Forum Discussion

Claudius's avatar
Claudius
Boss
5 years ago

2019 Update of Community SDK dependencies

Just trying to get set up with the Community SDK on my Mac (and miserably failing, but that is a different story). When running the 

npm install lithium-sdk -g

command there is a never-ending list of deprecation notices about moved, unmaintained and even unsupported packages, e.g.

 

npm WARN deprecated hawk@1.1.1: This module moved to @hapi/hawk. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues.
npm WARN deprecated cryptiles@0.2.2: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm WARN deprecated sntp@0.2.4: This module moved to @hapi/sntp. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues.
npm WARN deprecated boom@0.4.2: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm WARN deprecated hoek@0.9.1: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).

 

Is there a chance to move the code base to a safer environment by updating to more modern, supported packages any time soon? I am a bit concerned to install all these outdated packages on my work machine. 😱

  • RobertT's avatar
    RobertT
    Boss
    5 years ago

    Second this, as a workaround for the short term I use nvm to install Node v8.3.0 on my machines and switch to that version which should run fine.

    It is a bit of a pain though having so much of it dependent on outdated packages, some security risks there.

    • SamR's avatar
      SamR
      Genius
      5 years ago

      I have no idea what this means but the dev team feel it needs to be looked at. Happy devs, happy life for me.

       

      🙂 🙂

      • luk's avatar
        luk
        Boss
        5 years ago

        That's actually an issue for quite a while, welcome to dependency hell =)!

    • AlejandroRF's avatar
      AlejandroRF
      Khoros Alumni (Retired)
      5 years ago

      nvm is a life-saver indeed

      Updating lithium-sdk would affect a lot of users so it needs to be done carefully (and very well tested too) so it does not affect workflows around the world

      I am sure that it will get an update sooner rather than later 👍

  • Jake_N's avatar
    Jake_N
    Mentor
    5 years ago

    I also agree that is should be updated. This would make things easier if there are issues due to the availability of support for the newer version or modern packages.

    I would think it as a lesser pain for both Khoros Support and us.

  • Malcolm-M's avatar
    Malcolm-M
    Boss
    5 years ago

    Definitely needs some love. 2 releases since December 2017 one of which added a language pack and the other was a bug fix for the first release.

  • Inactive User's avatar
    Inactive User
    5 years ago

    Yes, PLEASE FOR THE LOVE OF GOD PLEASE UPDATE THE SDK TO USE A RECENT VERSION OF NODE. It interferes with other things. 

    And it breaks so easily on update.