Fsevents: 1.2.11 produces node-pre-gyp in package-lock

Created on 6 Jan 2020 · 6Comments · Source: fsevents/fsevents

Installing fsevents 1.2.11 still produces a variant of node-pre-gyp in package-lock.json. This now resolves to 0.14.0. Is this intentional?

    "fsevents": {
      "version": "1.2.11",
      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-1.2.11.tgz",
      "integrity": "sha512-+ux3lx6peh0BpvY0JebGyZoiR4D+oYzdPZMKJwkZ+sFkNJzpL7tXc/wehS49gUAxg3tmMHPHZkA8JU2rhhgDHw==",
      "optional": true,
      "requires": {
        "bindings": "^1.5.0",
        "nan": "^2.12.1",
        "node-pre-gyp": "*"
      },
      "dependencies": {
        ...
        "node-pre-gyp": {
          "version": "0.14.0",
          "bundled": true,
          "optional": true,
          "requires": {
            "detect-libc": "^1.0.2",
            "mkdirp": "^0.5.1",
            "needle": "^2.2.1",
            "nopt": "^4.0.1",
            "npm-packlist": "^1.1.6",
            "npmlog": "^4.0.2",
            "rc": "^1.2.7",
            "rimraf": "^2.6.1",
            "semver": "^5.3.0",
            "tar": "^4.4.2"
          }
        },
        ...
      }

Source

guidobouman

All 6 comments

Update your deps to fsevents 2, or chokidar v3.

paulmillr on 6 Jan 2020

👎2

I know what I should do. But what about the packages that can not, and get this update through the patch release?

guidobouman on 6 Jan 2020

👍1

Well, then they’ll have gyp in package-lock. They really should do this. There is really no excuse since january 1st. Which was the date of nodejs v8 end-of-life. Fsevents v2 dropped support for nodejs v6, so even unsupported v8 can be used with fse-v2.

Alternative approach would be to make v1.2.11 to store binaries on AWS. I don’t know what is the proper way of doing that, there’s not much documentation from the author who’ve set up aws.

paulmillr on 6 Jan 2020

All good them. 👍 This issue was just to check wether it was okay or not. As 1.2.11 specifically mentions the removal.

guidobouman on 6 Jan 2020

Looks like it removed it from dependencies but left it in bundledDependencies.