Gather around, it's story time. (If you hate stories, you can scroll down to the bottom. You monster.)
Have you upgraded your dev machine to node6 yet? If so, it most likely upgraded you to npm3 at the same time. Noticed the fancy (omg such noise!) progress bar and everything? Cool. Now go try to update the shrinkwrap in the auth-server. I dare you. What's the big deal, right? That's what I thought too. We have a nifty `npmshrink` thing, which does all the things. We have it in the package.json with an alias, so we can just run `npm run shrinkwrap`. This rebuilds our module tree, and generates a new shrinkwrap. Takes a couple minutes. I have a setup that will notify me when a command over 10 seconds finishes, so alt-tab and do something else. Some 10 minutes later, I realized, hey, there's no notification, what's the hold up? Hm, looks like it's still going (go go little progress bar!), so alt-tab away again. Remember 10 minutes later, OK, what is going on. Quick search says to turn off that progress bar, that it updates every single tick, and is slowing me down. Fine. Abort the command, disable progress, start command again. It's been 20 minutes, but now it should be quicker, right? Proceed to remember another 10 minutes later. Um, all the noise is gone! But, it's still going! Wow npm3, you've been eating too many tacos. Forget about it for another 30 minutes. Oh right, I was upgrading a simple dependency, the notification must have just bugged out... Wait, STILL? What ARE you doing, npm? Let me read this output... -.- ..... o.O .... O_O ... WAT! It's been looping this whole time! For an entire hour! Oh didn't you know, npm3 made it so `npm shrinkwrap` is now an alias for `npm run shrinkwrap`. So, when I enter `npm run shrinkwrap`, it goes and does `rm node_modules && npm install && npm shrinkwrap`. See the problem in there? After installing the whole dependency graph, the final part calls `npm shrinkwrap`, which is `npm run shrinkwrap`, which wipes the directoy and installs the whole dependency graph, and then calls `npm shrinkwrap`, which ... ;_; At this point, its 6pm, I figure it's a great time to play some Frogger on freeway. Er, so, sorry for using a whole page just to tell a story of a suicidal frog. Back to the subject. -------- How does someone avoid this tragic outcome? Force a downgrade to npm2, clearly. Except, that's not a very clear thing to remember to do, or to tell newcomers they need to as well. By the way, have you heard the story about how shrinkwrap is just kind of a lie, anyhow? npm knows it too. That's why the newest version, npm5, uses a new package-lock.json file by default, instead of shrinkwraps. They're pretty great. They include sha512s of the module content, and npm5 uses those for integrity checking. Now a bad download or evil registry or whatever would mean an error installing, instead of something horrible while deployed. So, what if we just upgraded to npm5? Like, boom, everywhere. It's super easy. Just `npm install npm@latest -g`, and you have npm5. Works on node4 and later. We can rip the shrinkwrappery out, and get better version locks, and it's way faster! I've tried it out locally already. We were concerned that something of ours reached into `node_modules` for l10n, but that still works just fine. While doing this, it'd be a fantastic time to kill all the node4 tests we have. It's such a tease that we're using node6, but then CI yells at us if we ever use new syntax available in node6. Anyone that's tried to use object destructuring knows what I mean. Big ol' meany CI. *tl;dr *- Let's upgrade all our stuff to npm5, and remove node4 support, so we can live in the bright new future!
_______________________________________________ Dev-fxacct mailing list [email protected] https://mail.mozilla.org/listinfo/dev-fxacct
