[bug#74187] [PATCH 00/20] Bumping node to 20.18.0 and beyond

[bug#74187] [PATCH 00/20] Bumping node to 20.18.0 and beyond

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

Hey folks,

As our current node-lts package has quite some security issues, here a bump to a recent release of something that is maintained. After this has been merged, a version bump to the Active LTS version of node (22) is in the works as well. 

I also opted to finally move everything and everyone away from the (very insecure) node@10/node-bootstrap package in this series. In case it makes sense to add a deprecated package alias for the now-removed `node` variable, please let me know; I sincerely hope nobody was still using node@10 anywhere.

guix refresh tells me the following:
Building the following 126 packages would ensure 223 dependent packages are rebuilt.
I'd appreciate a reminder as to whether this means this can go straight to master, or rather should be relegated to a specialised branch for the merge train(s).


Jelle Licht (20):
  gnu: node: Replace customized nghttp2-for-node by nghttp2.
  gnu: Remove nghttp2-for-node.
  gnu: node-lts: Replace customized c-ares-for-node by c-ares.
  gnu: Remove c-ares-for-node.
  gnu: Add libuv-for-node-lts.
  gnu: llhttp-bootstrap: Update to 8.1.2.
  gnu: node-lts: Update to 20.18.0 [security fixes].
  gnu: r-v8: Fix build with node-lts@20.
  gnu: cwltool: Use node-lts instead of node.
  gnu: python-cwl-utils: Use node-lts instead of node.
  gnu: ocaml-ezjsonm: Use node-lts instead of node.
  gnu: js-of-ocaml: Use node-lts instead of node.
  gnu: fmp: Use node-lts instead of node.
  gnu: python-cloudscraper: Use node-lts instead of node.
  gnu: qtwebengine-5: Use node-lts instead of node.
  gnu: ruby-autoprefixer-rails: Use node-lts instead of node.
  gnu: ruby-execjs: Use node-lts instead of node.
  gnu: vlang: Use node-lts instead of node.
  gnu: esbuild-node: Use node-lts instead of node.
  gnu: node: Rename variable node-bootstrap and hide package.

 gnu/packages/adns.scm               | 22 ----------
 gnu/packages/bioinformatics.scm     |  4 +-
 gnu/packages/cran.scm               |  2 +-
 gnu/packages/libevent.scm           | 24 +++++++++++
 gnu/packages/node.scm               | 67 +++++++++++++++++++----------
 gnu/packages/ocaml.scm              |  4 +-
 gnu/packages/package-management.scm |  2 +-
 gnu/packages/python-web.scm         |  2 +-
 gnu/packages/qt.scm                 |  2 +-
 gnu/packages/rails.scm              |  2 +-
 gnu/packages/ruby.scm               |  2 +-
 gnu/packages/vlang.scm              |  2 +-
 gnu/packages/web.scm                | 39 +----------------
 13 files changed, 82 insertions(+), 92 deletions(-)


base-commit: a26ba23cdd476cb5eb8378c4785ccf1bc4145f17
-- 
2.46.0

[bug#74187] [PATCH 01/20] gnu: node: Replace customized nghttp2-for-node by nghttp2.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/node.scm (node) [native-inputs]: Replace nghttp2-for-node by
nghttp2.
[inputs]: Ditto.
[arguments]<#:phases>: Adjust accordingly by skipping failing tests.

Change-Id: Ia3d63ea1c428c1353d6ec6fda394ccb016eb6603
---
 gnu/packages/node.scm | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index 7c320a00d6..6414b94278 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -48,6 +48,7 @@ (define-module (gnu packages node)
   #:use-module (gnu packages icu4c)
   #:use-module (gnu packages libevent)
   #:use-module (gnu packages linux)
+  #:use-module (gnu packages networking)
   #:use-module (gnu packages node-xyz)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
@@ -155,6 +156,11 @@ (define-public node
                          ;; See also <https://github.com/nodejs/node/issues/25903>.
                          "test/sequential/test-performance.js"))
 
+             ;; These tests fail on recent versions of nghttp2
+             (for-each delete-file
+                       '("test/parallel/test-http2-methods.js"
+                         "test/parallel/test-http2-multiplex.js"))
+
              ;; This requires a DNS resolver.
              (delete-file "test/parallel/test-dns.js")
 
