GNU bug report logs - #59188
[PATCH 0/4] gnu: node-lts: Update to 18.12.1.

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 59188 in the body.
You can then email your comments to 59188 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Hilton Chain <hako <at> ultrarare.space>
To: guix-patches <at> gnu.org
Subject: [PATCH 0/4] gnu: node-lts: Update to 18.12.1.
Date: Fri, 11 Nov 2022 13:34:12 +0800

Hilton Chain (4):
  gnu: libuv-for-node: Update to 1.43.0.
  gnu: llhttp-bootstrap: Update to 6.0.10.
  gnu: node-lts: Update to 18.12.1.
  gnu: libnode: Use node-lts as base.

 gnu/local.mk                                  |   1 -
 gnu/packages/libevent.scm                     |   4 +-
 gnu/packages/node.scm                         |  44 +++++---
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ------------------
 4 files changed, 30 insertions(+), 119 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch


base-commit: 70df5c47a89f4f353a1df94467581a0f0da599a4
--
2.38.1

Message #8 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: Hilton Chain <hako <at> ultrarare.space>
To: 59188 <at> debbugs.gnu.org
Subject: [PATCH 1/4] gnu: libuv-for-node: Update to 1.43.0.
Date: Fri, 11 Nov 2022 13:35:41 +0800

* gnu/packages/libevent.scm (libuv-for-node): Update to 1.43.0.
---
 gnu/packages/libevent.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/libevent.scm b/gnu/packages/libevent.scm
index 176e66cf42..5aff343c06 100644
--- a/gnu/packages/libevent.scm
+++ b/gnu/packages/libevent.scm
@@ -147,14 +147,14 @@ (define-public libuv-for-node
   (package
     (inherit libuv)
     (name "libuv")
-    (version "1.42.0")
+    (version "1.43.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://dist.libuv.org/dist/v" version
                                   "/libuv-v" version ".tar.gz"))
               (sha256
                (base32
-                "0wpb9pz3r8nksnrf4zbixj2kk9whr7abi45ydrwyv2js2ljrc4j3"))))
+                "194kwq3jfj9s628kzkchdca534rikjw0xiyas0cjbphqmsvjpmwh"))))
     (properties '((hidden? . #t)))))

 (define-public libuv-julia
--
2.38.1

Message #11 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: Hilton Chain <hako <at> ultrarare.space>
To: 59188 <at> debbugs.gnu.org
Subject: [PATCH 2/4] gnu: llhttp-bootstrap: Update to 6.0.10.
Date: Fri, 11 Nov 2022 13:36:44 +0800

