fix: npmx connector Node.js v22 compatibility

[DDeenis]

🔗 Linked issue

Resolves #2645

🧭 Context

npmx-connector currently crashes for users trying to run it with Node.js 22, which is still in the maintenance and used by many people. This PR fixes the only incompatible function (packageInit).

📚 Description

Node v24+ only features used:

• mkdtempDisposable - for temp dir creation
• await using - to ensure the temp dir cleanup

Replaced with compatible versions:

• mkdtempDisposable -> mkdtemp
• Automatic disposal with await using -> Manual disposal with rm

Fix verified on Node v22

Tradeoffs: if both the function code and rm will throw, only the error from rm would be preserved. Should be possible to fix at a cost of complex cleanup logic, but the situation seems unlikely.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
npmx.dev	Ready	Preview, Comment	May 1, 2026 6:15pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs.npmx.dev	Ignored	Preview	May 1, 2026 6:15pm
npmx-lunaria	Ignored		May 1, 2026 6:15pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e2bbdef0-fb67-4e16-90d4-8e738c66a934

📥 Commits

Reviewing files that changed from the base of the PR and between ca18086 and 0b0cfb6.

📒 Files selected for processing (1)

• cli/src/npm-client.ts

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved package publishing robustness: better handling of publish failures, clearer error propagation, and ensured cleanup of temporary files/directories even when errors occur.
  • Reduced risk of leaving temporary artefacts behind by making cleanup more reliable and preserving original publish errors for diagnostics.

Walkthrough

packageInit in cli/src/npm-client.ts now uses mkdtemp to create a temp directory (captured as tempDirPath), updates temp-path references, reorganises the publish flow to record publishResult and publishError instead of exiting immediately, and performs explicit cleanup that can attach the publish error as the cleanup error’s cause before re-throwing.

Changes

Cohort / File(s)	Summary
NPM client / publish flow cli/src/npm-client.ts	Replaced mkdtempDisposable/await using with mkdtemp and tempDirPath variable; updated all temp-path references. Reworked publish logic to capture publishResult and publishError in a try and perform rm cleanup in finally; if cleanup fails and a publish error exists, attach it as the cleanup error’s cause before throwing. Added explicit guard to throw if publishResult is unexpectedly null.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: fixing Node.js v22 compatibility in the npmx connector by addressing incompatible features.
Description check	✅ Passed	The description is directly related to the changeset, explaining the Node.js v22 compatibility issue, the specific features being replaced, and verification details.
Linked Issues check	✅ Passed	The PR directly addresses the linked issue #2645 by replacing Node v24+ specific APIs (mkdtempDisposable and await using) with Node v22 compatible alternatives (mkdtemp and manual rm cleanup).
Out of Scope Changes check	✅ Passed	All changes are scoped to fixing Node.js v22 compatibility in the packageInit function with no extraneous modifications.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@cli/src/npm-client.ts`:
- Around line 625-627: The cleanup in the finally block calls await
rm(tempDirPath, { recursive: true, force: true }) which can mask an earlier
error from the try block; change the finally to capture any earlier error (store
the caught error from the try/catch or wrap the try in a variable like
originalError), then perform the rm inside its own try/catch and if the cleanup
fails, log or attach the cleanup error but rethrow the original error (or throw
the cleanup result only if there was no originalError). Specifically, update the
code around the rm(tempDirPath, ...) call so that rm failures do not overwrite
the original publish/write failure—use a nested try/catch in the finally or
Promise.allSettled and rethrow originalError (or return successful result)
accordingly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2d591085-20d8-4301-833c-0652272d221e

📥 Commits

Reviewing files that changed from the base of the PR and between 5eab00c and ca18086.

📒 Files selected for processing (1)

• cli/src/npm-client.ts

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[ghostdevv]

holding this while we check we definitely want to downgrade the Node version we support

also this is effectively a revert of #2365

[DDeenis]

@ghostdevv okay, this makes more sense. In this case, the issue is that Node 22 users don't get a warning of unsupported engine. Feel free to close this PR in case the downgrade is unwanted.