You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
warning "This version of npm ($npm_version) has several known issues - consider upgrading to the latest release ($latest_npm)""https://devcenter.heroku.com/articles/nodejs-support#specifying-an-npm-version"
mcount 'warnings.npm.old'
fi
There are a few issues with this:
The semver.io site is deprecated and will be sunset in the future (GUS-W-9803092)
We should not be relying onherokuapp.com domains in production, since they give reduced flexibility (eg in case of needing to migrate to another app/service etc) and increase the risk of takeover, should the platform app be sunset and the old name not reserved for future use (this step is in the sunset playbook, but still)
It seems the simplest fix would be to make the warning recommend removing the NPM specifier from package.json entirely, thereby relying on the buildpack/Node default - or else to link to the NPM versions page or similar.
Since:
- The app is deprecated and due to be switched off shortly.
- The buildpack should have as few dependencies on
external resources as possible (particularly those not
productionised or behind CDN).
- We especially should not have dependencies on
`herokuapp.com` domains, given the reduced
flexibility and risk of subdomain takeover.
Fixes#1015.
GUS-W-11843580.
Since:
- The app is deprecated and due to be switched off shortly.
- The buildpack should have as few dependencies on
external resources as possible (particularly those not
productionised or behind CDN).
- We especially should not have dependencies on
`herokuapp.com` domains, given the reduced
flexibility and risk of subdomain takeover.
Fixes#1015.
GUS-W-11843580.
The buildpack currently makes a request to
semver.herokuapp.com
here:heroku-buildpack-nodejs/lib/failure.sh
Lines 748 to 752 in 34b2aad
There are a few issues with this:
herokuapp.com
domains in production, since they give reduced flexibility (eg in case of needing to migrate to another app/service etc) and increase the risk of takeover, should the platform app be sunset and the old name not reserved for future use (this step is in the sunset playbook, but still)It seems the simplest fix would be to make the warning recommend removing the NPM specifier from
package.json
entirely, thereby relying on the buildpack/Node default - or else to link to the NPM versions page or similar.cc @joshwlewis @colincasey
The text was updated successfully, but these errors were encountered: