Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

drop support for obsolete `hapi` package

See original GitHub issue

To be clear, I’m talking about hapi, and not about dropping @hapi/hapi.

Starting with v17.9.0 and v18.2.0 the name changed from ‘hapi’ to ‘@hapi/hapi’. hapi (the old one) is deprecated, obsolete, unmaintained and has known major security issues. IIUC it is coming up on two years being so. https://github.com/hapijs/hapi/issues/4114 provides some details. Anything before @hapi/hapi@20 is in this “deprecated, …” group.

% npm ci
npm WARN deprecated hapi@18.1.0: This version contains severe security issues and defects and should not be used! Please upgrade to the latest version of @hapi/hapi or consider a commercial license (https://github.com/hapijs/hapi/issues/4114)
...

There are maintenance and testing costs to continuing to support it. The monstrous .tav.yml block hints at some of the complexity: https://github.com/elastic/apm-agent-nodejs/blob/a289d4428c2c1ac3a57b0767794cb28e928c1da4/.tav.yml#L408-L464

Also, note there are lingering minor issues:

https://github.com/npm/cli/issues/2267 is an old unfixed issue with npm install and older versions of hapi (versions that we do currently install and test in our TAV tests)
The old ‘hapi’ packages used npm-shrinkwrap, which results in “extraneous” package entries in package-lock.json for npm versions before v8.6 (the default in node v16). So ‘hapi’ will be a contributor to noise in our package-lock updates.

open questions

Do we drop it now, or do we wait for a major version bump of the agent?

Issue Analytics

State:
Created a year ago
Comments:5 (4 by maintainers)

Top GitHub Comments

1reaction

trentmcommented, May 19, 2022

And just make sure you document that the obsolete hapi package support is untested and deprecated so that users know they are using its instrumentation it at their own risk.

Yup, that was done both in the changelog (https://github.com/elastic/apm-agent-nodejs/pull/2698/files#diff-cb0601935fcaac3fea29b215282428b964b8b6e1bd5a6b8c68e84d651633c9e3) and supported-technologies doc page (https://github.com/elastic/apm-agent-nodejs/pull/2698/files#diff-d2a92236665ca681fc14a4b85cb60e74bf3d25b42328ca2390fca53156100d25) of #2698

0reactions

estolfocommented, May 19, 2022

And just make sure you document that the obsolete hapi package support is untested and deprecated so that users know they are using its instrumentation it at their own risk.