Ghost 0.11.14 install failure

[hwdsl2]

Issue Summary

Ghost 0.11.14 depends on har-validator 5.1.2, which has been unpublished.

To Reproduce

Install Ghost 0.11.14. You'll likely encounter failures like:

npm ERR! fetch failed https://registry.npmjs.org/har-validator/-/har-validator-5.1.2.tgz
npm WARN retry will retry, error on last attempt: Error: fetch failed with status code 404
npm ERR! fetch failed https://registry.npmjs.org/har-validator/-/har-validator-5.1.2.tgz
npm WARN retry will retry, error on last attempt: Error: fetch failed with status code 404
npm ERR! fetch failed https://registry.npmjs.org/har-validator/-/har-validator-5.1.2.tgz
npm ERR! Linux 3.13.0-115-generic
npm ERR! argv "/usr/bin/nodejs" "/usr/bin/npm" "install" "--production"
npm ERR! node v6.11.0
npm ERR! npm  v3.10.10

This is because npm-shrinkwrap.json specifies har-validator 5.1.2, which has been unpublished. See:
https://github.com/ahmadnassri/node-har-validator/issues/112

To make the problem worse, the NPM registry returns inconsistent results for the unpublished 5.1.2 version. This command sometimes returns 200, sometimes returns 404 Not Found:

curl -I https://registry.npmjs.org/har-validator/-/har-validator-5.1.2.tgz

Suggested fix: Update to har-validator 5.1.3 in npm-shrinkwrap.json.

Technical details:

• Ghost Version: 0.11.14
• Node Version: 6.11.0
• Browser/OS: Linux
• Database: SQLite

[allouis]

This is because npm-shrinkwrap.json specifies har-validator 5.1.2, which has been unpublished.

Thanks for the report - i can sort out a fix on monday, but if you can put together a PR it would be appreciated :relaxed:

The 0.11.14 release is on the lts branch

[ErisDS]

Support for the LTS version of Ghost ends on Dec 31st - so in 25 days - this will probably be the last fix.

[hwdsl2]

@allouis @ErisDS I tried to search for har-validator in the lts branch but could not find any reference. So I'm unable to make a pull request for this. Maybe we simply need a repackage of Ghost 0.11.14 (which will generate a new npm-shrinkwrap.json?

[allouis]

Repackage of shrinkwrap could work! Give it a go :)

If you run npm ls you should see where har-validator is in the dep tree, spoiler:

├─┬ [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ ├── [email protected] deduped
│ │ ├── [email protected] deduped
│ │ ├─┬ [email protected]
│ │ │ ├── [email protected] deduped
│ │ │ ├── [email protected] deduped
│ │ │ └── [email protected]
│ │ ├─┬ [email protected]
│ │ │ ├── [email protected] deduped
│ │ │ └── [email protected] deduped
│ │ ├─┬ [email protected]
│ │ │ ├─┬ [email protected]
│ │ │ │ └── [email protected] deduped
│ │ │ └── [email protected]
│ │ ├── [email protected] deduped
│ │ ├── [email protected] deduped
│ │ ├── [email protected] deduped
│ │ ├── [email protected] deduped
│ │ └── [email protected] deduped
│ └─┬ [email protected]
│   ├── [email protected]
│   ├── [email protected]
│   ├── [email protected]
│   ├─┬ [email protected]
│   │ └── [email protected]
│   ├── [email protected] deduped
│   ├── [email protected]
│   ├── [email protected] deduped
│   ├─┬ [email protected] <-------------------------------- here
│   │ ├── [email protected] deduped
│   │ └── [email protected]

So you _might_ find that the sqlite dep has had a patch version since that that could fix the issue!

Thanks for taking a look :nerd_face:

[hwdsl2]

@allouis @ErisDS I've run npm ls on my Ghost 0.11.14 install. Here's the location of har-validator in the output:

... ...
├─┬ [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ ├─┬ [email protected]
│ │ ├─┬ [email protected]
│ │ │ ├─┬ [email protected]
│ │ │ │ └── [email protected]
│ │ │ ├─┬ [email protected]
│ │ │ │ ├── [email protected]
│ │ │ │ └─┬ [email protected]
│ │ │ │   └── [email protected]
│ │ │ └── [email protected]
│ │ ├─┬ [email protected]
│ │ │ └─┬ [email protected]
│ │ │   └─┬ [email protected]
│ │ │     ├── [email protected]
│ │ │     ├── [email protected]
│ │ │     ├── [email protected]
│ │ │     ├── [email protected]
│ │ │     ├─┬ [email protected] <-------------------------------- here
│ │ │     │ ├─┬ [email protected]
│ │ │     │ │ ├── [email protected]
│ │ │     │ │ ├── [email protected]
│ │ │     │ │ ├── [email protected]
│ │ │     │ │ └─┬ [email protected]
│ │ │     │ │   └── [email protected]
│ │ │     │ └── [email protected]
... ...

I think that in order to fix it, your team might need to release a new version of gscan or ghost-ignition, which bumps up the dependency version of har-validator.

Alternatively, as I said above, maybe a simple repackaging of Ghost 0.11.14 will suffice, because there is no direct reference to [email protected] in package.json, and when you repackage, a new npm-shrinkwrap.json will be generated which will use the correct version [email protected] instead. I'm not sure how to repackage 0.11.14 but it seems to me that it cannot be done via a pull request in the Git repo.

[JohnONolan]

I'm not sure we should really be fixing this. LTS maintenance period is to cover critical security vulnerabilities and major issues with existing installs.

A bug in doing a fresh 0.11 install 25 days before EOL is -IMO- not at all valid. I suggest closing as wontfix.

@hwdsl2 please try installing a newer version of Ghost.

[hwdsl2]

@JohnONolan Thanks for the recommendation. This issue may also affect existing users who upgrade to 0.11.14 because [email protected] is in npm-shrinkwrap.json which now 404s.

However I am good with whichever way the Ghost blog team decides. Thank you for the awesome product.

[ErisDS]

Agree w/ John. I've just gone through and closed all remaining LTS bugs.

There is no need to upgrade to 0.11.14 before doing a major upgrade. At the moment the best course of action is a fresh 1.0 install. We will be introducing a mechanism for upgrading straight from LTS -> 2.0 soon as per #10276.

Closing this as a wontfix.