Its first release is at least as old as the org
minimumReleaseAge. - Its key plugins and peers support it.
- At least one successful pilot, or a production repository in the fleet, already runs it.
Older majors that upstream still supports are Transitional and get a mechanical end date. Next is a newer major with no pilot and no production repo yet. Majors are never adopted by merging a Renovate major pull request. They go through a planned migration with Mark’s GO.
New repositories must start on Standard. Picking an older major needs a
recorded exception in supported-majors.json and the
exception process.
Current majors
Section titled “Current majors”Reviewed 22 October 2026 from npm publish times, upstream security pages, the
nodejs.org release schedule, Quality Audit run 39791821686, and a survey of
each managed repo’s root package.json on main. Each row has a short
fleet-today note from that survey.
Node.js here is the CI and tooling runtime from .nvmrc or .node-version.
engines.node is human guidance, not an audit input. The Cloudflare Workers
runtime (compat date plus nodejs_compat) is out of scope.
Status
Section titled “Status”| Tool | Standard | Next | Transitional | Unsupported |
|---|---|---|---|---|
| vite | 8 | — | 7 until 2027-01-20; 6 until 2027-01-20 | 5 and older |
| vitest | 4 | 5 | — | 3 and older |
| react | 19 | — | 18 until 2027-01-20 | 17 and older |
| typescript | 6 | 7 | 5 until 2027-01-20 | 4 and older |
| astro | astro 7 | — | astro 6 until 2027-01-20 | astro 5 and older |
| Node.js | 24 | 26 | — | 20 and older |
| pnpm | 11 | 12 | 10 until 2027-01-20 | 9 and older |
| wrangler / cf CLI | wrangler 4 | cf 1 | wrangler 3 until 2027-01-20 | wrangler 2 and older |
Node 22 is Maintenance LTS until 2027-04-30. It is Allowed, not Transitional. Existing repos get no finding. New repos must start on 24.
TypeScript 6 is Standard because four production repos already run it. 5 is Transitional until 2027-01-20. 7 stays Next.
cf 1.0.0-beta is Next, not Standard, because it is still an open-beta pilot.
New Vite-ready Workers that have a Worker entry still follow the
cf CLI standard. Assets-only Astro
stays on labeled transitional Wrangler 4.
Why, who acts, and upstream source
Section titled “Why, who acts, and upstream source”| Tool | Why | Who / when | Upstream |
|---|---|---|---|
| vite | vite.dev/releases still ships security patches to 8.3, 7.3, and 6.4. Nine production repos already run Vite 8. A production repo counts as a pilot. 8.0.0 published 2026-03-12. | Standards Cloud Agent, one repository per session. When a resolved major is Unsupported or an exception expires. Transitional creates no work. | https://vite.dev/releases |
| vitest | The fleet Vitest 4 migration completed 2026-09-16. wkd-proxy-worker resolves 4.1.11. Vitest 5 has no production repo; pool-workers still peers vitest ^4.1.0. | Standards Cloud Agent, one repository per session. When a resolved major is Unsupported or an exception expires. Transitional creates no work. | https://github.com/vitest-dev/vitest/blob/main/docs/releases.md |
| react | Seven repos run React 19 (namepicker, packing-checklist, jobsystem, mnppi-org, demo-crm, zuricert, and one additional production app). endorfun-rebuild and personal-finance stay on 18.3.1. No React 20. React’s versioning policy backports security fixes to affected majors. | Standards Cloud Agent, one repository per session. When a resolved major is Unsupported or an exception expires. Transitional creates no work. | https://react.dev/community/versioning-policy |
| typescript | Four repos already run TypeScript 6: airport-time-calc, packing-checklist, and mnppi.github.io pin typescript ^6.0.3; demo-crm pins @typescript/typescript6 ^6.0.2. The rest of the fleet is on 5.7-5.9. 7 stays Next. SUPPORT.md services the latest release. | Standards Cloud Agent, one repository per session. When a resolved major is Unsupported or an exception expires. Transitional creates no work. | https://github.com/microsoft/TypeScript/blob/main/SUPPORT.md |
| astro | Six repos run Astro 7: airport-time-calc, uihq-landing, tesseract, jobsystem, mnppi-org, and org-standards (7.2.8). Astro 7.0.0 published 2026-06-22. Astro’s GitHub security policy has no supported-majors table. | Standards Cloud Agent, one repository per session. When a resolved major is Unsupported or an exception expires. Transitional creates no work. | https://github.com/withastro/astro/security |
| Node.js | Fleet CI already runs Node 24. schedule.json: 24 maintenance 2026-10-20, 26 Active LTS 2026-10-28, 22 Maintenance until 2027-04-30, 20 EOL 2026-04-30. This table is CI and tooling Node only. | Standards Cloud Agent, one repository per session. When the line is EOL. Maintenance LTS creates no finding and no work. | https://github.com/nodejs/Release/blob/main/schedule.json |
