Skip to content
This repository has been archived by the owner on Jan 25, 2023. It is now read-only.

Warn against specifying minor/patch version numbers in custom Node.js versions. #748

Open
ehmicky opened this issue Mar 1, 2022 · 1 comment

Comments

@ehmicky
Copy link
Contributor

ehmicky commented Mar 1, 2022

Background

Sites can specify a custom Node.js version by using a .nvmrc file, .node_version file or NODE_VERSION environment variable.

Problem

Specifying the minor/patch version number for Node.js is a bad pattern since:

  • It prevents sites from receiving security fixes
  • Node.js respects semantic versioning faithfully, i.e. never introduces breaking changes in minor/patch releases

According to the following list of the Node.js versions used in the last 7 days, per build, this would impact 18% of builds.

Solution

We should print a log message in the build logs when this happens. The log message should warn but have no colors.

We should only do so when the site uses a custom Node.js version, as opposed to using the default Node.js version. The default Node.js is currently 12.18.0 but could differ depending on when the repository was linked, so we should not use the Node.js version value to determine whether the Node.js version has been customized.

@ehmicky ehmicky added the type: security code to address security issues label Mar 1, 2022
@ehmicky
Copy link
Contributor Author

ehmicky commented Mar 8, 2022

First part at #757

@ehmicky ehmicky self-assigned this Mar 8, 2022
@kitop kitop removed the type: security code to address security issues label Jul 12, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants