search

RafaelGSS / is-my-node-vulnerable

package that checks if your Node.js installation is vulnerable to known security vulnerabilities
MIT License
180 stars 6 forks source link

Specify minimum supported Node.js version in package.json engines field #21

Open trivikr opened 2 days ago

trivikr commented 2 days ago

Is your feature request related to a problem? Please describe.

The minimum supported Node.js version is not specified for is-my-node-vulnerable module.

The consumers are not aware of which versions this module supports, and it keep re-appearing

Describe the solution you'd like

Specify which versions of Node.js the module supports in package.json engines field, and add tests for them in CI. Since consumers are expected to run this module on EOL versions of Node.js, maybe support one or two EOL LTS versions?

As per the current CI setup, this module is expected to support Node.js 14+ https://github.com/RafaelGSS/is-my-node-vulnerable/blob/050a05a0798054e069bd305e866a84e326bba558/.github/workflows/test.yml#L14

RafaelGSS commented 2 days ago

Let's target v14 for now and see what needs to be done to support v12 and v10. Wdyt?

RafaelGSS commented 2 days ago

Actually, we could support pretty much all versions if we first check if process.version < 18.0.0 and throw the EOL warning, before requiring or using any module