feat: Use npm v7 #304

danez · 2020-12-08T09:43:40Z

I updated npm from v6 to v7. Reading the blogposts there shouldn't be any breaking changes, at least not in the functionality that semantic-release uses.

One test failed, but it was testing npm internal stuff about formating of package.json, so I removed it. (npm v7 does seem to preserve whatever formatting is in the file and just replace the version.) Hope that is okay?

danez · 2020-12-08T09:46:35Z

Not sure why the integration tests fail with 403 errors.

gr2m · 2020-12-08T17:07:23Z

Thanks a lot Daniel, I really want us to upgrade to npm 7, it hopefully get rid of several outdated packages that we are stuck with because of npm 6. I'll try to have a look at the failed CI. This week is busy for me because of GitHub Universe, but I'll do my best. I definitely have it on my list and won't forget

ext · 2021-02-13T13:21:40Z

Possible a bit off-topic but I am a bit curious as to why it has to be a dependency at all, is not not possible to use system npm?

gr2m · 2021-02-17T01:28:44Z

not possible to use system npm?

the problem is compatibility. WE don't know what system npm version you have and making sure that the code is compatible with all current and future version is a maintenance nightmare

ext · 2021-02-17T10:24:26Z

not possible to use system npm?

the problem is compatibility. WE don't know what system npm version you have and making sure that the code is compatible with all current and future version is a maintenance nightmare

But it is also a bit nightmare-ish for users? It pulls many extra dependencies (some with security vulnerabilities) and it also causes incompatibilities in run scripts, e.g. system with npm 7 uses npm 6 (or vice versa after this PR) when using npm in a run script because node_modules/.bin/npm in now in $PATH. (Bonus points when node_modules/.bin/npm says there is an update to NPM despite the system already runs the latest)

But I get your point, I was mostly curious about the reasoning.

lattwood · 2021-03-29T14:44:06Z

Expect this issue to have more activity in the coming days, we received this notification two hours ago from dependabot.

edit: Link to GHSA: GHSA-vx3p-948g-6vhq / CVE-2021-27290

danez · 2021-03-30T12:20:41Z

@gr2m I figured out why the integration tests fail, It is only because npm v7 does not set the maintainers field anymore on publish, but npm-registry-couchapp requires it to be set.

To fix this I switched to the proper npm registry verdaccio instead of the docker image from here.

Now all the test seems to work :)

gr2m

great work! Thank you so much! Just one question

gr2m · 2021-03-30T12:32:52Z

test/prepare.test.js

-
-  // Verify the logger has been called with the version updated
-  t.deepEqual(t.context.log.args[0], ['Write version %s to package.json in %s', '1.0.0', cwd]);
-});


Why did you remove this test?

Because it was testing npm internal stuff. Npm v7 does not format package.json files anymore, so this test failed because no newlines were present in the expected package.json.
I could have "fixed" the test and adjusted the expected output, but the test before this one (Preserve indentation and newline) does exactly the same thing then and the testname would have not really described anymore what it is testing. So I decided to remove it.

got it, thanks 👍🏼

github-actions · 2021-03-30T12:42:34Z

🎉 This PR is included in version 7.1.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

wyardley · 2021-03-31T16:10:35Z

This won't result in projects still using the old format publishing with the new package-lock.json format, right?

This may not technically be breaking, but it is causing issues for some of our tooling that was calling npm and expecting the v6 output.

danez · 2021-03-31T19:47:18Z

Is the package-lock.json now released with v7? I thought it is always excluded.

weaintplastic · 2021-04-01T12:56:49Z

Hey @danez. 👋 Hope you are doing well.

We've updated semantic-release/npm from 7.0.10 to 7.1.0 and since then our release flow isn't able to pubish packages anymore to our private repository due to an authentification error. The release is performed inside a Github action providing anNPM_TOKEN

- name: Release
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
  run: npm run release -- --debug

The error we're receiving is

npm ERR! code ENEEDAUTH 
1869npm ERR! need auth This command requires you to be logged in. 
1870npm ERR! need auth You need to authorize this machine using `npm adduser`

Reverting the dependency update made our releases to finish successfully again. Do you have any advice where to look for a fix?

danez · 2021-04-01T13:50:30Z

hey @weaintplastic,

That is odd as this error only appears if no credentials are found for the registry. https://github.com/npm/cli/blob/latest/lib/publish.js#L99-L109
And semantic release should provide valid credentials for the command.

what is the npm version that is now installed in your project?
What was the complete output of semantic release?
I guess you specify the private registry in package.json->publishConfig->registry?

weaintplastic · 2021-04-01T14:06:58Z

@danez we are using node 15 and npm 7.

we have a .npmrc file in our root that includes the read-only NPM-TOKEN.
The token with publishing rights is provided through a Github secret as posted above.
The registry is defined as you said in package.json/publishConfig/registry.

which required swapping the registry from the integration tests to verdaccio, similar to the change in semantic-release/npm#304 for #2055

gr2m mentioned this pull request Jan 25, 2021

Warnings of dependency npm #333

Open

feat: Use npm v7

c8056f8

ext approved these changes Mar 30, 2021

View reviewed changes

gr2m reviewed Mar 30, 2021

View reviewed changes

gr2m merged commit a15c017 into semantic-release:master Mar 30, 2021

danez deleted the npm7 branch March 30, 2021 12:40

github-actions bot added the released label Mar 30, 2021

masone mentioned this pull request Sep 29, 2021

feat(node-version): raised the minimum required version to v14.17 (#2063) semantic-release/semantic-release#2132

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Use npm v7 #304

feat: Use npm v7 #304

danez commented Dec 8, 2020 •

edited

danez commented Dec 8, 2020

gr2m commented Dec 8, 2020

ext commented Feb 13, 2021

gr2m commented Feb 17, 2021

ext commented Feb 17, 2021

lattwood commented Mar 29, 2021 •

edited

danez commented Mar 30, 2021

gr2m left a comment

gr2m Mar 30, 2021

danez Mar 30, 2021 •

edited

gr2m Mar 30, 2021

github-actions bot commented Mar 30, 2021

wyardley commented Mar 31, 2021

danez commented Mar 31, 2021

weaintplastic commented Apr 1, 2021 •

edited

danez commented Apr 1, 2021

weaintplastic commented Apr 1, 2021

feat: Use npm v7 #304

feat: Use npm v7 #304

Conversation

danez commented Dec 8, 2020 • edited

danez commented Dec 8, 2020

gr2m commented Dec 8, 2020

ext commented Feb 13, 2021

gr2m commented Feb 17, 2021

ext commented Feb 17, 2021

lattwood commented Mar 29, 2021 • edited

danez commented Mar 30, 2021

gr2m left a comment

Choose a reason for hiding this comment

gr2m Mar 30, 2021

Choose a reason for hiding this comment

danez Mar 30, 2021 • edited

Choose a reason for hiding this comment

gr2m Mar 30, 2021

Choose a reason for hiding this comment

github-actions bot commented Mar 30, 2021

wyardley commented Mar 31, 2021

danez commented Mar 31, 2021

weaintplastic commented Apr 1, 2021 • edited

danez commented Apr 1, 2021

weaintplastic commented Apr 1, 2021

danez commented Dec 8, 2020 •

edited

lattwood commented Mar 29, 2021 •

edited

danez Mar 30, 2021 •

edited

weaintplastic commented Apr 1, 2021 •

edited