@@ -297,7 +303,7 @@ (define-public node
            http-parser
            icu4c
            libuv-for-node
-           `(,nghttp2-for-node "lib")
+           `(,nghttp2 "lib")
            openssl-1.1
            zlib
            ;; Regular build-time dependencies.
@@ -317,7 +323,7 @@ (define-public node
            http-parser
            icu4c
            libuv-for-node
-           `(,nghttp2-for-node "lib")
+           `(,nghttp2 "lib")
            openssl
            python-wrapper               ;for node-gyp (supports python3)
            zlib))
-- 
2.46.0

[bug#74187] [PATCH 02/20] gnu: Remove nghttp2-for-node.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

This hidden package is not needed as the ancient version of node we use to
bootstrap llhttp can be built using the standard nghttp2 package.

* gnu/packages/web.scm (assimp-5.0): Delete variable.

Change-Id: Ib077fcc55c9bf7fd3caab69220aa8c86e5c33f8a
---
 gnu/packages/web.scm | 29 -----------------------------
 1 file changed, 29 deletions(-)

diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index 34739bf088..842c25b509 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -8552,35 +8552,6 @@ (define-public nghttp2
 @end itemize\n")
     (license license:expat)))
 
-;; Older variant for Node versions < 17 (upstream commit 43291b98edaa682
-;; add support for newer nghttp2, but is difficult to backport).
-(define-public nghttp2-for-node
-  (hidden-package
-   (package
-     (inherit nghttp2)
-     (version "1.44.0")
-     (source (origin
-               (method url-fetch)
-               (uri (string-append "https://github.com/nghttp2/nghttp2/"
-                                   "releases/download/v" version "/"
-                                   "nghttp2-" version ".tar.xz"))
-               (sha256
-                (base32
-                 "0p9wvva4g8hwj55x19rbyvnq2dbsnf65rphhxnpqs7ll54xlg6an"))))
-     (arguments
-      (substitute-keyword-arguments (package-arguments nghttp2)
-        ((#:phases phases #~%standard-phases)
-         #~(modify-phases #$phases
-             (add-after 'unpack 'workaround-broken-python-version-check
-               (lambda _
-                 (substitute* "configure"
-                   ;; The configure script uses a string comparison to
-                   ;; determine whether the Python interpreter is recent
-                   ;; enough, which fails when comparing 3.8 to 3.10.
-                   ;; Convert to tuples for a more reliable check.
-                   (("print \\(ver >= '3\\.8'\\)")
-                    "print (tuple(map(int, ver.split('.'))) >= (3,8))")))))))))))
-
 (define-public nghttp3
   (package
     (name "nghttp3")
-- 
2.46.0

[bug#74187] [PATCH 03/20] gnu: node-lts: Replace customized c-ares-for-node by c-ares.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/node.scm (node-lts) [native-inputs]: Replace c-ares-for-node by
c-ares.
[inputs]: Ditto.

Change-Id: Ibef027d55c14e302d406d6478fed474f67c0d508
---
 gnu/packages/node.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index 6414b94278..3997042e76 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -936,7 +936,7 @@ (define-public node-lts
                  (chmod file #o555))))))))
     (native-inputs
      (list ;; Runtime dependencies for binaries used as a bootstrap.
-           c-ares-for-node
+           c-ares
            brotli
            icu4c
            libuv
@@ -952,7 +952,7 @@ (define-public node-lts
     (inputs
      (list bash-minimal
            coreutils
-           c-ares-for-node
+           c-ares
            icu4c
            libuv
            llhttp-bootstrap
-- 
2.46.0

[bug#74187] [PATCH 04/20] gnu: Remove c-ares-for-node.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

The node-lts package can now be built using the standard c-ares package.

* gnu/packages/adns.scm (c-ares-for-node): Delete variable.

