preveen-stack
commented
12 months ago cc @nodejs/package-maintenance PTAL
Open Alexgopen opened 12 months ago
preveen-stack
commented
12 months ago cc @nodejs/package-maintenance PTAL
Alexgopen
commented
12 months ago I've received new information from the Chocolatey support team:
Apparently package installs were being double-counted by chocolatey.org's rate limiting, resulting in hitting the rate limit with fewer requests than usual, and receiving a 1 hour IP ban. Nonetheless, 19 packages requested by the Node.js installer is very close to their limit of 20/minute before a 1 hour IP ban. This should probably be considered for an opportunity to limit requests/minute made to chocolatey.org by the Node.js installer, otherwise adding new packages in the future could lead to exceeding their 20/minute limit if a user's PC gets through the installer in under a minute, triggering a 1 hour IP ban, and failing the install.
richardlau
commented
12 months ago You can see the exact command optionally run by the installer in https://github.com/nodejs/node/blob/v18.17.1/tools/msvs/install_tools/install_tools.bat#L55
This requests two packages
choco upgrade -y python visualstudio2019-workload-vctoolsAll of the other packages being installed must be dependencies of those packages in chocolatey.
ljharb
commented
12 months ago 20/minute is vanishingly small ftr; in the node ecosystem you'd hit that in a second or two - and having an hour ban is highly punitive for going slightly over a limit.
cinderblock
commented
4 months ago
Details
I attempted to install Node.js LTS on my home PC today using the Windows installer. At the point where the installation installs Chocolatey and required packages, I ran into an issue where two of the packages failed due to error 429 (Too Many Requests), and upon checking chocolatey.org I was 1 hour IP banned by their Cloudflare rate limiting.
I contacted Chocolatey's support team, who were confused by this and seemed to think I was an organization excessively sending requests, which is not the case, I am a single home user trying to install Node.js. They explained their rate limits for chocolatey.org as follows:
I then checked my chocolatey.log file and found that its execution ran from 2023-08-24 11:49:07,834 to 2023-08-24 11:50:07,447 which is indeed under 1 minute.
During this time, the Node.js 18.17.1 LTS Windows installer had installed Chocolatey itself, as well as many packages.
It seems that on a sufficiently fast internet connection and pc, the Windows installer for Node.js 18.17.1 LTS itself will run into chocolatey.org's rate limiting, resulting in an IP ban, and inability to complete installation.
In the end I had to resort to connecting to a VPN to get a different IP, and re-ran the installer to get the remaining two packages, bypassing my chocolatey.org IP ban.
The Node.js installer could probably use some waits in the install script to prevent getting rate limited, otherwise this might become a more prevalent issue going forward as PC hardware continues to get faster.
Node.js version
18.17.1 LTS
Example code
No response
Operating system
Microsoft Windows [Version 10.0.19045.3208]
Scope
Installation
Module and version
Not applicable.