* gnu/packages/node.scm (llhttp-bootstrap): Update to 6.0.10.
* gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch: Remove file.
* gnu/local.mk: Remove it.
---
 gnu/local.mk                                  |   1 -
 gnu/packages/node.scm                         |   5 +-
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ------------------
 3 files changed, 2 insertions(+), 104 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 27b31ea27f..1c4b9def96 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1480,7 +1480,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/linuxdcpp-openssl-1.1.patch		\
   %D%/packages/patches/lirc-localstatedir.patch			\
   %D%/packages/patches/lirc-reproducible-build.patch		\
-  %D%/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch	\
   %D%/packages/patches/llvm-3.5-fix-clang-build-with-gcc5.patch	\
   %D%/packages/patches/llvm-3.6-fix-build-with-gcc-10.patch	\
   %D%/packages/patches/llvm-3.x.1-fix-build-with-gcc.patch	\
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index 4e9daa522d..0af0158f45 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -666,7 +666,7 @@ (define-public node-llparse-bootstrap
 (define-public llhttp-bootstrap
   (package
     (name "llhttp")
-    (version "2.1.4")
+    (version "6.0.10")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -675,8 +675,7 @@ (define-public llhttp-bootstrap
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "115mwyds9655p76lhglxg2blc1ksgrix6zhigaxnc2q6syy3pa6x"))
-              (patches (search-patches "llhttp-bootstrap-CVE-2020-8287.patch"))
+                "0izwqa77y007xdi0bj3ccw821n19rz89mz4hx4lg99fwkwylr6x8"))
               (modules '((guix build utils)))
               (snippet
                '(begin
diff --git a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch b/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
deleted file mode 100644
index 215c920e53..0000000000
--- a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-This patch comes from upstream.  It corresponds to a patch applied to
-the generated C source code for llhttp included in Node.js 14.16.0
-(see commit 641f786bb1a1f6eb1ff8750782ed939780f2b31a).  That commit
-fixes CVE-2020-8287.  With this patch, the output of our
-llhttp-bootstrap package matches the files included in Node.js 14.16.0
-exactly.
-
-commit e9b36ea64709c35ca66094d5cf3787f444029601
-Author: Fedor Indutny <fedor <at> indutny.com>
-Date:   Sat Oct 10 19:56:01 2020 -0700
-
-    http: unset `F_CHUNKED` on new `Transfer-Encoding`
-    
-    Duplicate `Transfer-Encoding` header should be a treated as a single,
-    but with original header values concatenated with a comma separator. In
-    the light of this, even if the past `Transfer-Encoding` ended with
-    `chunked`, we should be not let the `F_CHUNKED` to leak into the next
-    header, because mere presence of another header indicates that `chunked`
-    is not the last transfer-encoding token.
-
-diff --git a/src/llhttp/http.ts b/src/llhttp/http.ts
-index f4f1a6e..0a0c365 100644
---- a/src/llhttp/http.ts
-+++ b/src/llhttp/http.ts
-@@ -460,11 +460,19 @@ export class HTTP {
-       .match([ ' ', '\t' ], n('header_value_discard_ws'))
-       .otherwise(checkContentLengthEmptiness);
- 
-+    // Multiple `Transfer-Encoding` headers should be treated as one, but with
-+    // values separate by a comma.
-+    //
-+    // See: https://tools.ietf.org/html/rfc7230#section-3.2.2
-+    const toTransferEncoding = this.unsetFlag(
-+      FLAGS.CHUNKED,
-+      'header_value_te_chunked');
-+
-     n('header_value_start')
-       .otherwise(this.load('header_state', {
-         [HEADER_STATE.UPGRADE]: this.setFlag(FLAGS.UPGRADE, fallback),
-         [HEADER_STATE.TRANSFER_ENCODING]: this.setFlag(
--          FLAGS.TRANSFER_ENCODING, 'header_value_te_chunked'),
-+          FLAGS.TRANSFER_ENCODING, toTransferEncoding),
-         [HEADER_STATE.CONTENT_LENGTH]: n('header_value_content_length_once'),
-         [HEADER_STATE.CONNECTION]: n('header_value_connection'),
-       }, 'header_value'));
-@@ -847,6 +855,11 @@ export class HTTP {
-     return span.start(span.end(this.node(next)));
-   }
- 
-+  private unsetFlag(flag: FLAGS, next: string | Node): Node {
-+    const p = this.llparse;
-+    return p.invoke(p.code.and('flags', ~flag), this.node(next));
-+  }
-+
-   private setFlag(flag: FLAGS, next: string | Node): Node {
-     const p = this.llparse;
-     return p.invoke(p.code.or('flags', flag), this.node(next));
-diff --git a/test/request/transfer-encoding.md b/test/request/transfer-encoding.md
-index a7d1681..b0891d6 100644
---- a/test/request/transfer-encoding.md
-+++ b/test/request/transfer-encoding.md
-@@ -353,6 +353,38 @@ off=106 headers complete method=3 v=1/1 flags=200 content_length=0
- off=106 error code=15 reason="Request has invalid `Transfer-Encoding`"
- ```
- 
-+## POST with `chunked` and duplicate transfer-encoding
-+
-+<!-- meta={"type": "request", "noScan": true} -->
-+```http
-+POST /post_identity_body_world?q=search#hey HTTP/1.1
-+Accept: */*
-+Transfer-Encoding: chunked
-+Transfer-Encoding: deflate
-+
-+World
-+```
-+
-+```log
-+off=0 message begin
-+off=5 len=38 span[url]="/post_identity_body_world?q=search#hey"
-+off=44 url complete
-+off=54 len=6 span[header_field]="Accept"
-+off=61 header_field complete
-+off=62 len=3 span[header_value]="*/*"
-+off=67 header_value complete
-+off=67 len=17 span[header_field]="Transfer-Encoding"
-+off=85 header_field complete
-+off=86 len=7 span[header_value]="chunked"
-+off=95 header_value complete
-+off=95 len=17 span[header_field]="Transfer-Encoding"
-+off=113 header_field complete
-+off=114 len=7 span[header_value]="deflate"
-+off=123 header_value complete
-+off=125 headers complete method=3 v=1/1 flags=200 content_length=0
-+off=125 error code=15 reason="Request has invalid `Transfer-Encoding`"
-+```
-+
- ## POST with `chunked` before other transfer-coding (lenient)
- 
- TODO(indutny): should we allow it even in lenient mode? (Consider disabling
-- 
2.38.1

Message #14 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: Hilton Chain <hako <at> ultrarare.space>
To: 59188 <at> debbugs.gnu.org
Subject: [PATCH 3/4] gnu: node-lts: Update to 18.12.1.
Date: Fri, 11 Nov 2022 13:37:22 +0800

* gnu/packages/node.scm (node-lts): Update to 18.12.1.
[snippet]: Keep file deps/openssl/nodejs-openssl.cnf.
[arguments]<#:phases>: Adjust problematic tests to delete accordingly.
Patch additional file with hardcoded references to /bin/sh.
[native-inputs,inputs]: Replace openssl-1.1 with openssl.
---
 gnu/packages/node.scm | 35 ++++++++++++++++++++++++-----------
 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index 0af0158f45..cae7d3b0ca 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -735,23 +735,28 @@ (define-public llhttp-bootstrap
 (define-public node-lts
   (package
     (inherit node)
-    (version "14.19.3")
+    (version "18.12.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nodejs.org/dist/v" version
-                                  "/node-v" version ".tar.xz"))
+                                  "/node-v" version ".tar.gz"))
               (sha256
                (base32
-                "15691j5zhiikyamiwwd7f282g6d9acfhq91nrwx54xya38gmpx2w"))
+                "11n1h54wgh61inrlqjp0j4fqcz6kl60a3iip7ya90nqdl3fp90ds"))
               (modules '((guix build utils)))
               (snippet
                `(begin
+                  ;; openssl.cnf is required for build.
+                  (for-each delete-file-recursively
+                            (find-files "deps/openssl"
+                                        (lambda (file stat)
+                                          (if (string-contains file "nodejs-openssl.cnf")
+                                              #f #t))))
                   ;; Remove bundled software, where possible
                   (for-each delete-file-recursively
                             '("deps/cares"
                               "deps/icu-small"
                               "deps/nghttp2"
-                              "deps/openssl"
                               "deps/zlib"))
                   (substitute* "Makefile"
                     ;; Remove references to bundled software.
@@ -800,23 +805,31 @@ (define-public node-lts
                                    libuv "/lib:"
                                    zlib "/lib"
                                    "'],"))))))
+           (add-after 'patch-hardcoded-program-references
+                      'patch-additional-hardcoded-program-references
+             (lambda* (#:key inputs #:allow-other-keys)
+               (substitute* "test/parallel/test-stdin-from-file-spawn.js"
+                 (("'/bin/sh'") (string-append
+                                 "'" (search-input-file inputs "/bin/sh")
+                                 "'")))))
            (replace 'delete-problematic-tests
              (lambda* (#:key inputs #:allow-other-keys)
                ;; FIXME: These tests fail in the build container, but they don't
                ;; seem to be indicative of real problems in practice.
                (for-each delete-file
-                         '("test/parallel/test-cluster-master-error.js"
-                           "test/parallel/test-cluster-master-kill.js"))
+                         '("test/parallel/test-cluster-primary-error.js"
+                           "test/parallel/test-cluster-primary-kill.js"))
 
                ;; These require a DNS resolver.
                (for-each delete-file
                          '("test/parallel/test-dns.js"
-                           "test/parallel/test-dns-lookupService-promises.js"))
+                           "test/parallel/test-dns-lookupService-promises.js"
+                           "test/parallel/test-net-socket-connect-without-cb.js"
+                           "test/parallel/test-tcp-wrap-listen.js"))
 
                ;; These tests require networking.
                (for-each delete-file
