Yesterday, I built the latest upstream version of Node.js for EPEL 7 (this version will be supported until 2019-04-01)
I have added it to the buildroot overrides so that anyone can rebuild their npm modules at will. This *is* an API/ABI-breaking upgrade, so some modules will fail to function on this version. We don't know ahead of time which ones will do so, except for binary modules.
I am electing *not* to build in a side-tag for this. Many of the noarch packages will just work (or they won't, and a rebuild wouldn't help us detect this). I am therefore putting out a request to anyone using nodejs-* packages in EPEL to please install nodejs from epel-testing[2] and help us find any issues before October.
If you maintain a nodejs-* package in EPEL, please test that it continues to work with Node.js 6.x. If it does not, please update it and build it in Koji. If the update is compatible with 0.10.x, feel free to submit it to Bodhi; if it is not (or you simply want to push them all together), please notify me directly I will add it to the Bodhi update for nodejs so that it goes stable at the same time as the interpreter.
Due to upstream terminating support for 0.10.x on 2016-10-01, we *will* be cutting over to 6.x on or around that date, so this testing request is time-sensitive.
[1] There's a long story behind this, but the short version is that the bundling style of npm makes it basically impossible to maintain, as even bugfix releases result in a huge tangled mess of dependencies. It is infeasible to keep up with bugfix and security updates. Node.js upstream is highly responsible and responsive about security issues, so we considered it an acceptable risk to bundle npm with the main package.
[2] https://copr.fedorainfracloud.org/coprs/g/nodejs-sig/nodejs-epel/ also has it, if your epel-testing mirrors don't have it yet.
Apologies for the re-send, but I typoed the epel-devel email address on the first try.
On 09/13/2016 09:27 AM, Stephen Gallagher wrote:
Yesterday, I built the latest upstream version of Node.js for EPEL 7 (this version will be supported until 2019-04-01)
I have added it to the buildroot overrides so that anyone can rebuild their npm modules at will. This *is* an API/ABI-breaking upgrade, so some modules will fail to function on this version. We don't know ahead of time which ones will do so, except for binary modules.
I am electing *not* to build in a side-tag for this. Many of the noarch packages will just work (or they won't, and a rebuild wouldn't help us detect this). I am therefore putting out a request to anyone using nodejs-* packages in EPEL to please install nodejs from epel-testing[2] and help us find any issues before October.
If you maintain a nodejs-* package in EPEL, please test that it continues to work with Node.js 6.x. If it does not, please update it and build it in Koji. If the update is compatible with 0.10.x, feel free to submit it to Bodhi; if it is not (or you simply want to push them all together), please notify me directly I will add it to the Bodhi update for nodejs so that it goes stable at the same time as the interpreter.
Due to upstream terminating support for 0.10.x on 2016-10-01, we *will* be cutting over to 6.x on or around that date, so this testing request is time-sensitive.
[1] There's a long story behind this, but the short version is that the bundling style of npm makes it basically impossible to maintain, as even bugfix releases result in a huge tangled mess of dependencies. It is infeasible to keep up with bugfix and security updates. Node.js upstream is highly responsible and responsive about security issues, so we considered it an acceptable risk to bundle npm with the main package.
[2] https://copr.fedorainfracloud.org/coprs/g/nodejs-sig/nodejs-epel/ also has it, if your epel-testing mirrors don't have it yet.
nodejs@lists.fedoraproject.org
-
Stephen Gallagher