Change-Id: I9e613f2d4aeacb6079d69f5bef22d11eb8dc6b18
---
 gnu/packages/adns.scm | 22 ----------------------
 1 file changed, 22 deletions(-)

diff --git a/gnu/packages/adns.scm b/gnu/packages/adns.scm
index bf07219d17..1097b84062 100644
--- a/gnu/packages/adns.scm
+++ b/gnu/packages/adns.scm
@@ -161,25 +161,3 @@ (define-public c-ares/cmake
      (arguments
       `(;; XXX: Tests require name resolution (the normal variant runs no tests).
         #:tests? #f)))))
-
-(define-public c-ares-for-node
-  (hidden-package
-   (package
-     (inherit c-ares)
-     (name "c-ares")
-     (version "1.18.1")
-     (source (origin
-               (method url-fetch)
-               (uri (string-append
-                     "https://c-ares.haxx.se/download/" name "-" version
-                     ".tar.gz"))
-               (sha256
-                (base32
-                 "1kxviskwsaa7dcgscvssxa8ps88pdq7kq4z93gxvz7sam2l54z8s"))))
-     (arguments
-      '(#:phases
-        (modify-phases %standard-phases
-          (add-before 'check 'filter-live-tests
-            (lambda _
-              ;; Filter tests that require internet access.
-              (setenv "GTEST_FILTER" "-*.Live*:*.FamilyV4*")))))))))
-- 
2.46.0

[bug#74187] [PATCH 05/20] gnu: Add libuv-for-node-lts.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

Specific versions of Node depend on specific versions of libuv.

* gnu/packages/libevent.scm (libuv-for-node-lts): New package.

Change-Id: I97f6b96002dde37a0cec56dbfd7ff8722982ff89
---
 gnu/packages/libevent.scm | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/gnu/packages/libevent.scm b/gnu/packages/libevent.scm
index 20f967757d..202deaea47 100644
--- a/gnu/packages/libevent.scm
+++ b/gnu/packages/libevent.scm
@@ -158,6 +158,30 @@ (define-public libuv-for-node
                 "0wpb9pz3r8nksnrf4zbixj2kk9whr7abi45ydrwyv2js2ljrc4j3"))))
     (properties '((hidden? . #t)))))
 
+(define-public libuv-for-node-lts
+  ;; When upgrading Node, also upgrade this. Get the version from
+  ;; https://github.com/nodejs/node/blob/main/deps/uv/include/uv/version.h
+  (package
+    (inherit libuv)
+    (name "libuv")
+    (version "1.46.0")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://dist.libuv.org/dist/v" version
+                                  "/libuv-v" version ".tar.gz"))
+              (sha256
+               (base32
+                "1knxvp6bl3y0c87cch1id0z7m7rb6igx55ci93qnbp4zifaq67qi"))
+       (modules '((guix build utils)))
+       (snippet
+        '(begin
+           ;; Disable io_uring by default due to CVE-2024-22017. Can be removed once
+           ;; https://github.com/libuv/libuv/issues/4468 is released and compatible
+           ;; with Node.js
+           (substitute* "src/unix/linux.c"
+             (("val == NULL \\|\\|") "val != NULL &&"))))))
+    (properties '((hidden? . #t)))))
+
 (define-public libuv-for-r-httpuv
   ;; When upgrading r-httpuv, also upgrade this.
   (package
-- 
2.46.0

[bug#74187] [PATCH 06/20] gnu: llhttp-bootstrap: Update to 8.1.2.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/node.scm (llhttp-bootstrap): Update to 8.1.2.

Change-Id: I4eff26889b2645c031fc9ea896657468d5752953
---
 gnu/packages/node.scm | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index 3997042e76..36ed22e052 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -680,7 +680,7 @@ (define-public node-llparse-bootstrap
 (define-public llhttp-bootstrap
   (package
     (name "llhttp")
-    (version "6.0.11")
+    (version "8.1.2")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -689,7 +689,7 @@ (define-public llhttp-bootstrap
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "16gaylka6nx9bsff9xga3s8xihxm3k7svrb88lr4dj2s4pzlfga9"))
+                "1808y8mpdcmsi8rxndilngg4nn2fbqfgb29f47kk9mmdpqg5s17r"))
               (modules '((guix build utils)))
               (snippet
                '(begin
@@ -715,6 +715,7 @@ (define-public llhttp-bootstrap
                                                "/bin/esbuild")))
                (invoke esbuild
                        "--platform=node"
+                       "--target=node10"
                        "--outfile=bin/generate.js"
                        "--bundle" "bin/generate.ts"))))
          (add-before 'install 'create-install-directories
-- 
2.46.0

[bug#74187] [PATCH 07/20] gnu: node-lts: Update to 20.18.0 [security fixes].

