Nonceworks
MenuClose

latest now installs a Node.js 27 alpha

Written 4 November 2026

Written 2026-11-04 for teams whose CI asks for the newest Node.js instead of a version. The Node.js project tagged v27.0.0-alpha.0.0.0 on 2026-10-29 at 18:13 UTC, published as a pre-release on GitHub (release). The nodejs.org dist index lists it first, above 26.13.0. The latest folder still holds 26.13.0.

What installs the alpha

  • actions/setup-node with node-version: latest, current or node. It sorts the index by semver and takes the top entry (source). Open as setup-node#1660.
  • nvm with nvm install node or nvm install stable, in 0.39.1 and in 0.40.8, the newest release.
  • crytic/slither-action 0.4.0 to 0.4.2 without node-version (and without ignore-compile): it runs nvm install node.

The alpha ships npm 12.1.0. The npm 12 breaking changes include "npm view --json now always returns an array", dependency lifecycle scripts blocked unless allowScripts allows them, and unknown CLI flags that now throw.

Two failures in public CI

One account-abstraction SDK's npm cleanup job has failed every day since 2026-10-30. It pipes npm view <package> dist-tags --json through jq 'to_entries' to find tags to remove. npm 12 wraps the object in an array, so the only key is 0 (package name removed):

npm error 0 is not a dist-tag on <package>
##[error]Process completed with exit code 123.

Its 2026-10-29 run, on Node 26.13.0 and npm 11.20.0, passed.

One L2's Slither security scan stopped before Slither ran in all seven of its runs on 2026-11-03. nvm installed the alpha, then yarn 1.22.22 failed:

error follow-redirects@1.16.0: The engine "node" is incompatible with this module. Expected version ">=4.0". Got "27.0.0-alpha.0.0.0"

yarn 1 does not count a pre-release Node as inside ranges like >=4.0. In our test on the alpha it also failed >=18 and ^20 || ^22 || >=24, and passed * and >=0.10.0. A run on 2026-10-29 got Node 26.13.0 and passed.

What to do

We ran each of these offline in Docker against the 2026-11-04 index, with release tarballs checked against Node's signed checksums:

  • setup-node: node-version: 24 installed 24.22.2. lts/* reads the actions/node-versions manifest, whose newest LTS is 26.13.0.
  • slither-action: pass node-version: '24' or lts/*. nvm 0.39.1, the version the action installs, gave 24.22.2 and 26.13.0.
  • nvm: nvm install --lts gave 26.13.0 and nvm install 24 gave 24.22.2.
  • Scripts that read npm view --json: for an object or a single value, such as dist-tags or version, jq '(if type == "array" then .[0] else . end)' reads both npm 11 and npm 12 output. It does not fit list fields such as versions.

lts/* now means Node 26, whose release tarballs have no corepack (our Node 26 note).