chore: Bump node version used on GitHub

adopted-ember-addons / ember-cli-content-security-policy

MIT License

158 stars 51 forks source link

chore: Bump node version used on GitHub #366

Closed MichalBryxi closed 6 months ago

MichalBryxi commented 6 months ago

While adding trivial change to the code I bumped into CI being red from various reasons last one ended with a hard error on:

[3/5] Fetching packages...
error ember-cli-babel@8.2.0: The engine "node" is incompatible with this module. Expected version "16.* || 18.* || >= 20". Got "12.22.12"
error Found incompatible module.

I tried to reproduce locally, but node@12.x is surprisingly not trivial to install on modern OSX without breaking my other projects.
I tried to consult the node support matrix for EmberJS and since 16.x is supported through 3.28.0 - 5.3.0, it seems like a safe bet.
After a consultation in the PR, it has been decided to go with node@18.

MichalBryxi commented 6 months ago

Happy to hear your thoughts. I can't tell if this change also means that the code compatibility will suffer? But some cuts need to be done at some point?

MichalBryxi commented 6 months ago

I'm happy dropping support for node <18. Could you please update package.json accordingly as well?

Should be done as well.

MichalBryxi commented 6 months ago

It's "changing the lightbulb" again :) Now there seems to be an old security issue in node(?) I tried to follow the most reasonably looking answer by this commit.

Seems to easy to see that nothing dodgy is going on by:

npm_config_yes=true npx yarn-audit-fix

Now waiting for the CI to tell yes/no.

MichalBryxi commented 6 months ago

This ... is getting pretty tangly. Any chance someone who might have a better overview over the project could take a look? I was trying to make a minimal change necessary, but ... things keep needing attention...

MichalBryxi commented 6 months ago

Talked on Discord about this. The goal here is not to update the package per-se, but to allow me to progress with #365. Given that this package might get replaced, significant efforts to modernise it are not good use of anyone's time. So going to close this PR and see if #365 can be "fixed" simply by changing the README which might pass the CI.