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/node.scm (node-lts): Update to 20.18.0.
[origin]: Delete bundled brotli, ngtcp2 and uv.
[:configure-flags]: Add shared-nghtcp2 flag. Add shared-nghttp3 flag.
[#:phases]<delete-problematic-tests>: Remove tests that fail due to linking to
unbundled libuv.
[native-inputs]: Replace libuv by libuv-for-node-lts.
[inputs]: Replace libuv by libuv-for-node-lts. Add ngtpc2, nghttp3.

Change-Id: I932e64f212283b34f0affad65c3d9f92fdea3d79
---
 gnu/packages/node.scm | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index 36ed22e052..f046f1bad5 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -750,14 +750,14 @@ (define-public llhttp-bootstrap
 (define-public node-lts
   (package
     (inherit node)
-    (version "18.19.0")
+    (version "20.18.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nodejs.org/dist/v" version
                                   "/node-v" version ".tar.gz"))
               (sha256
                (base32
-                "05qc1dgmrms73073n4l36jrcxf6ygqj959d3cngy5qclrg0isk6x"))
+                "033jb6kf9jq2qlq7ncvbznkd9wi3zppjl0129k989183qn7rz0f0"))
               (modules '((guix build utils)))
               (snippet
                '(begin
@@ -768,9 +768,12 @@ (define-public node-lts
                                           (not (string-contains file "nodejs-openssl.cnf")))))
                   ;; Remove bundled software, where possible
                   (for-each delete-file-recursively
-                            '("deps/cares"
+                            '("deps/brotli"
+                              "deps/cares"
                               "deps/icu-small"
                               "deps/nghttp2"
+                              "deps/ngtcp2"
+                              "deps/uv"
                               "deps/zlib"))
                   (substitute* "Makefile"
                     ;; Remove references to bundled software.
@@ -786,6 +789,8 @@ (define-public node-lts
            "--shared-zlib"
            "--shared-brotli"
            "--with-intl=system-icu"
+           "--shared-ngtcp2"
+           "--shared-nghttp3"
            ;;Needed for correct snapshot checksums
            "--v8-enable-snapshot-compression"))
        ((#:phases phases)
@@ -874,7 +879,15 @@ (define-public node-lts
                ;; TODO: Regenerate certs instead.
                (for-each delete-file
                          '("test/parallel/test-tls-passphrase.js"
-                           "test/parallel/test-tls-server-verify.js"))))
+                           "test/parallel/test-tls-server-verify.js"))
+
+               ;; These tests fail when linking to upstream libuv.
+               ;; https://github.com/nodejs/node/commit/3f6addd590
+               (for-each delete-file
+                         '("test/parallel/test-process-euid-egid.js"
+                           "test/parallel/test-process-initgroups.js"
+                           "test/parallel/test-process-setgroups.js"
+                           "test/parallel/test-process-uid-gid.js"))))
            (add-after 'delete-problematic-tests 'replace-llhttp-sources
              (lambda* (#:key inputs #:allow-other-keys)
                ;; Replace pre-generated llhttp sources
@@ -940,10 +953,11 @@ (define-public node-lts
            c-ares
            brotli
            icu4c
-           libuv
+           libuv-for-node-lts
            `(,nghttp2 "lib")
            openssl
            zlib
+           ; ngtcp2? nghttp3?
            ;; Regular build-time dependencies.
            perl
            pkg-config
@@ -955,9 +969,11 @@ (define-public node-lts
            coreutils
            c-ares
            icu4c
-           libuv
+           libuv-for-node-lts
            llhttp-bootstrap
            brotli
+           ngtcp2
+           nghttp3
            `(,nghttp2 "lib")
            openssl
            zlib))))
-- 
2.46.0

[bug#74187] [PATCH 08/20] gnu: r-v8: Fix build with node-lts@20.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

The version bump of node-lts from 18 to 20 also bumped the version in the so-file.

