v0.10.54 release breaks package installation about es5-ext HOT 25 CLOSED

I found that core-js had the same problem in the past:

zloirock/core-js#551

I created a PR with the same approach to prevent npx fails.

from es5-ext.

@medikoo The published NPM package is 0 bytes: #108 (comment).

from es5-ext.

workaround for npx scripts: disable post install scripts
npm config set ignore-scripts true
before running npx.

from es5-ext.

Here is the commit that broke installs: 28de285

from es5-ext.

👍

Build broken. Understand and appreciate the sentiment behind what you're doing, but please test your stuff before breaking everyone's CI/CD pipelines.

from es5-ext.

@marshall007 @marksteele can you elaborate on why exactly you assume that it breaks package installation?

You can confirm here, that v0.10.54 is perfectly fine:
https://npmview.vercel.app/[email protected]

It has all the modules, and there's _postinstall.js included. You can confirm it installs without any issues, simply by running npm install [email protected]

from es5-ext.

You can confirm it installs without any issues, simply by running npm install [email protected]

@medikoo that is the command I am running to reproduce the issue. For what it's worth I am on v12.21.0 of node which is fairly old but also the version you get from apt. Perhaps there is some inconsistency between node versions?

from es5-ext.

@stanhu The published NPM package is 0 bytes: #108 (comment).

It's definitely not the case. Are you sure you're relying on a legit npm registry mirror?

Again you can easily confirm on the content of published es5-ext at e.g. https://npmview.vercel.app/[email protected]

from es5-ext.

Note, also that if that would be the case. It'll be mayhem already (this package has 10+ million downloads per week). It's over 1 hour after release, and you're the only reporter of the issue :)

from es5-ext.

@medikoo we are not relying on a registry mirror. Most folks probably have this dependency pinned in their package-lock.json. I'm sure plenty of people are wondering why their builds are failing right now, but it would be limited to those that are not pinning versions (like the example above using npx).

All of the builds on GitLab's public handbook have been failing this morning. You can see that here for example: https://gitlab.com/gitlab-com/www-gitlab-com/-/jobs/2173245711

I confirmed this was an issue locally, nothing specific to our CI environment. Please make sure you do not have a local copy of your package cached and try to run npm i [email protected].

from es5-ext.

@marshall007 again you're the only person reporting the issue, and we can see in various remote sources, that package publication is perfectly fine.

1. https://npmview.vercel.app/[email protected] shows all the content, and it takes data simply from npm registry

2. npm page reports that size of 0.10.54 version is 543 kB -> https://www.npmjs.com/package/es5-ext/v/0.10.54

3. When I test installation locally in an empty folder, all goes as expected:

It looks there's some issue with your setup, and I cannot really do much about it

from es5-ext.

@medikoo I haven't tested on the latest version of node, but as I mentioned in #109 (comment) we are on an older version. This could be part of the problem.

I can confirm the package is not zero bytes, so I agree that is not the issue. It appears to be a node version inconsistency. Try running:

$ docker run -it node:12 "/bin/bash"
root@c25867fc0684:/# npx sass-lint

internal/modules/cjs/loader.js:818
  throw err;
  ^

Error: Cannot find module '/root/.npm/_npx/8/lib/node_modules/sass-lint/node_modules/es5-ext/_postinstall.js'
    at Function.Module._resolveFilename (internal/modules/cjs/loader.js:815:15)
    at Function.Module._load (internal/modules/cjs/loader.js:667:27)
    at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:60:12)
    at internal/main/run_main_module.js:17:47 {
  code: 'MODULE_NOT_FOUND',
  requireStack: []
}
npm ERR! Maximum call stack size exceeded

npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2022-03-07T21_18_28_716Z-debug.log
Install for [ 'sass-lint@latest' ] failed with code 1

from es5-ext.

@marshall007 I don't see how Error: Cannot find module '/sh -c npx sass-lint' error can be related to this package in any way.

Installations with node.js v12 also work perfectly fine:

from es5-ext.

I think the problem on older node versions is inside Docker where getuid() == 0 because of the file permissions:

3977 verbose lifecycle [email protected]~postinstall: unsafe-perm in lifecycle false
3978 verbose lifecycle [email protected]~postinstall: PATH: /usr/lib/node_modules/npm/node_modules/npm-lifecycle/node-gyp-bin:/root/.npm/_npx/1653/lib/node_modules/sass-lint/node_modules/es5-ext/node_modules/.bin:/root/.npm/_npx/1653/lib/node_modules/sass-lint/node_modules/.bin:/root/.npm/_npx/1653/lib/node_modules/.bin:/asd/asd/node_modules/.bin:/usr/local/bundle/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
3979 verbose lifecycle [email protected]~postinstall: CWD: /root/.npm/_npx/1653/lib/node_modules/sass-lint/node_modules/es5-ext
3980 silly lifecycle [email protected]~postinstall: Args: [ '-c', 'node ./_postinstall.js' ]
3981 silly lifecycle [email protected]~postinstall: Returned: code: 1  signal: null
3982 info lifecycle [email protected]~postinstall: Failed to exec postinstall script

With a node:12 docker image :

╰─>$ docker run --rm -it node:12 bash
root@a068395a1032:/# npm -v
6.14.4
root@a068395a1032:/# npx sass-lint -V
internal/modules/cjs/loader.js:983
  throw err;
  ^

Error: Cannot find module '/root/.npm/_npx/46/lib/node_modules/sass-lint/node_modules/es5-ext/_postinstall.js'
    at Function.Module._resolveFilename (internal/modules/cjs/loader.js:980:15)
    at Function.Module._load (internal/modules/cjs/loader.js:862:27)
    at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:74:12)
    at internal/main/run_main_module.js:18:47 {
  code: 'MODULE_NOT_FOUND',
  requireStack: []
}
npm ERR! Maximum call stack size exceeded

npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2022-03-07T21_20_21_093Z-debug.log
Install for [ 'sass-lint@latest' ] failed with code 1

root@a068395a1032:/# npm config set unsafe-perm true
root@a068395a1032:/# npx sass-lint -V
1.13.1

Since we do node ./_postinstall.js instead of ./_postinstall.js in the postinstall section, maybe a chown -x postinstall.js and publishing that would work?

