Lisk-sdk: Update to Node.js version 8.12.0

[MaciejBaj]

Expected behavior

We should upgrade Node.js to version v8.12.0(LTS) and align the other products lisk-build and lisk-commander.

The rationale behind upgrading to version v8.12.0(LTS) are:

• NPM 5 supports freezing the dependency with package-lock.json, this will allow us to lock down the dependencies versions.
• Node.js 6.x is under Maintenance LTS and we want to move to Node.js 8.x which the current Active LTS

Following is summary of features comes with upgrading from 6.x to 8.x:

• NPM 5 (Introduction of package-lock.json and faster package install)
• Use of Async and Await functions
• Static Error Codes
• N-API (Experimental)
• Object REST AND SPREAD operator usage
• Experimental HTTP/2 (faster, simpler, and more robust) for more info

Actual behavior

Currently, lisk-core supports node.js version v6.14.1 and npm 3.10.10.

Which version(s) does this affect? (Environment, OS, etc...)

1.0.0

[willclarktech]

Given that this change won't be happening very soon, it should not specify the version so exactly. Node v10 would be more appropriate.

[MaciejBaj]

As part of this issue, we should set up the process of Node version upgrade for the future purposes.

[ManuGowda]

Node.js v10.5.0(dubnium) Features:

• Stable HTTP/2 (faster, simpler, and more robust) for more info...
• Better support for ESM modules
• Standardized error codes
• N-API is no longer experimental
• V8 and OpenSSL updates (V8 got an upgrade bump to v6.6, support for async generators and iterators, OpenSSL updated to v1.1.0. Which allows faster SSL handshakes and more security.)
• npm v6
  
  
  
  • More focus on security, and npm has it baked in.
  
  
  • You can use the npm audit command to find security vulnerabilities.
  
  
  • I haven't tested this out, but it claims to be 17x faster.
  
  
  • There's also npm optimizations for continuous integration (CI) environments so builds can run faster.
  
  
  • More visible integrity metadata for package tampering. etc.
  
  
• Deprecations
  
  
  
  • Using require() to access several of Node.js' own internal dependencies will emit a runtime deprecation.
  
  
  • The crypto.createCipher() and crypto.createDecipher() methods have been deprecated.
  
  
  • Passing more than one argument to assert.fail() will emit a runtime deprecation warning
  
  
  • Use of non-string values for process.env has been deprecated in documentation.
  
  

[ManuGowda]

Status on possible breaking change that might be introduced when we upgrade from v6.14.3 to v.8.11.3:

After investigating the changes that were introduced in node v.8.11.3, the possible breaking change that will be introduced to our application is Buffer in node v.8.11.3

We use Buffer.from function to generate a Hex and utf8, the Buffer.from function in v8.11.3 has been changed to accept invalid hex string meaning

• Previously(v6.14.3): Buffer.from('abx', 'hex') caused: TypeError: Invalid hex string.
• Now(v8.11.3): Buffer.from('abx', 'hex') results in: <Buffer ab>.

So with the node v8.11.3 these fuctions has changed to ignore invalid hex strings, which is the only possible breaking change that can impact to us that i can see of, otherwise rest all the features are not making any impact

• Buffer#write(), Buffer#fill() and Buffer.from() now ignore invalid hex strings.

Here is the full list of changes that were introduced from v6.14.3 to v.8.11.3: v6.14.3 ====> v.8.11.3

[willclarktech]

This issue should be updated to reflect the decision to move to v8 first (with some explanation).

[ManuGowda]

Node.js v8.11.3 Features:

• Use of Async and Await functions
• Static Error Codes
• N-API (Experimental)
• Object REST AND SPREAD operator usage
• NPM 5 (Introduction of package-lock.json and faster package install)
• Experimental HTTP/2 (faster, simpler, and more robust) for more info

[MaciejBaj]

We decided to move to Node v8 first before upgrading to Node v10 straight away, because:

1. Build for freshly adapted library sodium-native is failing for Node v10, but passing for Node v8.
2. Node v8 supports demanded features that @ManuGowda presented in posts above.

[MaciejBaj]

The LTS Node v8 version changed https://nodejs.org/download/release/latest-v8.x. on 12-09-2018. I updated the issue description and changed the Node version from v8.11.3 to the latest v8.12.0.

[ManuGowda]

Reopening this issue as the fix was not applied in all places(nvmrc, README, etc.).