Skip to content

nodejs_14: is EOL on 2023-04-30, nodejs_16: goes EOL during 23.05 release#229910

Merged
mweinelt merged 2 commits intoNixOS:masterfrom
helsinki-systems:nodejs-14-insecure
May 19, 2023
Merged

nodejs_14: is EOL on 2023-04-30, nodejs_16: goes EOL during 23.05 release#229910
mweinelt merged 2 commits intoNixOS:masterfrom
helsinki-systems:nodejs-14-insecure

Conversation

@ajs124
Copy link
Member

@ajs124 ajs124 commented May 4, 2023

Description of changes
Things done
  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 23.05 Release Notes (or backporting 22.11 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
  • Fits CONTRIBUTING.md.

@ajs124 ajs124 requested a review from mweinelt May 4, 2023 14:31
@ofborg ofborg bot added 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux. labels May 4, 2023
@mweinelt

This comment was marked as outdated.

@mweinelt
Copy link
Member

mweinelt commented May 4, 2023

Head's up. Your package is using nodejs_14, which we are going to mark vulnerable (because EOL) before the 23.05 branch-off.

And remember that there is now buildNpmPackage, that can be used to build npm projects (those with a package-lock.json lockfile).

@turboMaCk
Copy link
Member

turboMaCk commented May 5, 2023

thanks for ping. I will take care of elm modules.

@mweinelt
Copy link
Member

mweinelt commented May 6, 2023

We might have to pull nodejs_16 as well, given that it EOLS in 4 months. cc @turboMaCk

@mweinelt mweinelt added the 12.approvals: 1 This PR was reviewed and approved by one person. label May 6, 2023
hyshka added a commit to hyshka/nixpkgs that referenced this pull request May 6, 2023
@hyshka hyshka mentioned this pull request May 6, 2023
12 tasks
@jojosch jojosch mentioned this pull request May 7, 2023
12 tasks
@turboMaCk turboMaCk mentioned this pull request May 7, 2023
12 tasks
turboMaCk added a commit to turboMaCk/nixpkgs that referenced this pull request May 7, 2023
Related to issue NixOS#229910
This bumps nodejs to 18 since 16 is soon to EOL.
selmison pushed a commit to selmison/nixpkgs that referenced this pull request May 8, 2023
because it will reach its EOL 2023-09-11, before the EOL of NixOS 23.05
@mweinelt mweinelt changed the title nodejs_14: is EOL on 2023-04-30 nodejs_14: is EOL on 2023-04-30, nodejs_16: goes EOL during 23.05 release May 8, 2023
@ajs124 ajs124 deleted the nodejs-14-insecure branch May 19, 2023 14:42
This was referenced May 19, 2023
amarshall added a commit to amarshall/nixpkgs that referenced this pull request May 20, 2023
- Backport patch from Bitwarden master to achieve this as they have done
  (unreleased) upgrade 16→18, and have several other changes along with
  it. We want this now because Node 16 is being marked insecure soon for
  NixOS 23.05; see NixOS#229910.
- These changes should be in the next release in a few weeks
- `npm bin` no longer exists, use `npm exec` instead
Ma27 added a commit to Ma27/nixpkgs that referenced this pull request May 21, 2023
Part of NixOS#229910.

Unfortunately this is a little hacky because upstream doesn't intend to
support it for 2.5, but only for 3.0 which isn't out yet, however nodejs-16
will get out of maintenance during the support-span of NixOS 23.05[1].

The only breaking change is that `extract-files` uses a deprecated way
of exposing modules, I went through the list of other breaking
changes in v17 and v18[2][3] and couldn't spot any usage of removed
features, also local testing didn't reveal further issues.

Unfortunately fixing that breakage turned out to be non-trivial.
Currently, `extract-files@9.0.0` is used with the problematic portions
in its `package.json`, however it's only a transitive dependency of
`@graphql-tools/url-loader` & `apollo-upload-client`. Unfortunately, the
versions of that in use require v9 and don't work with a newer version of
`extract-files` with the problem fixed[4]. Also, upgrading the
dependencies in question is not a feasible option because `graphql-tools`
was split up into multiple smaller packages in v8 and also some of the
APIs in use in `wiki.js` were dropped there[5], so this would also be
very time-consuming and non-trivial to fix.

Since this was the only issue, I decided to go down the hacky route and
patch the problem in `package.json` of `extract-files` manually during
our `patchPhase`.

[1] requarks/wiki#6388
[2] https://nodejs.org/en/blog/release/v17.0.0
[3] https://nodejs.org/en/blog/release/v18.0.0
[4] Upon local testing, this broke with the following error:

        Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: Package subpath './public/extractFiles' is not defined by "exports" in /wiki/node_modules/extract-files/package.json
[5] For instance `SchemaDirectiveVisitor` in
  `server/graph/directives/auth`.

(cherry picked from commit 577ffe7)
Ma27 added a commit to Ma27/nixpkgs that referenced this pull request May 21, 2023
Part of NixOS#229910.

Upstream uses `node:current-alpine` to build their images[1], so newer
nodejs versions shouldn't be a problem.

[1] https://github.com/Ylianst/MeshCentral/blob/1.1.5/docker/Dockerfile

(cherry picked from commit d9f9708)
@figsoda figsoda mentioned this pull request May 21, 2023
12 tasks
@figsoda figsoda mentioned this pull request May 21, 2023
12 tasks
midchildan added a commit to midchildan/nixpkgs that referenced this pull request May 21, 2023
@RaitoBezarius RaitoBezarius mentioned this pull request May 22, 2023
12 tasks
@xanderio xanderio mentioned this pull request May 23, 2023
12 tasks
midchildan added a commit to midchildan/nixpkgs that referenced this pull request May 24, 2023
github-actions bot pushed a commit that referenced this pull request May 25, 2023
Relates to #229910.

(cherry picked from commit c3346f8)
lunik1 added a commit to lunik1/flakelight-bug-mwe that referenced this pull request Feb 27, 2026
NixOS/nixpkgs#229910 marked node 16 as insecure,
so now all nodePackages fail to build.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux.

Projects

None yet

Development

Successfully merging this pull request may close these issues.