-                         '("test/parallel/test-https-agent-unref-socket.js"
-                           "test/parallel/test-corepack-yarn-install.js"))
+                         '("test/parallel/test-https-agent-unref-socket.js"))
 
                ;; This test is timing-sensitive, and fails sporadically on
                ;; slow, busy, or even very fast machines.
@@ -866,7 +879,7 @@ (define-public node-lts
            icu4c-71
            libuv-for-node
            `(,nghttp2 "lib")
-           openssl-1.1
+           openssl
            zlib
            ;; Regular build-time dependencies.
            perl
@@ -883,7 +896,7 @@ (define-public node-lts
            llhttp-bootstrap
            brotli
            `(,nghttp2 "lib")
-           openssl-1.1
+           openssl
            python-wrapper ;; for node-gyp (supports python3)
            zlib))))
 
-- 
2.38.1

Message #17 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: Hilton Chain <hako <at> ultrarare.space>
To: 59188 <at> debbugs.gnu.org
Subject: [PATCH 4/4] gnu: libnode: Use node-lts as base.
Date: Fri, 11 Nov 2022 13:37:52 +0800

* gnu/packages/node.scm (libnode): Use node-lts as base.
---
 gnu/packages/node.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index cae7d3b0ca..0e56d12038 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -901,10 +901,10 @@ (define-public node-lts
            zlib))))
 
 (define-public libnode
-  (package/inherit node
+  (package/inherit node-lts
     (name "libnode")
     (arguments
-     (substitute-keyword-arguments (package-arguments node)
+     (substitute-keyword-arguments (package-arguments node-lts)
        ((#:configure-flags flags ''())
         `(cons* "--shared" "--without-npm" ,flags))
        ((#:phases phases '%standard-phases)
-- 
2.38.1

Message #20 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Hilton Chain <hako <at> ultrarare.space>
To: guix-patches <at> gnu.org
Subject: [PATCH v2 0/4] gnu: node-lts: Update to 18.12.1.
Date: Fri, 11 Nov 2022 14:21:15 +0800

v1 -> v2: Fix libnode path for r-v8.

Hilton Chain (4):
  gnu: libuv-for-node: Update to 1.43.0.
  gnu: llhttp-bootstrap: Update to 6.0.10.
  gnu: node-lts: Update to 18.12.1.
  gnu: libnode: Use node-lts as base.

 gnu/local.mk                                  |   1 -
 gnu/packages/cran.scm                         |   2 +-
 gnu/packages/libevent.scm                     |   4 +-
 gnu/packages/node.scm                         |  44 +++++---
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ------------------
 5 files changed, 31 insertions(+), 120 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch


base-commit: 70df5c47a89f4f353a1df94467581a0f0da599a4
--
2.38.1

Message #23 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Hilton Chain <hako <at> ultrarare.space>
To: guix-patches <at> gnu.org
Subject: [PATCH v2 1/4] gnu: libuv-for-node: Update to 1.43.0.
Date: Fri, 11 Nov 2022 14:22:27 +0800

* gnu/packages/libevent.scm (libuv-for-node): Update to 1.43.0.
---
 gnu/packages/libevent.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/libevent.scm b/gnu/packages/libevent.scm
index 176e66cf42..5aff343c06 100644
--- a/gnu/packages/libevent.scm
+++ b/gnu/packages/libevent.scm
@@ -147,14 +147,14 @@ (define-public libuv-for-node
   (package
     (inherit libuv)
     (name "libuv")
-    (version "1.42.0")
+    (version "1.43.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://dist.libuv.org/dist/v" version
                                   "/libuv-v" version ".tar.gz"))
               (sha256
                (base32
-                "0wpb9pz3r8nksnrf4zbixj2kk9whr7abi45ydrwyv2js2ljrc4j3"))))
+                "194kwq3jfj9s628kzkchdca534rikjw0xiyas0cjbphqmsvjpmwh"))))
     (properties '((hidden? . #t)))))
 
 (define-public libuv-julia
-- 
2.38.1

Message #26 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Hilton Chain <hako <at> ultrarare.space>
To: guix-patches <at> gnu.org
Subject: [PATCH v2 2/4] gnu: llhttp-bootstrap: Update to 6.0.10.
Date: Fri, 11 Nov 2022 14:22:56 +0800

* gnu/packages/node.scm (llhttp-bootstrap): Update to 6.0.10.
* gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch: Remove file.
* gnu/local.mk: Remove it.
---
 gnu/local.mk                                  |   1 -
 gnu/packages/node.scm                         |   5 +-
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ------------------
 3 files changed, 2 insertions(+), 104 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 27b31ea27f..1c4b9def96 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1480,7 +1480,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/linuxdcpp-openssl-1.1.patch		\
   %D%/packages/patches/lirc-localstatedir.patch			\
   %D%/packages/patches/lirc-reproducible-build.patch		\
-  %D%/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch	\
   %D%/packages/patches/llvm-3.5-fix-clang-build-with-gcc5.patch	\
   %D%/packages/patches/llvm-3.6-fix-build-with-gcc-10.patch	\
   %D%/packages/patches/llvm-3.x.1-fix-build-with-gcc.patch	\
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index 4e9daa522d..0af0158f45 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -666,7 +666,7 @@ (define-public node-llparse-bootstrap
 (define-public llhttp-bootstrap
   (package
     (name "llhttp")
-    (version "2.1.4")
+    (version "6.0.10")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -675,8 +675,7 @@ (define-public llhttp-bootstrap
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "115mwyds9655p76lhglxg2blc1ksgrix6zhigaxnc2q6syy3pa6x"))
-              (patches (search-patches "llhttp-bootstrap-CVE-2020-8287.patch"))
+                "0izwqa77y007xdi0bj3ccw821n19rz89mz4hx4lg99fwkwylr6x8"))
               (modules '((guix build utils)))
               (snippet
                '(begin
diff --git a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch b/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
deleted file mode 100644
index 215c920e53..0000000000
--- a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-This patch comes from upstream.  It corresponds to a patch applied to
-the generated C source code for llhttp included in Node.js 14.16.0
-(see commit 641f786bb1a1f6eb1ff8750782ed939780f2b31a).  That commit
-fixes CVE-2020-8287.  With this patch, the output of our
-llhttp-bootstrap package matches the files included in Node.js 14.16.0
-exactly.
-
-commit e9b36ea64709c35ca66094d5cf3787f444029601
-Author: Fedor Indutny <fedor <at> indutny.com>
-Date:   Sat Oct 10 19:56:01 2020 -0700
-
-    http: unset `F_CHUNKED` on new `Transfer-Encoding`
-    
-    Duplicate `Transfer-Encoding` header should be a treated as a single,
-    but with original header values concatenated with a comma separator. In
-    the light of this, even if the past `Transfer-Encoding` ended with
-    `chunked`, we should be not let the `F_CHUNKED` to leak into the next
-    header, because mere presence of another header indicates that `chunked`
-    is not the last transfer-encoding token.
-
-diff --git a/src/llhttp/http.ts b/src/llhttp/http.ts
-index f4f1a6e..0a0c365 100644
---- a/src/llhttp/http.ts
-+++ b/src/llhttp/http.ts
-@@ -460,11 +460,19 @@ export class HTTP {
-       .match([ ' ', '\t' ], n('header_value_discard_ws'))
-       .otherwise(checkContentLengthEmptiness);
- 
-+    // Multiple `Transfer-Encoding` headers should be treated as one, but with
-+    // values separate by a comma.
-+    //
-+    // See: https://tools.ietf.org/html/rfc7230#section-3.2.2
-+    const toTransferEncoding = this.unsetFlag(
-+      FLAGS.CHUNKED,
-+      'header_value_te_chunked');
-+
-     n('header_value_start')
-       .otherwise(this.load('header_state', {
-         [HEADER_STATE.UPGRADE]: this.setFlag(FLAGS.UPGRADE, fallback),
-         [HEADER_STATE.TRANSFER_ENCODING]: this.setFlag(
--          FLAGS.TRANSFER_ENCODING, 'header_value_te_chunked'),
-+          FLAGS.TRANSFER_ENCODING, toTransferEncoding),
-         [HEADER_STATE.CONTENT_LENGTH]: n('header_value_content_length_once'),
-         [HEADER_STATE.CONNECTION]: n('header_value_connection'),
-       }, 'header_value'));
-@@ -847,6 +855,11 @@ export class HTTP {
-     return span.start(span.end(this.node(next)));
-   }
- 
-+  private unsetFlag(flag: FLAGS, next: string | Node): Node {
-+    const p = this.llparse;
-+    return p.invoke(p.code.and('flags', ~flag), this.node(next));
-+  }
-+
-   private setFlag(flag: FLAGS, next: string | Node): Node {
-     const p = this.llparse;
-     return p.invoke(p.code.or('flags', flag), this.node(next));
-diff --git a/test/request/transfer-encoding.md b/test/request/transfer-encoding.md
-index a7d1681..b0891d6 100644
---- a/test/request/transfer-encoding.md
-+++ b/test/request/transfer-encoding.md
-@@ -353,6 +353,38 @@ off=106 headers complete method=3 v=1/1 flags=200 content_length=0
- off=106 error code=15 reason="Request has invalid `Transfer-Encoding`"
- ```
- 
-+## POST with `chunked` and duplicate transfer-encoding
-+
-+<!-- meta={"type": "request", "noScan": true} -->
-+```http
-+POST /post_identity_body_world?q=search#hey HTTP/1.1
-+Accept: */*
-+Transfer-Encoding: chunked
-+Transfer-Encoding: deflate
-+
-+World
-+```
-+
-+```log
-+off=0 message begin
-+off=5 len=38 span[url]="/post_identity_body_world?q=search#hey"
-+off=44 url complete
-+off=54 len=6 span[header_field]="Accept"
-+off=61 header_field complete
-+off=62 len=3 span[header_value]="*/*"
-+off=67 header_value complete
-+off=67 len=17 span[header_field]="Transfer-Encoding"
-+off=85 header_field complete
-+off=86 len=7 span[header_value]="chunked"
-+off=95 header_value complete
-+off=95 len=17 span[header_field]="Transfer-Encoding"
-+off=113 header_field complete
-+off=114 len=7 span[header_value]="deflate"
-+off=123 header_value complete
-+off=125 headers complete method=3 v=1/1 flags=200 content_length=0
-+off=125 error code=15 reason="Request has invalid `Transfer-Encoding`"
-+```
-+
- ## POST with `chunked` before other transfer-coding (lenient)
- 
- TODO(indutny): should we allow it even in lenient mode? (Consider disabling
-- 
2.38.1