Note: newer versions work ~fine:

╰─>$ docker run --rm -it node:16 bash
root@9fb9485b56a7:/# npm -v
8.3.1
root@9fb9485b56a7:/# npx sass-lint -V
Need to install the following packages:
  sass-lint
Ok to proceed? (y) y
npm WARN deprecated [email protected]: CircularJSON is in maintenance only, flatted is its successor.
1.13.1

from es5-ext.

Since we do node ./_postinstall.js instead of ./_postinstall.js in the postinstall section, maybe a chown -x postinstall.js and publishing that would work?

It's published as executable file, but still that's not needed for node command (it would be if command would be just ./postinstall.js)

One thing it misses (for an executable file) is shebang (I'll add it now), but as it's invoked via node ./_postinstall.js it shouldn't be an issue for npm installation

from es5-ext.

@medikoo I agree that the file permissions being executable should not matter. I think it might be that the postinstall script being set to node ./_postinstall.js vs simply ./_postinstall.js may result in differing behavior between versions (or maybe even npm i vs npx).

Notice that in the npm error logs you see this line indicating the arguments that were passed when executing the postinstall script:

3979 verbose lifecycle [email protected]~postinstall: CWD: /root/.npm/_npx/1653/lib/node_modules/sass-lint/node_modules/es5-ext
3980 silly lifecycle [email protected]~postinstall: Args: [ '-c', 'node ./_postinstall.js' ]
3981 silly lifecycle [email protected]~postinstall: Returned: code: 1  signal: null
3982 info lifecycle [email protected]~postinstall: Failed to exec postinstall script

So if we try to run this directly from within the node:12 image:

/ # touch _postinstall.js
/ # node -c "_postinstall.js"          # works
/ # node -c "node _postinstall.js" # fails
internal/modules/cjs/loader.js:818
  throw err;
  ^

Error: Cannot find module '/node _postinstall.js'
    at Module._resolveFilename (internal/modules/cjs/loader.js:815:15)
    at internal/main/check_syntax.js:32:20 {
  code: 'MODULE_NOT_FOUND',
  requireStack: []
}

In other words, I think it seems to be interpreting the entire string node _postinstall.js as the argument that should be passed to the node binary. Still very unclear what the problem is here, but perhaps try adding the shebang, making the file executable and setting the postinstall script to just _postinstall.js?

from es5-ext.

node -c "node _postinstall.js" will fail in any case, and it's expected. Argument for -c should be a path to script file, and not a CLI command.

Issue lies in node -c usage and not in this package setup.

from es5-ext.

@marshall007 I've looked more closely to silly lifecycle [email protected]~postinstall: Args: [ '-c', 'node ./_postinstall.js' ] log, and those are args for shell, not for node.

See: https://github.com/npm/npm-lifecycle/blob/v3.1.5/index.js#L322-L324

By default in non windows environment it's sh, so executed command is sh -c "node ./_postinstall.js", and it works without issues.

It appears in your case shell is customized (see https://github.com/npm/npm-lifecycle/blob/v3.1.5/index.js#L291-L304)
and the issue is that it doesn't handle -c "node ./_postinstall.js" args as expected.

from es5-ext.

@medikoo even with sh we got error. try docker run node:14.0.0-alpine npx sequelize-cli --version to reproduce.

from es5-ext.

@gilelias if you observe issue via docker run node:14.0.0-alpine npx sequelize-cli --version and not via npx sequelize-cli --version, it's clear it's an issue with docker container. Have you tried to report it over there?

from es5-ext.

@medikoo The issue is npx. (https://npm.community/t/npx-crashes-on-postinstall-script/9360.html). npx is deprecated. the solution is to use npm cli instead.

from es5-ext.

@gilelias great thanks for clarifying this. @marshall007 can we close this report?

from es5-ext.

I am experiencing a build break in my CI/CD environment due to the new node call in the postinstall step of es5-ext.

Our builds fail when trying to install gulp 4.0.2 using command npm install gulp -g. npm version 8.3.1. I am going to try the suggested npm install --ignore-scripts option.

The error in our builds:

> [email protected] postinstall /root/.nvm/versions/node/v12.13.0/lib/node_modules/gulp/node_modules/es5-ext
> node ./_postinstall.js

sh: 1: node: Permission denied

Here is the dependency tree for gulp on my local system

$ npm list es5-ext -g
...
└─┬ [email protected]
  └─┬ [email protected]
    └─┬ [email protected]
      ├─┬ [email protected]
      │ └── [email protected]  deduped
      ├── [email protected] 
      └─┬ [email protected]
        └── [email protected]  deduped

Update: The workaround to use --ignore-scripts worked for my scenario.

from es5-ext.

One quick solution is to use $ npm shrinkwrap
and change the es5-next version to 0.10.53
this works momently for me.
( i´m running a gulp task with npx and docker with node:14 in a jenkins job )

from es5-ext.

Thanks to @martindrq finding, the issue should be gone starting with v0.10.57 version 🎉

from es5-ext.