build(deps): regenerate package-lock.json to match http-proxy-middleware bump - #2228
Conversation
Upstream commit 9e49bae bumped http-proxy-middleware from 3.x to 4.x in package.json but the lockfile was not regenerated, causing npm ci to fail with: npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. This regenerates package-lock.json so npm ci succeeds again on a fresh clone of release/v3.8.0. Co-authored-by: OmniRoute Ops <ops@nomenak.dev>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the http-proxy-middleware dependency from version 3.0.5 to 4.0.0, along with associated changes to the dependency tree including the addition of httpxy and the removal of deprecated packages like http-proxy and eventemitter3. A critical compatibility issue was identified: the new version of http-proxy-middleware requires Node.js 22.15.0 or higher, which conflicts with the project's current support for Node.js 20. It is recommended to either update the project's engine requirements or downgrade the dependency to maintain compatibility.
| "engines": { | ||
| "node": "^14.15.0 || ^16.10.0 || >=18.0.0" | ||
| "node": "^22.15.0 || ^24.0.0 || >=26.0.0" | ||
| } |
There was a problem hiding this comment.
The update to http-proxy-middleware v4 introduces a breaking change for Node.js version support. The new version requires Node.js ^22.15.0 || ^24.0.0 || >=26.0.0, which drops support for Node.js 20.
However, this project's package.json still lists Node.js 20 as a supported version (>=20.20.2 <21). This will cause npm install to fail for users on Node.js 20.
This is a significant compatibility issue. Please consider one of the following resolutions:
- Update the project's
enginesinpackage.jsonto drop support for Node.js 20. This would be a breaking change for the project. - Downgrade
http-proxy-middlewareto a version that is compatible with all supported Node.js versions for this project.
Given the context of this PR, downgrading the dependency seems more appropriate unless dropping Node 20 support is an intentional decision.
|
Re the engine compat concern from review: this is real but doesn't originate here — the Two ways to resolve, both fine for us:
Either direction works — your call. |
|
Hey @NomenAK! Thanks for catching the http-proxy-middleware lock-sync gap. This PR is mutually exclusive with #2214 (which downgrades http-proxy-middleware to ^3.0.5). We need to decide between 3.x (currently in release/v3.8.0 lockfile) vs 4.x. The blocker for 4.x: requires For v3.8.x: leaning toward staying on 3.x (compatibility) and revisiting 4.x in the v3.9 cycle. Will discuss with maintainers and update here. Leaving this open. Thanks for the contribution! |
|
Thanks @NomenAK! Lockfile is now in sync with http-proxy-middleware 4.x. Follow-up: bumped Merged via |
… 20.x) The root package.json was updated in 52f3285 to drop Node 20.x support (http-proxy-middleware 4.x requirement). electron/package.json had no engines field declared, leaving the desktop build implicitly permissive. Adds the same constraint (>=22.22.2 <23 || >=24.0.0 <27) to keep the electron workspace consistent with the root engine policy. Refs: #2228 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Deep audit of all 320 commits since v3.7.9 found: - 18 merged PRs not documented in CHANGELOG (4 features, 10 bug fixes, 1 security, 2 chores, 1 debug improvement) - 3 contributors entirely missing from credits table (@NomenAK with 12 PRs, @kang-heewon, @one-vs) - 4 existing contributors with inaccurate PR counts (@oyi77 8→12, @ddarkr 2→3, @andrewmunsell 2→3, @nickwizard 2→3) New entries added: - feat: #2135 (1proxy settings), #2227 (antigravity project ID), #2238 (Z.AI Search), #2240 (CLI Suite) - fix: #2217, #2218, #2219, #2221, #2222, #2223, #2224, #2231, #2233, #2236, #2242, #2243 - security: #2209 (stack trace exposure) - chore: #2228, #2234 Total contributors updated from 50+ to 55+.