Message #29 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Hilton Chain <hako <at> ultrarare.space>
To: guix-patches <at> gnu.org
Subject: [PATCH v2 3/4] gnu: node-lts: Update to 18.12.1.
Date: Fri, 11 Nov 2022 14:23:27 +0800

* gnu/packages/node.scm (node-lts): Update to 18.12.1.
[snippet]: Keep file deps/openssl/nodejs-openssl.cnf.
[arguments]<#:phases>: Adjust problematic tests to delete accordingly.
Patch additional file with hardcoded references to /bin/sh.
[native-inputs,inputs]: Replace openssl-1.1 with openssl.
---
 gnu/packages/node.scm | 35 ++++++++++++++++++++++++-----------
 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index 0af0158f45..cae7d3b0ca 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -735,23 +735,28 @@ (define-public llhttp-bootstrap
 (define-public node-lts
   (package
     (inherit node)
-    (version "14.19.3")
+    (version "18.12.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nodejs.org/dist/v" version
-                                  "/node-v" version ".tar.xz"))
+                                  "/node-v" version ".tar.gz"))
               (sha256
                (base32
-                "15691j5zhiikyamiwwd7f282g6d9acfhq91nrwx54xya38gmpx2w"))
+                "11n1h54wgh61inrlqjp0j4fqcz6kl60a3iip7ya90nqdl3fp90ds"))
               (modules '((guix build utils)))
               (snippet
                `(begin
+                  ;; openssl.cnf is required for build.
+                  (for-each delete-file-recursively
+                            (find-files "deps/openssl"
+                                        (lambda (file stat)
+                                          (if (string-contains file "nodejs-openssl.cnf")
+                                              #f #t))))
                   ;; Remove bundled software, where possible
                   (for-each delete-file-recursively
                             '("deps/cares"
                               "deps/icu-small"
                               "deps/nghttp2"
-                              "deps/openssl"
                               "deps/zlib"))
                   (substitute* "Makefile"
                     ;; Remove references to bundled software.
@@ -800,23 +805,31 @@ (define-public node-lts
                                    libuv "/lib:"
                                    zlib "/lib"
                                    "'],"))))))
+           (add-after 'patch-hardcoded-program-references
+                      'patch-additional-hardcoded-program-references
+             (lambda* (#:key inputs #:allow-other-keys)
+               (substitute* "test/parallel/test-stdin-from-file-spawn.js"
+                 (("'/bin/sh'") (string-append
+                                 "'" (search-input-file inputs "/bin/sh")
+                                 "'")))))
            (replace 'delete-problematic-tests
              (lambda* (#:key inputs #:allow-other-keys)
                ;; FIXME: These tests fail in the build container, but they don't
                ;; seem to be indicative of real problems in practice.
                (for-each delete-file
-                         '("test/parallel/test-cluster-master-error.js"
-                           "test/parallel/test-cluster-master-kill.js"))
+                         '("test/parallel/test-cluster-primary-error.js"
+                           "test/parallel/test-cluster-primary-kill.js"))
 