* gnu/packages/cran.scm (r-v8)[#:phases]<find-v8>: Look for libnode-so.115 as
provided by node-lts.

Change-Id: Ib5c0d865aea36c7d881efddf4877cbab4b7dd932
---
 gnu/packages/cran.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/cran.scm b/gnu/packages/cran.scm
index dc2a77593a..f69281c177 100644
--- a/gnu/packages/cran.scm
+++ b/gnu/packages/cran.scm
@@ -2454,7 +2454,7 @@ (define-public r-v8
                (("^PKG_LIBS=.*")
                 (string-append "PKG_LIBS="
                                (assoc-ref inputs "libnode")
-                               "/lib/libnode.so.108\n")))
+                               "/lib/libnode.so.115\n")))
              (setenv "INCLUDE_DIR"
                      (string-append
                       (assoc-ref inputs "libnode")
-- 
2.46.0

[bug#74187] [PATCH 08/20] gnu: r-v8: Fix build with node-lts@20.

[Ricardo Wurmus]

jlicht@fsfe.org writes:

> From: Jelle Licht <jlicht@fsfe.org>
>
> The version bump of node-lts from 18 to 20 also bumped the 
> version in the so-file.
>
> * gnu/packages/cran.scm (r-v8)[#:phases]<find-v8>: Look for 
> libnode-so.115 as
> provided by node-lts.

This looks okay to me, but I don't see the bump from 18 to 20 on 
the master branch, so I'll wait for someone else to apply this 
patch when it becomes necessary.

-- 
Ricardo

[bug#74187] [PATCH 09/20] gnu: cwltool: Use node-lts instead of node.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/bioinformatics.scm (cwltool)[inputs]: Replace node by node-lts.

Change-Id: Idea8c5cb456080fccd8fff6c6b2c674764ae7bce
---
 gnu/packages/bioinformatics.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/bioinformatics.scm b/gnu/packages/bioinformatics.scm
index 3c1c180b7c..3430d3072b 100644
--- a/gnu/packages/bioinformatics.scm
+++ b/gnu/packages/bioinformatics.scm
@@ -5865,7 +5865,7 @@ (define-public cwltool
            python-spython
            python-typing-extensions
            ;; Not listed as needed but still necessary:
-           node))
+           node-lts))
     (native-inputs
      (list python-arcp
            python-humanfriendly
-- 
2.46.0

[bug#74187] [PATCH 10/20] gnu: python-cwl-utils: Use node-lts instead of node.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/bioinformatics.scm (python-cwl-utils)[inputs]: Replace node by
node-lts.

Change-Id: Ia98601db0a9233a96263051e1520a848dbc40a9c
---
 gnu/packages/bioinformatics.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/bioinformatics.scm b/gnu/packages/bioinformatics.scm
index 3430d3072b..7d7c5b871a 100644
--- a/gnu/packages/bioinformatics.scm
+++ b/gnu/packages/bioinformatics.scm
@@ -5775,7 +5775,7 @@ (define-public python-cwl-utils
                              " and not test_remote_packing_github_soft_links"
                              " and not test_value_from_two_concatenated_expressions"))))
     (inputs
-     (list node))
+     (list node-lts))
     (native-inputs
      (list python-mypy-extensions
            python-pytest
-- 
2.46.0

[bug#74187] [PATCH 11/20] gnu: ocaml-ezjsonm: Use node-lts instead of node.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/ocaml.scm (ocaml-ezjsonm)[native-inputs]: Replace node by
node-lts.

