Cloudflare OS pins its toolchain (pnpm, Node.js, Vite, Vitest, Wrangler) to exact versions across the workspace and CI to ensure reproducible builds and sidestep known breakages. A minimumReleaseAge policy enforces 24-hour supply-chain quarantine for most dependencies, with exemptions for internal Cloudflare packages, while nodejs_compat compatibility flags enable the inference and routing layers to use standard Node.js SDKs.
The workspace uses pnpm@11.17.0 (hash-pinned) as its package manager.[1] CI pins Node.js to 22.14.0 for both the lint and test jobs, runs on ubuntu-latest, and installs dependencies with pnpm install --frozen-lockfile via Corepack.[2]
vite is pinned to exactly 7.3.6 across the entire workspace via a pnpm override to avoid Oxc Stage-3 decorator breakage (workers-sdk#12626); Vitest pool workers are aligned at 0.18.8 and Wrangler at 4.118.0 in the same pin pass.[3][4] @types/node is pinned to 26.1.0 and @lezer/markdown to 1.6.4 via workspace overrides to prevent minimumReleaseAge from being bypassed for these frequently-updated packages.[3] The minimumReleaseAge policy rejects any dependency version published within the last 1440 minutes (24 hours), matching the CI supply-chain policy so local installs cannot commit a too-fresh lockfile.[3] Exempt from minimumReleaseAge are capnweb, capnweb-validate, workerd, and @cloudflare/workerd-* packages, which may be used at any release age.[3] The integration-test wrangler version is pinned to ~4.104.0 because a newer wrangler brings a newer miniflare that requires a newer workerd than the root overrides pin, causing the harness to fail to boot; bumping wrangler therefore requires bumping the workerd override in step.[5]
The nodejs_compat compatibility flag is required by the pi-ai inference layer, which wraps official provider SDKs (@anthropic-ai/sdk, openai, @google/genai) and Puppeteer (used for Gadget PDF exports) — all of which need Node.js compatibility.[6] gatekeeper-context declares both the nodejs_compat and allow_irrevocable_stub_storage compatibility flags in its wrangler.jsonc — further detail on that Worker lives on the Routing and admin page.[7] The nodejs_compat compatibility flag causes Cloudflare Workers to polyfill or proxy standard Node.js built-ins (such as Buffer, crypto, and stream) that are otherwise absent in the Workers runtime.
Sources