                ;; These require a DNS resolver.
                (for-each delete-file
                          '("test/parallel/test-dns.js"
-                           "test/parallel/test-dns-lookupService-promises.js"))
+                           "test/parallel/test-dns-lookupService-promises.js"
+                           "test/parallel/test-net-socket-connect-without-cb.js"
+                           "test/parallel/test-tcp-wrap-listen.js"))
 
                ;; These tests require networking.
                (for-each delete-file
-                         '("test/parallel/test-https-agent-unref-socket.js"
-                           "test/parallel/test-corepack-yarn-install.js"))
+                         '("test/parallel/test-https-agent-unref-socket.js"))
 
                ;; This test is timing-sensitive, and fails sporadically on
                ;; slow, busy, or even very fast machines.
@@ -866,7 +879,7 @@ (define-public node-lts
            icu4c-71
            libuv-for-node
            `(,nghttp2 "lib")
-           openssl-1.1
+           openssl
            zlib
            ;; Regular build-time dependencies.
            perl
@@ -883,7 +896,7 @@ (define-public node-lts
            llhttp-bootstrap
            brotli
            `(,nghttp2 "lib")
-           openssl-1.1
+           openssl
            python-wrapper ;; for node-gyp (supports python3)
            zlib))))
 
-- 
2.38.1

Message #32 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Hilton Chain <hako <at> ultrarare.space>
To: guix-patches <at> gnu.org
Subject: [PATCH v2 4/4] gnu: libnode: Use node-lts as base.
Date: Fri, 11 Nov 2022 14:24:07 +0800

* gnu/packages/node.scm (libnode): Use node-lts as base.
* gnu/packages/cran.scm (r-v8)[arguments]<#:phases>: Adjusted accordingly.
---
 gnu/packages/cran.scm | 2 +-
 gnu/packages/node.scm | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/cran.scm b/gnu/packages/cran.scm
index a1702ae5f6..8f04d9ad6e 100644
--- a/gnu/packages/cran.scm
+++ b/gnu/packages/cran.scm
@@ -902,7 +902,7 @@ (define-public r-v8
                (("^PKG_LIBS=.*")
                 (string-append "PKG_LIBS="
                                (assoc-ref inputs "libnode")
-                               "/lib/libnode.so.64\n")))
+                               "/lib/libnode.so.108\n")))
              (setenv "INCLUDE_DIR"
                      (string-append
                       (assoc-ref inputs "libnode")
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index cae7d3b0ca..0e56d12038 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -901,10 +901,10 @@ (define-public node-lts
            zlib))))
 
 (define-public libnode
-  (package/inherit node
+  (package/inherit node-lts
     (name "libnode")
     (arguments
-     (substitute-keyword-arguments (package-arguments node)
+     (substitute-keyword-arguments (package-arguments node-lts)
        ((#:configure-flags flags ''())
         `(cons* "--shared" "--without-npm" ,flags))
        ((#:phases phases '%standard-phases)
-- 
2.38.1

Message #35 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Mekeor Melire <mekeor <at> posteo.de>
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>, guix-patches <at> gnu.org
Subject: Re: [bug#59188] [PATCH v2 3/4] gnu: node-lts: Update to 18.12.1.
Date: Wed, 16 Nov 2022 23:31:24 +0000

2022-11-11 / 14:23 / hako <at> ultrarare.space:

> * gnu/packages/node.scm (node-lts): Update to 18.12.1.
> [snippet]: Keep file deps/openssl/nodejs-openssl.cnf.
> [arguments]<#:phases>: Adjust problematic tests to delete accordingly.
> Patch additional file with hardcoded references to /bin/sh.
> [native-inputs,inputs]: Replace openssl-1.1 with openssl.

Thank you for this submission.

As I said in the other thread, I'd suggest to decline the 53414 (which
updates node to version 16.x) in favor of this patch-series (which
updates to 18.x). That is because it'll save us work since there'll only
be a single package-breaking upgrade (instead of two).

