fix: define the supported Node.js range once, so the startup check matches engines

[wmadden-electric]

In create-prisma 0.14.2, the startup check and engines.node disagree about Node.js prereleases:

Node.js version	Inside engines.node, by semver?	create-prisma 0.14.2 startup check
24.11.0	yes	accepts
24.11.0-rc.1	no (npm prints an EBADENGINE warning)	accepts
26.0.0-nightly20260901	no (npm prints an EBADENGINE warning)	accepts

This PR makes create-prisma's startup check agree with engines.node exactly, by defining the supported range in one place. It also tidies the README's support statement.

The decision: one definition of the supported range

create-prisma supports what Prisma ORM supports: Node.js 22.18 or newer on the 22 line, 24.11 or newer on the 24 line, or 26 or newer. That is the range ^22.18.0 || ^24.11.0 || >=26.0.0 (#128).

In 0.14.2 that range is written four times: in engines.node, in the startup check, in the refusal message and in a test. The check also compares versions by hand, and it treats a prerelease such as 24.11.0-rc.1 as 24.11.0. npm follows semver, which puts those prereleases outside this range.

Now src/utils/node-version.ts lists the supported Node.js lines once. The range string, the check and the refusal message are all built from that list. The check refuses prereleases, as semver does.

How we know they agree

A new test runs the check and Bun.semver.satisfies(version, SUPPORTED_NODE_RANGE) on the same 17 versions, 4 of them prereleases, and expects the same answer from both. The existing test still checks that engines.node equals the range string. If someone changes one definition and not the other, a test fails.

README

• Supported versions no longer lists the Node.js versions that are excluded. It states the range once.
• It says that the next, svelte, astro and tanstack-start templates declare no engines field. Only minimal, hono, elysia, nest and turborepo declare the range.
• Deno is described as supported for local minimal PostgreSQL apps only, as the detailed section below it already says.
• The package manager list points to Supported versions, which gives the Yarn 4.10 minimum.

Testing

bun run typecheck, bun run check and bun run test:unit pass: 107 tests, in each of three runs.

Alternatives considered

• Add semver as a dependency and use it in the check. It is only an indirect dependency today, and the check needs just the range's three lines. The test uses Bun's built-in semver to compare against.
• Leave the duplicates. They already disagreed on prereleases, and the next change to the range would have had to touch four places.

Agent: maui-32

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 621cab25-0f9b-46e8-a2ec-aa46111f9449

---

📥 Commits

Reviewing files that changed from the base of the PR and between c1c36e5 and 325a682.

---

📒 Files selected for processing (3)

• README.md
• src/utils/node-version.ts
• tests/node-version.test.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

Summary by CodeRabbit

• Documentation
  • Clarified which templates omit Node.js engine requirements and where to find supported package manager versions.
  • Clarified that Bun and Deno support is limited to local minimal PostgreSQL apps.
• Bug Fixes
  • Node.js version checks now reject incomplete or malformed version strings and apply consistent minimum-version requirements for supported releases.

Walkthrough

The supported Node.js range and requirement description are now generated from minimum versions for majors 22 and 24, plus support for major 26 and later. Version checks reject strings that do not match the accepted release-version format. Tests compare support results with Bun’s semver implementation and check prerelease boundaries. The README clarifies template engine fields, limits stated Bun and Deno support, and links to Supported versions for package-manager details.

Priority: ⬇️ Low

Merge Risk

Merge Risk: ⚪ Minimal · up to 325a6

The Node.js support check and documentation changes present no identified merge-blocking risk. Merge after normal checks.

Security Architecture Review

Security architecture risk: ⚪ Minimal · up to 325a6

The change narrows runtime acceptance while preserving the existing startup guard and supported stable-release thresholds. No material security risk was found introduced or worsened by this change.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed policy affects whether an invocation proceeds under its current runtime. Its unchanged caller and narrower prerelease acceptance do not expand attacker-controlled reachability or the command's existing authority.

Trust Boundaries and Controls

• observed — The startup compatibility guard remains between input validation and project-context collection. The PR changes the pure version-policy decision, not caller identity, credentials, ownership, or downstream operation dispatch.

---

---

---

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely describes the main change: defining the supported Node.js range once and aligning the startup check with the package engines declaration.
Description check		The description directly explains the prerelease mismatch, the centralized Node.js range, the test coverage, and the related README updates.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (1 skipped: 1 unsupported.)

---

---

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

✨ Simplify code

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR preview published

• Version: 0.14.2-pr.129.424.1
• Tag: pr129
• Run with Bun: bunx create-prisma@pr129
• Run with npm: npx create-prisma@pr129
• Run with Yarn: yarn dlx create-prisma@pr129
• Run with pnpm: pnpm dlx create-prisma@pr129
• Run with Deno: deno run -A --minimum-dependency-age=0 npm:create-prisma@pr129
• Workflow run: https://github.com/prisma/create-prisma/actions/runs/37909334825