Change-Id: Icb79d2ac8cfa424a55e9b5985b8f4dacae7a9f37
---
 gnu/packages/ocaml.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/ocaml.scm b/gnu/packages/ocaml.scm
index 9d29105cdb..dc35bd4d97 100644
--- a/gnu/packages/ocaml.scm
+++ b/gnu/packages/ocaml.scm
@@ -5061,7 +5061,7 @@ (define-public ocaml-ezjsonm
     (build-system dune-build-system)
     (arguments
      `(#:package "ezjsonm"))
-    (native-inputs (list ocaml-alcotest js-of-ocaml node))
+    (native-inputs (list ocaml-alcotest js-of-ocaml node-lts))
     (propagated-inputs (list ocaml-jsonm ocaml-uutf ocaml-sexplib0 ocaml-hex))
     (home-page "https://github.com/mirage/ezjsonm/")
     (synopsis "Read and write JSON data")
-- 
2.46.0

[bug#74187] [PATCH 12/20] gnu: js-of-ocaml: Use node-lts instead of node.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/ocaml.scm (js-of-ocaml)[native-inputs]: Replace node by
node-lts.

Change-Id: Ie7dd4dc25bac75a41d1510df9ecf6cc2c4a2c5a7
---
 gnu/packages/ocaml.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/ocaml.scm b/gnu/packages/ocaml.scm
index dc35bd4d97..1b7a43ce7e 100644
--- a/gnu/packages/ocaml.scm
+++ b/gnu/packages/ocaml.scm
@@ -9081,7 +9081,7 @@ (define-public js-of-ocaml
            ocaml-yojson))
     (native-inputs
      ;; for tests
-     (list node ocaml-ppx-expect ocaml-num))
+     (list node-lts ocaml-ppx-expect ocaml-num))
     (properties `((upstream-name . "js_of_ocaml")))
     (home-page "https://ocsigen.org/js_of_ocaml/")
     (synopsis "Compiler from OCaml bytecode to Javascript")
-- 
2.46.0

[bug#74187] [PATCH 13/20] gnu: fmp: Use node-lts instead of node.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/package-management.scm (fpm)[native-inputs]: Repalce node by
node-lts.

Change-Id: I5afdb49e18805722b9e69be0cf48c3a29ce49921
---
 gnu/packages/package-management.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/package-management.scm b/gnu/packages/package-management.scm
index 1763d2d59f..18a8d1e981 100644
--- a/gnu/packages/package-management.scm
+++ b/gnu/packages/package-management.scm
@@ -2193,7 +2193,7 @@ (define-public fpm
     (native-inputs
      (list dpkg
            libarchive
-           node
+           node-lts
            perl-app-cpanminus
            python
            ruby-rspec
-- 
2.46.0

[bug#74187] [PATCH 14/20] gnu: python-cloudscraper: Use node-lts instead of node.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/python-web.scm (python-cloudscraper)[inputs]: Replace node by
node-lts.

Change-Id: Id7a9354c04557d27ec90cfbecd0c8005cf912f1a
---
 gnu/packages/python-web.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/python-web.scm b/gnu/packages/python-web.scm
index d892e03c9d..5d34534e12 100644
--- a/gnu/packages/python-web.scm
+++ b/gnu/packages/python-web.scm
@@ -7615,7 +7615,7 @@ (define-public python-cloudscraper
                (invoke "pytest" "-vv"
                        "-k" "not test_getCookieString_challenge_js_challenge1_16_05_2020")))))))
     (inputs
-     (list node))
+     (list node-lts))
     (propagated-inputs
      (list python-js2py
            python-polling2
-- 
2.46.0

[bug#74187] [PATCH 15/20] gnu: qtwebengine-5: Use node-lts instead of node.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/qt.scm (qtwebengine-5)[native-inputs]: Replace node by
node-lts.

Change-Id: If05e9dd0ef4a971074828da66742bb9387536e4d
---
 gnu/packages/qt.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/qt.scm b/gnu/packages/qt.scm
index 687c20cd90..62413ce445 100644
--- a/gnu/packages/qt.scm
+++ b/gnu/packages/qt.scm
@@ -3198,7 +3198,7 @@ (define-public qtwebengine-5
            flex
            gperf
            ninja
-           node
+           node-lts
            perl
            pkg-config
            python2-six
-- 
2.46.0

[bug#74187] [PATCH 16/20] gnu: ruby-autoprefixer-rails: Use node-lts instead of node.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/rails.scm (ruby-autoprefixer-rails)[native-inputs]: Replace
node by node-lts.