For this submission to be merged, I'd guess we should:

1. Check if we want to adapt some patches from Debian, listed here:
   https://sources.debian.org/patches/nodejs/18.12.1+dfsg-2/
   E.g. the "dfsg/privacy_breach.patch" looks good.

2. Make sure that packages, which depend on node, still build (and run)
   fine. I'm not sure how to do this. Do we need a branch for this?


Kindly,
Mekeor


> --- gnu/packages/node.scm | 35 ++++++++++++++++++++++++----------- 1
> file changed, 24 insertions(+), 11 deletions(-)
>
> diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
> index 0af0158f45..cae7d3b0ca 100644
> --- a/gnu/packages/node.scm
> +++ b/gnu/packages/node.scm
> @@ -735,23 +735,28 @@ (define-public llhttp-bootstrap
>  (define-public node-lts
>    (package
>      (inherit node)
> -    (version "14.19.3")
> +    (version "18.12.1")
>      (source (origin
>                (method url-fetch)
>                (uri (string-append "https://nodejs.org/dist/v" version
> -                                  "/node-v" version ".tar.xz"))
> +                                  "/node-v" version ".tar.gz"))
>                (sha256
>                 (base32
> -                "15691j5zhiikyamiwwd7f282g6d9acfhq91nrwx54xya38gmpx2w"))
> +                "11n1h54wgh61inrlqjp0j4fqcz6kl60a3iip7ya90nqdl3fp90ds"))
>                (modules '((guix build utils)))
>                (snippet
>                 `(begin
> +                  ;; openssl.cnf is required for build.
> +                  (for-each delete-file-recursively
> +                            (find-files "deps/openssl"
> +                                        (lambda (file stat)
> +                                          (if (string-contains file "nodejs-openssl.cnf")
> +                                              #f #t))))
>                    ;; Remove bundled software, where possible
>                    (for-each delete-file-recursively
>                              '("deps/cares"
>                                "deps/icu-small"
>                                "deps/nghttp2"
> -                              "deps/openssl"
>                                "deps/zlib"))
>                    (substitute* "Makefile"
>                      ;; Remove references to bundled software.
> @@ -800,23 +805,31 @@ (define-public node-lts
>                                     libuv "/lib:"
>                                     zlib "/lib"
>                                     "'],"))))))
> +           (add-after 'patch-hardcoded-program-references
> +                      'patch-additional-hardcoded-program-references
> +             (lambda* (#:key inputs #:allow-other-keys)
> +               (substitute* "test/parallel/test-stdin-from-file-spawn.js"
> +                 (("'/bin/sh'") (string-append
> +                                 "'" (search-input-file inputs "/bin/sh")
> +                                 "'")))))
>             (replace 'delete-problematic-tests
>               (lambda* (#:key inputs #:allow-other-keys)
>                 ;; FIXME: These tests fail in the build container, but they don't
>                 ;; seem to be indicative of real problems in practice.
>                 (for-each delete-file
> -                         '("test/parallel/test-cluster-master-error.js"
> -                           "test/parallel/test-cluster-master-kill.js"))
> +                         '("test/parallel/test-cluster-primary-error.js"
> +                           "test/parallel/test-cluster-primary-kill.js"))
>
>                 ;; These require a DNS resolver.
>                 (for-each delete-file
>                           '("test/parallel/test-dns.js"
> -                           "test/parallel/test-dns-lookupService-promises.js"))
> +                           "test/parallel/test-dns-lookupService-promises.js"
> +                           "test/parallel/test-net-socket-connect-without-cb.js"
> +                           "test/parallel/test-tcp-wrap-listen.js"))
>
>                 ;; These tests require networking.
>                 (for-each delete-file
> -                         '("test/parallel/test-https-agent-unref-socket.js"
> -                           "test/parallel/test-corepack-yarn-install.js"))
> +                         '("test/parallel/test-https-agent-unref-socket.js"))
>
>                 ;; This test is timing-sensitive, and fails sporadically on
>                 ;; slow, busy, or even very fast machines.
> @@ -866,7 +879,7 @@ (define-public node-lts
>             icu4c-71
>             libuv-for-node
>             `(,nghttp2 "lib")
> -           openssl-1.1
> +           openssl
>             zlib
>             ;; Regular build-time dependencies.
>             perl
> @@ -883,7 +896,7 @@ (define-public node-lts
>             llhttp-bootstrap
>             brotli
>             `(,nghttp2 "lib")
> -           openssl-1.1
> +           openssl
>             python-wrapper ;; for node-gyp (supports python3)
>             zlib))))

Message #41 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Mekeor Melire <mekeor <at> posteo.de>
Cc: hako <at> ultrarare.space, Christopher Baines <mail <at> cbaines.net>,
 59188 <at> debbugs.gnu.org
Subject: Re: bug#59188: [PATCH 0/4] gnu: node-lts: Update to 18.12.1.
Date: Fri, 18 Nov 2022 15:12:10 +0100

Hi,

Mekeor Melire <mekeor <at> posteo.de> skribis:

> As I said in the other thread, I'd suggest to decline the 53414 (which
> updates node to version 16.x) in favor of this patch-series (which
> updates to 18.x). That is because it'll save us work since there'll only
> be a single package-breaking upgrade (instead of two).

Sounds good to me.

> For this submission to be merged, I'd guess we should:
>
> 1. Check if we want to adapt some patches from Debian, listed here:
>    https://sources.debian.org/patches/nodejs/18.12.1+dfsg-2/
>    E.g. the "dfsg/privacy_breach.patch" looks good.

Yes, but that can be done separately I guess.

> 2. Make sure that packages, which depend on node, still build (and run)
>    fine. I'm not sure how to do this. Do we need a branch for this?

It depends.  Hilton, were you able to build everything returned by
‘guix refresh -l node’, except perhaps ungoogled-chromium?

For some reason <https://qa.guix.gnu.org/issue/59188> didn’t pick it
up.  Anything we should do to address that, Chris?

Otherwise we can indeed create a branch and tell ci.guix to build it,
for instance.

Thanks,
Ludo’.

Message #44 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: Hilton Chain <hako <at> ultrarare.space>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: Mekeor Melire <mekeor <at> posteo.de>, Christopher Baines <mail <at> cbaines.net>,
 59188 <at> debbugs.gnu.org
Subject: Re: bug#59188: [PATCH 0/4] gnu: node-lts: Update to 18.12.1.
Date: Sat, 19 Nov 2022 13:17:51 +0800

node-acorn fails in check phase.
#+RESULTS:
: starting phase `check'
: npm ERR! Missing script: "test"
: npm ERR!
: npm ERR! To see a list of scripts, run:
: npm ERR!   npm run
:
: npm ERR! A complete log of this run can be found in:
: npm ERR!     /tmp/guix-build-node-acorn-8.4.1.drv-0/source/npm-home-0/.npm/_logs/2022-11-19T04_28_57_471Z-debug-0.log
: error: in phase 'check': uncaught exception:
: %exception #<&invoke-error program: "/gnu/store/l32l0i53ik9ja3fircdd89bgq6b1v6y5-node-18.12.1/bin/npm" arguments: ("test") exit-status: 1 term-signal: #f stop-signal: #f>
: phase `check' failed after 0.2 seconds
: command "/gnu/store/l32l0i53ik9ja3fircdd89bgq6b1v6y5-node-18.12.1/bin/npm" "test" failed with status 1

Then node-uglify-js
#+RESULTS:
: starting phase `configure'
: npm ERR! code 254
: npm ERR! path /gnu/store/969597ncg311d3kd8vbhdlniwqg4mr2k-node-acorn-8.4.1/lib/node_modules/acorn
: npm ERR! command failed
: npm ERR! command sh -c -- cd ..; npm run build:main && npm run build:bin
: npm ERR! npm ERR! code ENOENT
: npm ERR! npm ERR! syscall open
: npm ERR! npm ERR! path /gnu/store/969597ncg311d3kd8vbhdlniwqg4mr2k-node-acorn-8.4.1/lib/package.json
: npm ERR! npm ERR! errno -2
: npm ERR! npm ERR! enoent ENOENT: no such file or directory, open '/gnu/store/969597ncg311d3kd8vbhdlniwqg4mr2k-node-acorn-8.4.1/lib/package.json'
: npm ERR! npm ERR! enoent This is related to npm not being able to find a file.
: npm ERR! npm ERR! enoent
: npm ERR!
: npm ERR! npm ERR! A complete log of this run can be found in:
: npm ERR! npm ERR!     /tmp/guix-build-node-uglify-js-3.13.9.drv-0/npm-home-0/.npm/_logs/2022-11-19T04_54_25_643Z-debug-0.log
:
: npm ERR! A complete log of this run can be found in:
: npm ERR!     /tmp/guix-build-node-uglify-js-3.13.9.drv-0/npm-home-0/.npm/_logs/2022-11-19T04_54_25_343Z-debug-0.log
: error: in phase 'configure': uncaught exception:
: %exception #<&invoke-error program: "/gnu/store/l32l0i53ik9ja3fircdd89bgq6b1v6y5-node-18.12.1/bin/npm" arguments: ("--offline" "--ignore-scripts" "install") exit-status: 254 term-signal: #f stop-signal: #f>
: phase `configure' failed after 0.6 seconds
: command "/gnu/store/l32l0i53ik9ja3fircdd89bgq6b1v6y5-node-18.12.1/bin/npm" "--offline" "--ignore-scripts" "install" failed with status 254

One test failed after deleting node-uglify-js's configure phase.
#+RESULTS:
: 1 test(s) failed!
:
: test/reduce.js
:   1) Should reduce test case which differs only in Error.message
: AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
: + actual - expected
:
: + `try{null[function(){}]}catch(e){console.log(e)}\n// output: TypeError: Cannot read properties of null (reading 'function(){}')\n// \n// minify: TypeError: Cannot read properties of null (reading 'function() {}')\n// \n// options: {\n//   "compress": false,\n//   "mangle": false,\n//   "output": {\n//     "beautify": true\n//   }\n// }`
: - `try{null[function(){}]}catch(e){console.log(e)}\n// output: TypeError: Cannot read property 'function(){}' of null\n// \n// minify: TypeError: Cannot read property 'function() {}' of null\n// \n// options: {\n//   "compress": false,\n//   "mangle": false,\n//   "output": {\n//     "beautify": true\n//   }\n// }`
:     at Function.<anonymous> (/tmp/guix-build-node-uglify-js-3.13.9.drv-0/source/test/mocha/reduce.js:285:16)
:     at run (/tmp/guix-build-node-uglify-js-3.13.9.drv-0/source/test/mocha.js:79:18)
:     at process.processTicksAndRejections (node:internal/process/task_queues:77:11)
: error: in phase 'check': uncaught exception:
: %exception #<&invoke-error program: "/gnu/store/l32l0i53ik9ja3fircdd89bgq6b1v6y5-node-18.12.1/bin/npm" arguments: ("test") exit-status: 1 term-signal: #f stop-signal: #f>
: phase `check' failed after 264.2 seconds
: command "/gnu/store/l32l0i53ik9ja3fircdd89bgq6b1v6y5-node-18.12.1/bin/npm" "test" failed with status 1

