Require node 20 and record every place the version is pinned (#2168)

* Require node 20 and record every place the version is pinned

The declared floor was >=18 while CI, Docker and both .nvmrc files had
been on 20 since the pnpm 8 to 10 migration, and transitive dependencies
now require 20.18.1. The docs had drifted further still, telling
contributors to install Node 16 and PNPM 8.

* Set the node floor to the strictest dependency and keep one checklist

undici needs >=20.18.1, so a bare >=20 advertised support for 20.0 to
20.18.0, which fail dependency engine checks. frontend/CLAUDE.md already
carried a pinning checklist, so the new entries fold into it rather than
starting a rival list in the root file.

* Keep the node floor at the major, not a patch version

engines.node states the major we support. Individual dev dependencies
can be stricter within it, and chasing those patch floors into engines
and the docs would turn every lockfile refresh into a docs change.

CLAUDE.md

@@ -23,6 +23,7 @@
   - The example module replaces `github.com/umputun/remark42/backend` with `../../`, so it carries the backend's dependencies as indirect entries. Leaving them stale fails the `test examples` CI step with `go: updates to go.mod needed; to update it: go mod tidy`.
   - This applies to Dependabot pull requests too: the bot updates `backend/` only, so its Go module PRs need the example tidied before they can go green.
 
+
 ## Release Procedure
 
 Remark42 uses two tags for each release:
@@ -42,7 +43,7 @@ git push origin backend/vX.Y.Z
 
 GoReleaser must ignore `backend/*` tags in `.goreleaser.yml` so release notes and current-tag detection use only product tags. Docker image publishing stays separate and is handled by the existing Docker workflow.
 
-For local artifact runs, install GoReleaser, Go 1.25, Node 16+, PNPM 8, and Perl, then use `make release`. The target runs a snapshot/no-publish GoReleaser build, leaves local artifacts and metadata in `dist/`, and cleans generated frontend embed files after GoReleaser exits. Do not run raw `goreleaser release` for local artifacts unless you also run `./scripts/cleanup-release-assets.sh` afterward.
+For local artifact runs, install GoReleaser, Go 1.25, Node 20+, PNPM 10, and Perl, then use `make release`. The target runs a snapshot/no-publish GoReleaser build, leaves local artifacts and metadata in `dist/`, and cleans generated frontend embed files after GoReleaser exits. Do not run raw `goreleaser release` for local artifacts unless you also run `./scripts/cleanup-release-assets.sh` afterward.
 
 ## Milestones and Issue Labels
 

frontend/CLAUDE.md

@@ -12,10 +12,14 @@ CI staying green does **not** mean every pin is consistent — `.nvmrc` in parti
 - `frontend/.nvmrc`, `site/.nvmrc` — not read by CI at all; only matters to a human running `nvm use` locally. This is the one that drifted unnoticed: it sat at `16` through the whole node-20 migration because nothing red ever pointed at it.
 - Every `package.json`'s `packageManager` field (`frontend/package.json`, `frontend/apps/remark42/package.json` — `frontend/e2e/package.json` has none) and `frontend/apps/remark42/package.json`'s `engines` block
 - `pnpm/action-setup@vN` blocks in `.github/workflows/ci-frontend.yml` (5) and `release.yml` (2) — pin `version:` to the **exact** patch (e.g. `10.10.0`), matching `packageManager`, not just the major. A floating major here is silent in CI (it just resolves to whatever the latest patch is at run time) but breaks the "Dockerfile and CI use the same pnpm" guarantee.
+- `node:` matrices in `.github/workflows/ci-frontend.yml` (every entry, not just the first) and the `node-version:` values in `release.yml`
+- `site/package.json`'s `engines.node` and `engines.yarn` (site uses yarn, so its `packageManager` moves independently)
 - `frontend/e2e/package.json`'s `@playwright/test`/`playwright` versions must match `frontend/Dockerfile.e2e`'s base image tag exactly, or the e2e container's bundled browser revision mismatches what the npm package expects.
 
 When bumping pnpm/node, also re-check `frontend/apps/remark42/package.json`'s `engines` field — it's separate from `packageManager` and won't update itself.
 
+`engines.node` states the major we support, currently `>=20`, and the docs say the same. Individual dev dependencies can be stricter within that major (`undici` wants `>=20.18.1`), which any current Node 20 satisfies; do not chase those patch floors into `engines` or the docs, or every lockfile refresh becomes a documentation change.
+
 ## pnpm 10's stricter `node-linker` layout needs explicit pins
 
 A few deps needed pinning specifically because of pnpm 10's hoisting changes, not because of the deps themselves:

frontend/apps/remark42/package.json

@@ -22,7 +22,7 @@
     "translation:check": "node ./tasks/checkTranslation.js"
   },
   "engines": {
-    "node": ">=18",
+    "node": ">=20",
     "pnpm": ">=10"
   },
   "packageManager": "pnpm@10.10.0",

site/src/docs/contributing/frontend/index.md

@@ -20,8 +20,8 @@ While developing, we set up environment which imitates real world example. We se
 
 You must have at least 2GB RAM or swap enabled for building.
 
-- install [Node.js 16](https://nodejs.org/en/) or higher (we recommend using [NVM](https://github.com/nvm-sh/nvm) for node version autoswitch)
-- install [PNPM 8](https://pnpm.io/installation)
+- install [Node.js 20](https://nodejs.org/en/) or higher (we recommend using [NVM](https://github.com/nvm-sh/nvm) for node version autoswitch)
+- install [PNPM 10](https://pnpm.io/installation)
 - run `pnpm i` inside `./frontend`
 
 Running `pnpm i` will set up pre-commit hooks into your git repository. They are used to reformat your frontend code using `prettier` and lint with `eslint` and `stylelint` before every commit.

site/src/docs/getting-started/installation/index.md

@@ -29,7 +29,7 @@ _This is the recommended way to run Remark42_
 - download [archive for the stable release](https://github.com/umputun/remark42/releases)
 - unpack with `gunzip` (Linux, macOS) or with `zip` (Windows)
 - run as `remark42.{os}-{arch} server {parameters...}`, i.e., `remark42.linux-amd64 server --secret=12345 --url=http://127.0.0.1:8080`
-- alternatively compile from the sources - `make OS=[linux|darwin|windows] ARCH=[amd64,386,arm64,arm]`. Source binary builds require Go 1.25, Node 16+, PNPM 8, and Perl because the frontend assets are built and embedded locally.
+- alternatively compile from the sources - `make OS=[linux|darwin|windows] ARCH=[amd64,386,arm64,arm]`. Source binary builds require Go 1.25, Node 20+, PNPM 10, and Perl because the frontend assets are built and embedded locally.
 
 #### Installation as a systemd Service
 
@@ -129,4 +129,4 @@ To verify if Remark42 has been properly installed, check a demo page at `${REMAR
 ### Build from the source
 
 - to build Docker container - `make docker`. This command will produce container `ghcr.io/umputun/remark42`
-- to build a single binary for direct execution - `make OS=<linux|windows|darwin> ARCH=<amd64|386>`. This requires Go 1.25, Node 16+, PNPM 8, and Perl, builds frontend assets locally, and produces an executable `remark42` file with everything embedded
+- to build a single binary for direct execution - `make OS=<linux|windows|darwin> ARCH=<amd64|386>`. This requires Go 1.25, Node 20+, PNPM 10, and Perl, builds frontend assets locally, and produces an executable `remark42` file with everything embedded