Change-Id: Iea7fc9001cb12eecb1257a9a0f83851bd8bc36fd
---
 gnu/packages/rails.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/rails.scm b/gnu/packages/rails.scm
index a28249d9bd..537650cc88 100644
--- a/gnu/packages/rails.scm
+++ b/gnu/packages/rails.scm
@@ -273,7 +273,7 @@ (define-public ruby-autoprefixer-rails
            ruby-sprockets
            ruby-standard
            ;; This is used at runtime by ruby-execjs.
-           node))
+           node-lts))
     (propagated-inputs
      (list ruby-execjs))
     (synopsis "Parse CSS and add vendor prefixes to CSS rules")
-- 
2.46.0

[bug#74187] [PATCH 17/20] gnu: ruby-execjs: Use node-lts instead of node.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/ruby.scm (ruby-execjs)[native-inputs]: Replace node by
node-lts.

Change-Id: If7ff42d9865d79c23560fb190db4fdce9ecc621c
---
 gnu/packages/ruby.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/ruby.scm b/gnu/packages/ruby.scm
index 5af1bb1cef..c563c100b4 100644
--- a/gnu/packages/ruby.scm
+++ b/gnu/packages/ruby.scm
@@ -3124,7 +3124,7 @@ (define-public ruby-execjs
            ;; PASSED: test:node
            ;; SKIPPED: test:duktape, ;; test:javascriptcore, test:jscript,
            ;; test:miniracer, test:rubyracer, ;; test:rubyrhino, test:v8
-           node))
+           node-lts))
     (synopsis "Run JavaScript code from Ruby")
     (description
      "ExecJS lets you run JavaScript code from Ruby.  It automatically picks a
-- 
2.46.0

[bug#74187] [PATCH 18/20] gnu: vlang: Use node-lts instead of node.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/vlang.scm (vlang)[native-inputs]: Replace node by node-lts.

Change-Id: Iaf577f0b9bbd7095392c88c2d2737c0703d3bf96
---
 gnu/packages/vlang.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/vlang.scm b/gnu/packages/vlang.scm
index 4741483f12..db3b6a66aa 100644
--- a/gnu/packages/vlang.scm
+++ b/gnu/packages/vlang.scm
@@ -133,7 +133,7 @@ (define-public vlang
       ("git" ,git-minimal)
       ;; For the tests.
       ("libx11" ,libx11)
-      ("node" ,node)
+      ("node" ,node-lts)
       ("openssl" ,openssl)
       ("sqlite" ,sqlite)))
    (home-page "https://vlang.io/")
-- 
2.46.0

[bug#74187] [PATCH 19/20] gnu: esbuild-node: Use node-lts instead of node.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

* gnu/packages/web.scm (esbuild-node)[#:phases]<build-platform>: Remove
workaround needed for building with older versions of Node.
[native-inputs]: Replace node by node-lts.

Change-Id: Iedf30dc1a395e674007c08ce6c0881dbb0f94f0e
---
 gnu/packages/web.scm | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index 842c25b509..954da312bd 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -2126,12 +2126,6 @@ (define-public esbuild-node
           (add-after 'build 'build-platform
             (lambda* (#:key unpack-path #:allow-other-keys)
               (with-directory-excursion (string-append "src/" unpack-path)
-                ;; We're using Node 10, which doesn't have this method.
-                (substitute* "scripts/esbuild.js"
-                  (("exports.buildNativeLib" m)
-                   (string-append
-                    "Object.fromEntries = entries => entries.reduce((result, entry) => (result[entry[0]] = entry[1], result), {});\n"
-                    m)))
                 ;; Must be writable.
                 (for-each make-file-writable (find-files "." "."))
                 (invoke "node" "scripts/esbuild.js"
@@ -2154,7 +2148,7 @@ (define-public esbuild-node
                   (invoke "make" "test-go"))))))))
     (native-inputs
      (modify-inputs (package-native-inputs esbuild)
-       (append node)))))
+       (append node-lts)))))
 
 (define-public wwwoffle
   (package
@@ -9517,7 +9511,7 @@ (define-public archivebox
     (build-system python-build-system)
     (propagated-inputs
      (list curl
-           node))
+           node-lts))
     (inputs
      (list python
            youtube-dl
-- 
2.46.0

[bug#74187] [PATCH 20/20] gnu: node: Rename variable node-bootstrap and hide package.