…osouzapw#2228) Integrated into release/v3.8.0 (http-proxy-middleware bumped to 4.x; engines.node updated in follow-up)
http-proxy-middleware 4.x (introduced via diegosouzapw#2228) requires Node >=22.15.0. Updated engines.node to >=22.22.2 <23 || >=24.0.0 <27 (drops 20.x). BREAKING CHANGE: users on Node 20.x must upgrade to Node 22.22.2+ or 24+. Refs: diegosouzapw#2228 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
… 20.x) The root package.json was updated in eefe291 to drop Node 20.x support (http-proxy-middleware 4.x requirement). electron/package.json had no engines field declared, leaving the desktop build implicitly permissive. Adds the same constraint (>=22.22.2 <23 || >=24.0.0 <27) to keep the electron workspace consistent with the root engine policy. Refs: diegosouzapw#2228 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Deep audit of all 320 commits since v3.7.9 found: - 18 merged PRs not documented in CHANGELOG (4 features, 10 bug fixes, 1 security, 2 chores, 1 debug improvement) - 3 contributors entirely missing from credits table (@NomenAK with 12 PRs, @kang-heewon, @one-vs) - 4 existing contributors with inaccurate PR counts (@oyi77 8→12, @ddarkr 2→3, @andrewmunsell 2→3, @nickwizard 2→3) New entries added: - feat: diegosouzapw#2135 (1proxy settings), diegosouzapw#2227 (antigravity project ID), diegosouzapw#2238 (Z.AI Search), diegosouzapw#2240 (CLI Suite) - fix: diegosouzapw#2217, diegosouzapw#2218, diegosouzapw#2219, diegosouzapw#2221, diegosouzapw#2222, diegosouzapw#2223, diegosouzapw#2224, diegosouzapw#2231, diegosouzapw#2233, diegosouzapw#2236, diegosouzapw#2242, diegosouzapw#2243 - security: diegosouzapw#2209 (stack trace exposure) - chore: diegosouzapw#2228, diegosouzapw#2234 Total contributors updated from 50+ to 55+.
…osouzapw#2228) Integrated into release/v3.8.0 (http-proxy-middleware bumped to 4.x; engines.node updated in follow-up)
http-proxy-middleware 4.x (introduced via diegosouzapw#2228) requires Node >=22.15.0. Updated engines.node to >=22.22.2 <23 || >=24.0.0 <27 (drops 20.x). BREAKING CHANGE: users on Node 20.x must upgrade to Node 22.22.2+ or 24+. Refs: diegosouzapw#2228 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
… 20.x) The root package.json was updated in 52f3285 to drop Node 20.x support (http-proxy-middleware 4.x requirement). electron/package.json had no engines field declared, leaving the desktop build implicitly permissive. Adds the same constraint (>=22.22.2 <23 || >=24.0.0 <27) to keep the electron workspace consistent with the root engine policy. Refs: diegosouzapw#2228 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Deep audit of all 320 commits since v3.7.9 found: - 18 merged PRs not documented in CHANGELOG (4 features, 10 bug fixes, 1 security, 2 chores, 1 debug improvement) - 3 contributors entirely missing from credits table (@NomenAK with 12 PRs, @kang-heewon, @one-vs) - 4 existing contributors with inaccurate PR counts (@oyi77 8→12, @ddarkr 2→3, @andrewmunsell 2→3, @nickwizard 2→3) New entries added: - feat: diegosouzapw#2135 (1proxy settings), diegosouzapw#2227 (antigravity project ID), diegosouzapw#2238 (Z.AI Search), diegosouzapw#2240 (CLI Suite) - fix: diegosouzapw#2217, diegosouzapw#2218, diegosouzapw#2219, diegosouzapw#2221, diegosouzapw#2222, diegosouzapw#2223, diegosouzapw#2224, diegosouzapw#2231, diegosouzapw#2233, diegosouzapw#2236, diegosouzapw#2242, diegosouzapw#2243 - security: diegosouzapw#2209 (stack trace exposure) - chore: diegosouzapw#2228, diegosouzapw#2234 Total contributors updated from 50+ to 55+.
2 participants
What
Regenerate
package-lock.jsonso it matchespackage.jsonagain after the recenthttp-proxy-middlewaremajor bump.Why
On a fresh clone of
release/v3.8.0,npm cicurrently fails:The cause is commit
9e49baefwhich bumpedhttp-proxy-middleware3.x → 4.x inpackage.jsonwithout regenerating the lockfile. Anyone trying to build the image from source (or runnpm ciin CI) hits this. We hit it on our fork's deploy rebuild yesterday and worked around it by runningnpm install --package-lock-onlylocally.How
npm install --package-lock-onlyonrelease/v3.8.0HEAD to refresh the lockfile in-place.package-lock.jsonis changed; no behavior change.npm cisucceeds afterward.Notes
Happy to revise if the bump was deliberate and the lockfile is intended to lag, or if you'd prefer to roll back the bump entirely.