Pull Request resolves # .

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

Since a couple of days, the "Install JS/CSS dependencies and build assets" action in our CI workflow fails for new PRs which target the 5.4-dev branch, and it fails also for the last commit in the 5.4-dev branch after I had deleted the GitHub action cache for that branch and started the workflow again.

The reason is node.js having started their alpha phase for their new major version 27, and they insist on it being offered to clients which request the latest NPM version like we do it in our CI workflow. See their discussion here: nodejs/node#67135 .

So if you want to run your tests with the latest node.js version, you currently get node.js version "v27.0.0-alpha.0.0.0", see e.g. the log of the Run actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e step here: https://github.com/joomla/joomla-cms/actions/runs/40466466711/job/124178576545#logs

The "build/build.mjs" script in the 5.4-dev branch contains 2 checks for the node.js version, one which is run at the very beginning and uses semver.gte, and another one in function allowedVersion which uses semver.satisfies. The latter fails because semver.satisfies by default does not allow pre-releases, you can see that at the beginning of the "Build assets" step in the log:

Command line tools require Node Version >=20.0.0 but found v27.0.0-alpha.0.0.0

In 6.2-dev, the assets build scripts have been refactored with PR #46879 . The 2nd version check mentioned above has been removed, that's why it does not fail in 6.2-dev and above.

This pull request (PR) fixes that 2nd version check by using semver.coerce to reduce the version to a plain semver version, e.g. "v27.0.0-alpha.0.0.0" is reduced to "27.0.0". This makes the "build/build.mjs" script in the 5.4-dev branch work like it does on 6.2-dev and above, without losing that additional check completely, as it might still make sense in 5.4-dev due to the different parallelisation of the asynchronous javascript compared to 6.2-dev and above.

Currently there is no way excluding alpha or other pre-release versions when using the "latest" as node version in our CI action.

The alternative would be to not use "latest" as version but the major version 26 here: https://github.com/joomla/joomla-cms/blob/5.4-dev/.github/workflows/ci.yml#L39 .

For 5.4-dev this could be sufficient as 5.4 is in security only support mode.

But if we also want to do that on the other branches in order not to get an alpha version, then it would need to maintain that major version in the .github/workflows/ci.yml and change it with every new major after its alpha phase. This would be additional maintenance effort, so I suggest to leave 6.2-dev and above as they are, as long as that works.

Note on Failing PHPstan in CI checks

The failing PHPstan in the 5.4-dev branch and also for this PR is another issue which is not handled with this PR here.

Hint For 6.2 Release Managers

@drmenzelit @MacJoom When you do an upmerge after this PR has been merged into 5.4-dev, you should make sure that the change from this PR is not included. You will very likely get a merge conflict because the function modified by this PR has been removed in 6.2-dev. Solve this conflict by using your version of that file from your 6.2-dev branch, completely ignoring the incoming change from 5.4-dev.

Testing Instructions

Preparation

It needs a development environment for Joomla CMS, i.e. a git clone of this repository here with composer and NPM.

The command line (terminal on Linux, CMD on Windows) should be adjusted to keep a sufficient history so when you run npm ci you can scroll up to the beginning of the very long output of that command when it has finished.

1. Note the currently used node.js version so you later can restore to that version when cleaning up after the tests:

node -v

2. Install and use the new "v27.0.0-alpha.0.0.0" version of node.js.
   If you are using Node Version Manager (NVM), you can do that with following 2 commands:

nvm install v27.0.0-alpha.0.0.0
nvm use v27.0.0-alpha.0.0.0

2. If not done before, checkout the 5.4-dev branch (without the PR applied) and run composer install.

Test 1: Verify the issue and test the fix

1. Run npm ci. When that has finished, check the result (end of output created by the command).
   Result: The command failed.

npm error code 255
npm error path /home/richard/lamp/public_html/joomla-cms-5.4-dev
npm error command failed
npm error command sh -c node build/build.mjs --prepare
npm error A complete log of this run can be found in: /home/richard/.npm/_logs/2026-11-01T12_03_22_240Z-debug-0.log

2. Scroll up to the beginning of the output produced by that command, and check if there is a line Command line tools require Node Version >=20.0.0 but found v27.0.0-alpha.0.0.0.
   Result: That line is there.

npm notice run joomla@5.4.11 install
npm notice run node build/build.mjs --prepare
Command line tools require Node Version >=20.0.0 but found v27.0.0-alpha.0.0.0

4. Apply the changes from this PR.

5. Repeat steps 1 and 2.
   Result: The command succeeds. There is no such line.

Test 2: Verify that this PR does not break the node version check

This test should be executed after the previous test 1 so that the changes from this PR here are still applied.

1. Open the build/build.mjs file in an editor.
2. Modify the allowedVersion function as follows so that it checks for '>=28.0.0'.
   Old code with this PR applied:

const allowedVersion = () => {
  if (!semver.satisfies(semver.coerce(process.version), options.engines.node)) {
    handleError(
      `Command line tools require Node Version ${options.engines.node} but found ${process.version}`,
      -1,
    );
  }
};

New code checking and reporting for '>=28.0.0':

const allowedVersion = () => {
  if (!semver.satisfies(semver.coerce(process.version), '>=28.0.0')) {
    handleError(
      `Command line tools require Node Version >=28.0.0 but found ${process.version}`,
      -1,
    );
  }
};

3. Run npm ci. When that has finished, check the result (end of output created by the command).
   Result: The command failed.

npm error code 255
npm error path /home/richard/lamp/public_html/joomla-cms-5.4-dev
npm error command failed
npm error command sh -c node build/build.mjs --prepare
npm error A complete log of this run can be found in: /home/richard/.npm/_logs/2026-11-01T12_30_57_235Z-debug-0.log

4. Scroll up to the beginning of the output produced by that command, and check if there is a line Command line tools require Node Version >=28.0.0 but found v27.0.0-alpha.0.0.0.
   Result: That line is there.

npm notice run joomla@5.4.11 install
npm notice run node build/build.mjs --prepare
Command line tools require Node Version >=28.0.0 but found v27.0.0-alpha.0.0.0

Clean Up After Tests

Change back your node.js version to like it was before, i.e. to the version noted in step 1 of the preparation.

If you are using Node Version Manager (NVM), you can do that with following command:

nvm use v26.13.0

(replace v26.13.0 by your version).

Or use following for LTS (long-term support):

nvm use --lts

Currently this results in version v26.13.0, too.

Actual result BEFORE applying this Pull Request

npm ci fails with node.js version v27.0.0-alpha.0.0.0:

npm notice run joomla@5.4.11 install
npm notice run node build/build.mjs --prepare
Command line tools require Node Version >=20.0.0 but found v27.0.0-alpha.0.0.0

...

npm error code 255
npm error path /home/richard/lamp/public_html/joomla-cms-5.4-dev
npm error command failed
npm error command sh -c node build/build.mjs --prepare
npm error A complete log of this run can be found in: /home/richard/.npm/_logs/2026-11-01T12_03_22_240Z-debug-0.log

Expected result AFTER applying this Pull Request

npm ci works with node.js version v27.0.0-alpha.0.0.0:

npm notice run joomla@5.4.11 install
npm notice run node build/build.mjs --prepare
Recreating the media folder...

...

Timer: Build finished in 11024 ms

added 920 packages, and audited 921 packages in 27s

227 packages are looking for funding
  run `npm fund` for details

24 vulnerabilities (5 low, 14 moderate, 5 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

The version check is not broken by this PR. When changing the version requirement to >=20.0.0, it fails as expected.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed