<div dir="ltr"><div><br></div><div>To close the loop here, we disucssed this in the backend catchup meeting today and decided:</div><div><br></div><div>* We're going to drop node4 support in all our repos, make node6 the defeault, and start looking at preliminary node8 support.</div><div>* Given that node6 ships with npm3, we need to do *something* to fix shrinkwrap on the auth-server. Sean's going to investigate whether just requiring npm5 is acceptable or whether we need a fix that works with npm3.</div><div><br></div><div><br></div><div> Thanks all,</div><div><br></div><div> Ryan</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 16 August 2017 at 02:36, Jon Buckley <span dir="ltr"><<a href="mailto:jbuckley@mozilla.com" target="_blank">jbuckley@mozilla.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>I have no concerns about moving to node 6. Adding npm v5 seems like an additional step that isn't necessary yet. All you need to do is rename the shrinkwrap script in package.json and the infinite loop won't occur, right?<br></div><div><br></div><div>I'd like to upgrade to node 8 after it has gone LTS which should be around October 2017.</div><span class="HOEnZb"><font color="#888888"><div><br></div><div>Jon<br></div></font></span></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Aug 14, 2017 at 10:42 PM, John Morrison <span dir="ltr"><<a href="mailto:jmorrison@mozilla.com" target="_blank">jmorrison@mozilla.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF"><span>
<div class="m_-3735939492188653432m_3457784456741389820moz-cite-prefix">On 08/14/17 17:40, Ryan Kelly wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">On 15 August 2017 at 10:20, Sean
McArthur <span dir="ltr"><<a href="mailto:smcarthur@mozilla.com" target="_blank">smcarthur@mozilla.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div><br>
</div>
<div><b>tl;dr </b>- Let's upgrade all our stuff to
npm5, and remove node4 support, so we can live in the
bright new future!</div>
<div><br>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Thanks for kicking off this discussion, Sean! John and
Jon, I'm particularly interested to know whether either of
these changes would be scary from an ops/deployment
perspective.</div>
</div>
</div>
</div>
</blockquote></span>
I'm +1 on moving to npm5. The travis and circle-ci instructions
would need to to be changed to install npm@5.<br>
<br>
Other things:<br>
- there's some leftover CXX=g++-4.8 stuff that I think can be
removed now (it was for older linux distros)<br>
- I thought the `npm shrinkwrap` loop was known and had been fixed
in some repos (but maybe I misremember)<br>
- I do think there are some places/scripts that reach into
`./node_modules/foo/node_modul<wbr>es/bin/bar.js`, but it just needs a
grep-audit to discover them/any.<br>
- (I'll mildly note that the yarn spin about npm isn't accurate, but
I don't really care: Subresource integrity checks are the true way).<br>
- By the way, we're also probably due to use node8, but let's do the
cleanup for node6/npm5 now.<br>
<br>
John<br>
<blockquote type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div><br>
</div>
<div><br>
</div>
<div> Cheers,</div>
<div><br>
</div>
<div> Ryan<br>
</div>
</div>
</div>
</div>
<br>
<fieldset class="m_-3735939492188653432m_3457784456741389820mimeAttachmentHeader"></fieldset>
<br>
<pre>______________________________<wbr>_________________
Dev-fxacct mailing list
<a class="m_-3735939492188653432m_3457784456741389820moz-txt-link-abbreviated" href="mailto:Dev-fxacct@mozilla.org" target="_blank">Dev-fxacct@mozilla.org</a>
<a class="m_-3735939492188653432m_3457784456741389820moz-txt-link-freetext" href="https://mail.mozilla.org/listinfo/dev-fxacct" target="_blank">https://mail.mozilla.org/listi<wbr>nfo/dev-fxacct</a>
</pre>
</blockquote>
<p><br>
</p>
</div>
<br>______________________________<wbr>_________________<br>
Dev-fxacct mailing list<br>
<a href="mailto:Dev-fxacct@mozilla.org" target="_blank">Dev-fxacct@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/dev-fxacct" rel="noreferrer" target="_blank">https://mail.mozilla.org/listi<wbr>nfo/dev-fxacct</a><br>
<br></blockquote></div><br></div>
</div></div><br>______________________________<wbr>_________________<br>
Dev-fxacct mailing list<br>
<a href="mailto:Dev-fxacct@mozilla.org">Dev-fxacct@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/dev-fxacct" rel="noreferrer" target="_blank">https://mail.mozilla.org/<wbr>listinfo/dev-fxacct</a><br>
<br></blockquote></div><br></div>