| pnpm | 18 repos pin pnpm 11.x. namepicker and packing-checklist pin 10.27.0; workers-builds-notify pins 10.33.3. pnpm SECURITY.md supports 12.x, and 11.x and 10.x until 2027-04-30. 9.x and older are unsupported. endorfun-rebuild uses npm@10.9.2 and is out of this row. | Standards Cloud Agent, one repository per session. When a resolved major is Unsupported or an exception expires. Transitional creates no work. | https://github.com/pnpm/pnpm/security |
| wrangler / cf CLI | Cloudflare’s SDK ecosystem policy actively supports only the latest major; critical security fixes for older majors are case by case. The Wrangler v4 announcement keeps v3 on bug fixes through Q1 2026 and critical security updates through Q1 2027. org-standards and wkd-proxy-worker resolve wrangler 4. cf 1.0.0-beta is accepted for pilots, not a fleet default. | Standards Cloud Agent, one repository per session. When a resolved major is Unsupported or an exception expires. Transitional creates no work. | https://developers.cloudflare.com/fundamentals/reference/sdk-ecosystem-support-policy/ |
Fleet today
Section titled “Fleet today”| Tool | Fleet today |
|---|---|
| vite | 9 production repos on 8 (airport-time-calc, uihq-landing, org-standards, tesseract, workers-builds-notify, twintech-reia-rewrite, packing-checklist, botmail-worker, and one additional production app). pyndale started on 6. |
| vitest | Fleet on 4 (wkd-proxy-worker 4.1.11). Vitest 4 migration completed 2026-09-16. No Vitest 5 production repo. |
| react | 19 in namepicker, packing-checklist, jobsystem, mnppi-org, demo-crm, zuricert, and one additional production app. 18.3.1 in endorfun-rebuild and personal-finance. |
| typescript | 6.x in airport-time-calc, packing-checklist, mnppi.github.io (^6.0.3) and demo-crm (@typescript/typescript6 ^6.0.2). Every other repo is on 5.7-5.9. |
| astro | 7.x in airport-time-calc, uihq-landing, tesseract, jobsystem, mnppi-org, and org-standards. |
| Node.js | Fleet CI on 24. org-standards .nvmrc 22.23.1 is Allowed. No 26 pin. |
| pnpm | 11.x in 18 repos. 10.x in namepicker, packing-checklist (10.27.0), and workers-builds-notify (10.33.3). endorfun-rebuild uses npm@10.9.2 and is out of scope. |
| wrangler / cf CLI | org-standards 4.113.0; wkd-proxy-worker 4.123.0. cf pilots: airport-time-calc, tesseract. |
Peers stay on the parent row. They are not separate audit rows.
- vite:
@vitejs/plugin-react,@cloudflare/vite-plugin - vitest:
@cloudflare/vitest-pool-workers - react:
react-dom - typescript:
@typescript/typescript6 - astro:
@astrojs/starlight - wrangler:
cf
A Transitional end date is the earlier of upstream security EOL or 90 days after the successor major was promoted to Standard. Past that date the line is Unsupported.
Upgrading a major
Section titled “Upgrading a major”-
One repository per Cloud Agent.
Do not open a fleet-wide major in one session.
-
Baseline the old major.
Record the current test, build, and preview-deploy results before you change the lockfile.
-
Add missing tests.
Cover the paths the upgrade is likely to break. Do not drop coverage to make the new major pass.
-
Upgrade to a release that is at least as old as the org
minimumReleaseAge.Do not add
minimumReleaseAgeExclude. Do not merge a Renovate major as the adoption path. -
Run the full suite.
Tests, production build, and a preview deploy must pass. Compare the result to the baseline.
-
Merge, then wave.
Start with low-risk repositories. Move to flagship last. Promote the major to Standard only after Mark’s GO and the promotion rule above.
Exceptions
Section titled “Exceptions”Record a major exception in supported-majors.json with owner, reason,
created, and expires. Expiry is at most 90 days. Renew once. An expired
or missing-expiry exception is a finding. Also follow the
exception process.
Audit signal
Section titled “Audit signal”The weekday quality audit reports, per managed repository, any direct dependency that resolves to an Unsupported major. It also reports Transitional majors on existing repositories. Those findings are advisory. They must not fail the central quality-audit workflow.
Current Quality - Private runs the same classifier on pull requests. For a
repository created on or after blockingFrom, a Transitional, Unsupported, or
other non-Standard line without a valid unexpired exception fails that
existing check. Next and Standard pass. The required-check name does not
change.
The audit reads lockfiles when it can. It does not change Renovate, branch protection, or security settings.