[jlicht]

From: Jelle Licht <jlicht@fsfe.org>

The formerly known as node package has security issues, so should only be used
to bootstrap more recent and secure versions of node.

* gnu/packages/node.scm (node): Rename to...
(node-bootstrap): ... this, and make it a hidden package.

Change-Id: I536a8f55faa14f8221915467c2981053f4c4d70e
---
 gnu/packages/node.scm | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index f046f1bad5..bf7fbebf8f 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -56,9 +56,12 @@ (define-module (gnu packages node)
   #:use-module (gnu packages tls)
   #:use-module (gnu packages web)
   #:use-module (ice-9 match)
+  #:use-module (srfi srfi-1)
   #:use-module (srfi srfi-26))
 
-(define-public node
+;; This should be the latest version of node that still builds without
+;; depending on llhttp.
+(define-public node-bootstrap
   (package
     (name "node")
     (version "10.24.1")
@@ -338,12 +341,8 @@ (define-public node
     (license license:expat)
     (properties '((max-silent-time . 7200)   ;2h, needed on ARM
                   (timeout . 21600)          ;6h
-                  (cpe-name . "node.js")))))
-
-;; This should be the latest version of node that still builds without
-;; depending on llhttp.
-(define-public node-bootstrap
-  (hidden-package node))
+                  (cpe-name . "node.js")
+                  (hidden? . #t)))))
 
 ;; Duplicate of node-semver
 (define-public node-semver-bootstrap
@@ -749,7 +748,7 @@ (define-public llhttp-bootstrap
 
 (define-public node-lts
   (package
-    (inherit node)
+    (inherit node-bootstrap)
     (version "20.18.0")
     (source (origin
               (method url-fetch)
@@ -780,7 +779,7 @@ (define-public node-lts
                     (("deps/uv/uv.gyp") "")
                     (("deps/zlib/zlib.gyp") ""))))))
     (arguments
-     (substitute-keyword-arguments (package-arguments node)
+     (substitute-keyword-arguments (package-arguments node-bootstrap)
        ((#:configure-flags configure-flags)
         ''("--shared-cares"
            "--shared-libuv"
@@ -976,7 +975,8 @@ (define-public node-lts
            nghttp3
            `(,nghttp2 "lib")
            openssl
-           zlib))))
+           zlib))
+    (properties (alist-delete 'hidden? (package-properties node-bootstrap)))))
 
 (define-public libnode
   (package/inherit node-lts
-- 
2.46.0

[bug#74187] [PATCH 00/20] Bumping node to 20.18.0 and beyond

[Ludovic Courtès]

Hey Jelle,

jlicht@fsfe.org skribis:

>   gnu: node: Replace customized nghttp2-for-node by nghttp2.
>   gnu: Remove nghttp2-for-node.
>   gnu: node-lts: Replace customized c-ares-for-node by c-ares.
>   gnu: Remove c-ares-for-node.
>   gnu: Add libuv-for-node-lts.
>   gnu: llhttp-bootstrap: Update to 8.1.2.
>   gnu: node-lts: Update to 20.18.0 [security fixes].
>   gnu: r-v8: Fix build with node-lts@20.
>   gnu: cwltool: Use node-lts instead of node.
>   gnu: python-cwl-utils: Use node-lts instead of node.
>   gnu: ocaml-ezjsonm: Use node-lts instead of node.
>   gnu: js-of-ocaml: Use node-lts instead of node.
>   gnu: fmp: Use node-lts instead of node.
>   gnu: python-cloudscraper: Use node-lts instead of node.
>   gnu: qtwebengine-5: Use node-lts instead of node.
>   gnu: ruby-autoprefixer-rails: Use node-lts instead of node.
>   gnu: ruby-execjs: Use node-lts instead of node.
>   gnu: vlang: Use node-lts instead of node.
>   gnu: esbuild-node: Use node-lts instead of node.
>   gnu: node: Rename variable node-bootstrap and hide package.

Feel empowered to push this if nothing breaks according to your tests.

If you’re not sure and would like to set up a ci.guix jobset, let us
know.

Ludo’.