Node-ldapjs: Pre-release with Node 10 compatibility available

[jsumners]

A pre-release version of the library has been published under the @next tag on npm. You can look at the commit history for the next branch to see what changes are included -- https://github.com/ldapjs/node-ldapjs/compare/master...next

Notably, this release includes support for Node >= 10. Going forward, Node 10.16.0 will the minimally supported version. I do not believe there are any changes that strictly preclude Node 8, but it is not included in the automatic test suite. Node 8 will be desupported by year end, and is currently in "maintenance LTS." Given this, I do not see a need to focus on supporting it when the final release version of the next branch could take just as long to be released.

There will be regular "pre" releases published as work progresses, but there is not a hard target date for the final release. You can consider these pre releases as "mostly stable." The goal with v2.0.0 is not to radically change the outward functionality of the library. The goal is to incorporate long outstanding fixes and generally make the code easier for contributors to work with.

Please give these a releases a try by installing via npm install ldapjs@next. Please report issues you discover at https://github.com/ldapjs/node-ldapjs/issues

[xPaw]

I think it would be a better idea to reduce the minimum version to 10.13.0 which is the first 10 LTS release. https://nodejs.org/en/download/releases/

10.16.0 is mildly arbitrary.

[jsumners]

It is not "mildly arbitrary". 10.16 is major security patch release -- https://github.com/nodejs/node/blob/02c74e72eacc34fa90ae85983900a5d93f13b6c8/doc/changelogs/CHANGELOG_V10.md#2019-05-28-version-10160-dubnium-lts-bethgriggs

[xPaw]

Does that matter for this library though? You're essentially forcing anything that depends on ldapjs to also use that version.

[jsumners]

You can ignore the minimum requirements if you like. 10.16.0 will be the minimally supported version though.

[xPaw]

We can't.

[3/5] Fetching packages...
error [email protected]: The engine "node" is incompatible with this module. Expected version ">=10.16.0". Got "8.10.0"

Telling users to use --ignore-engines isn't a great idea.

[jsumners]

Please re-read the original post in this issue. It specifically states that by the time this release is "final", Node 8 will not be supported upstream. I know that is the case because there is a lot I want to do for the release and I have very limited time to work on this.

There isn't any _intention_ to break Node 8 compatibility, but maintaining such compatibility will not be a goal. Even so:

[xPaw]

You will hit the same error on 10.13 which is also current LTS. I just gave the message from our CI for that specific version.

We will have to set our minimum version to 10.16.0 to match yours to prevent any issues during install.

[jsumners]

I have been thinking about this. I cannot conceive of an argument to support < 10.16 when almost every release between 10.13 and 10.16 addresses some sort of security vulnerability. One has to explicitly choose to install 10.13 over 10.16. Any version manger tool that supports installing a version labeled "lts" is going to install the latest 10.16 release, not the minimum 10.13 release. In fact, 10.13 is _no longer supported_ by the Node.js organization:

https://github.com/nodejs/Release/tree/315dd8fff9cc15db0b193353d8b30096afd3d434#release-plan (emphasis added)

Every major version covered by the LTS plan will be actively maintained for a period of 18 months from the date it enters LTS coverage.

Do you have an extremely compelling argument for why this project should standardize on an unsupported version of Node?

[xPaw]

Debian stable for example has 10.15.2 https://packages.debian.org/buster/nodejs

You're needlessly making the version requirement high for v10 (mind you, you can still v11 which is also has had no release in months, and doesn't include the security fixes you're describing).

[UziTech]

Telling users to use --ignore-engines isn't a great idea.

No, telling them to upgrade would be a better idea, but telling them to use npm or --ignore-engines seems fair.

[jsumners]

Hmm. It looks like Debian has backported the 10.16 patches into their 10.15 version. That’s annoying.

https://metadata.ftp-master.debian.org/changelogs//main/n/nodejs/nodejs_10.15.2~dfsg-2_changelog

Mon, 08 Apr 2019 15:06:40 +0200

nodejs (10.15.2~dfsg-1) unstable; urgency=high

• New upstream version 10.15.2~dfsg
  Slowloris HTTP Denial of Service with keep-alive
  (CVE-2019-5737)

[jsumners]

@xPaw #561 includes explicit testing against 10.13.0 and adjust the engines accordingly. This is specifically because of distributions breaking the minor version guarantee.