[alexander-akait]

webpack-cli@7.3.0 depends on rechoir@^1.0.0. rechoir 1.0 requires Node.js >= 22.15.0, but webpack-cli supports >=20.9.0. On Node.js 20, installing webpack-cli with Yarn 1, or with npm's engine-strict, fails:

error rechoir@1.0.0: The engine "node" is incompatible with this module. Expected version ">= 22.15.0". Got "20.20.2"

#4875 had moved back to rechoir 0.8 for this reason, but Dependabot bumped it to 1.0 again in #4881, and 7.3.0 shipped with it.

Changes

• Revert chore(deps): bump rechoir from 0.8.0 to 1.0.0 #4881, so rechoir is ^0.8.0 again. The lockfile change only touches rechoir; the code already works with 0.8.
• Add a Dependabot ignore rule for rechoir >=1.0.0, with a TODO to remove it once webpack-cli requires Node.js 22.15.
• Add a patch changeset, since 7.3.0 users on Node.js 20 need a release.

CI note

create-webpack-app's "uses yarn as the package manager" test fails on Node.js 20 on every PR right now (for example #4889). It installs the published webpack-cli@7.3.0, so it will keep failing, on this PR too, until a release with this fix is published.

Locally, npm ci installs rechoir@0.8.0 from the updated lockfile, and the config-format and config-lookup tests pass (21 suites).

---

Generated by Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved installation compatibility for webpack-cli on Node.js 20 when using Yarn 1 or strict engine checks. Installations are less likely to fail because of incompatible versions of a supporting package.
  • Compatibility is maintained with Node.js 20; versions requiring a newer Node.js release are not selected.

[changeset-bot]

🦋 Changeset detected

Latest commit: 6c2175b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
webpack-cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rechoir@​1.0.0 ⏵ 0.8.0	+1		-4	+7

View full report

[github-actions]

This PR is packaged and the instant preview is available (6c2175b).

Install it locally:

• npm

npm i -D webpack-cli@https://pkg.pr.new/webpack-cli@6c2175b

• yarn

yarn add -D webpack-cli@https://pkg.pr.new/webpack-cli@6c2175b

• pnpm

pnpm add -D webpack-cli@https://pkg.pr.new/webpack-cli@6c2175b

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.55%. Comparing base (349b660) to head (6c2175b).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4890      +/-   ##
==========================================
- Coverage   95.08%   91.55%   -3.53%     
==========================================
  Files          14       14              
  Lines        5874     5874              
  Branches      894      852      -42     
==========================================
- Hits         5585     5378     -207     
- Misses        288      491     +203     
- Partials        1        5       +4     

see 3 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 349b660...6c2175b. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.