Then node-string-decoder fails to install, I have no idea how to continue...
#+RESULTS:
: starting phase `install'
: npm info using npm <at> 8.19.2
: npm info using node <at> v18.12.1
: npm timing npm:load:whichnode Completed in 0ms
: npm timing config:load:defaults Completed in 1ms
: npm timing config:load:file:/gnu/store/l32l0i53ik9ja3fircdd89bgq6b1v6y5-node-18.12.1/lib/node_modules/npm/npmrc Completed in 2ms
: npm timing config:load:builtin Completed in 3ms
: npm WARN config production Use `--omit=dev` instead.
: npm timing config:load:cli Completed in 1ms
: npm timing config:load:env Completed in 1ms
: npm timing config:load:project Completed in 0ms
: npm timing config:load:file:/tmp/guix-build-node-string-decoder-1.3.0.drv-0/npm-home-0/.npmrc Completed in 0ms
: npm timing config:load:user Completed in 0ms
: npm timing config:load:file:/gnu/store/ansccgk9y8vzd5rwsx4iz7j2n0gp8ig8-node-string-decoder-1.3.0/etc/npmrc Completed in 2ms
: npm timing config:load:global Completed in 2ms
: npm timing config:load:validate Completed in 0ms
: npm timing config:load:credentials Completed in 1ms
: npm timing config:load:setEnvs Completed in 0ms
: npm timing config:load Completed in 9ms
: npm timing npm:load:configload Completed in 9ms
: npm timing npm:load:mkdirpcache Completed in 1ms
: npm timing npm:load:mkdirplogs Completed in 1ms
: npm timing npm:load:setTitle Completed in 0ms
: npm timing config:load:flatten Completed in 1ms
: npm timing npm:load:display Completed in 4ms
: npm timing npm:load:logFile Completed in 3ms
: npm timing npm:load:timers Completed in 0ms
: npm timing npm:load:configScope Completed in 0ms
: npm timing npm:load Completed in 19ms
: npm timing arborist:ctor Completed in 0ms
: npm timing idealTree:init Completed in 4ms
: npm timing idealTree:userRequests Completed in 30ms
: npm timing idealTree:#root Completed in 16ms
: npm timing idealTree:node_modules/string_decoder Completed in 3ms
: npm timing idealTree:node_modules/string_decoder/node_modules/safe-buffer Completed in 0ms
: npm timing idealTree:buildDeps Completed in 20ms
: npm timing idealTree:fixDepFlags Completed in 0ms
: npm timing idealTree Completed in 56ms
: npm timing reify:loadTrees Completed in 57ms
: npm timing reify:diffTrees Completed in 1ms
: npm timing reify:retireShallow Completed in 1ms
: npm timing reify:createSparse Completed in 0ms
: npm timing reify:trashOmits Completed in 0ms
: npm timing reify:loadBundles Completed in 0ms
: npm timing reify:audit Completed in 0ms
: npm timing reifyNode:node_modules/string_decoder/node_modules/safe-buffer Completed in 5ms
: npm timing reifyNode:node_modules/string_decoder Completed in 12ms
: npm timing reify:unpack Completed in 13ms
: npm timing reify:unretire Completed in 0ms
: npm timing build:queue Completed in 1ms
: npm timing build:deps Completed in 1ms
: npm timing build:queue Completed in 1ms
: npm timing build:links Completed in 1ms
: npm timing build Completed in 2ms
: npm timing reify:build Completed in 2ms
: npm timing reify:trash Completed in 0ms
: npm timing command:install Completed in 83ms
: npm ERR! Cannot set properties of null (setting 'dev')
: npm timing npm Completed in 163ms
:
: npm ERR! A complete log of this run can be found in:
: npm ERR!     /tmp/guix-build-node-string-decoder-1.3.0.drv-0/npm-home-0/.npm/_logs/2022-11-19T05_09_44_366Z-debug-0.log
: error: in phase 'install': uncaught exception:
: %exception #<&invoke-error program: "/gnu/store/l32l0i53ik9ja3fircdd89bgq6b1v6y5-node-18.12.1/bin/npm" arguments: ("--prefix" "/gnu/store/ansccgk9y8vzd5rwsx4iz7j2n0gp8ig8-node-string-decoder-1.3.0" "--global" "--offline" "--loglevel" "info" "--production" "install" "../package.tgz") exit-status: 1 term-signal: #f stop-signal: #f>
: phase `install' failed after 0.4 seconds
: command "/gnu/store/l32l0i53ik9ja3fircdd89bgq6b1v6y5-node-18.12.1/bin/npm" "--prefix" "/gnu/store/ansccgk9y8vzd5rwsx4iz7j2n0gp8ig8-node-string-decoder-1.3.0" "--global" "--offline" "--loglevel" "info" "--production" "install" "../package.tgz" failed with status 1

Message #47 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: Christopher Baines <mail <at> cbaines.net>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 59188 <at> debbugs.gnu.org
Subject: Re: bug#59188: [PATCH 0/4] gnu: node-lts: Update to 18.12.1.
Date: Sun, 20 Nov 2022 09:40:19 +0000

[Message part 1 (text/plain, inline)]

Ludovic Courtès <ludo <at> gnu.org> writes:

> It depends.  Hilton, were you able to build everything returned by
> ‘guix refresh -l node’, except perhaps ungoogled-chromium?
>
> For some reason <https://qa.guix.gnu.org/issue/59188> didn’t pick it
> up.  Anything we should do to address that, Chris?

For some reason, the branch existed, but the patchwork checks
didn't. I've got some ideas on how to avoid that being a possibility in
the future.

Thanks,

Chris

[signature.asc (application/pgp-signature, inline)]

Message #50 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: Jelle Licht <jlicht <at> fsfe.org>
To: Hilton Chain <hako <at> ultrarare.space>
Cc: Mekeor Melire <mekeor <at> posteo.de>,
 Ludovic Courtès <ludo <at> gnu.org>,
 Christopher Baines <mail <at> cbaines.net>, 59188 <at> debbugs.gnu.org
Subject: Re: bug#59188: [PATCH 0/4] gnu: node-lts: Update to 18.12.1.
Date: Thu, 05 Jan 2023 14:10:45 +0100

Hello Hilton, other folks,

Hilton Chain <hako <at> ultrarare.space> writes:

> node-acorn fails in check phase.
> #+RESULTS:
> : starting phase `check'
> : npm ERR! Missing script: "test"
> : npm ERR!
> : npm ERR! To see a list of scripts, run:
> : npm ERR!   npm run
> <snip>

This is due to a change in how npm treats the 'test' command; before,
having no "scripts.test" entry in package.json lead to a placeholder of 
"echo 'Error: no test specified'" (with a status code of 0).

More recently, npm was changed to make `npm test' like any other `npm
run XYZ' command. This means that all of the packages that fail like
this due to upgrading node/npm should be get a `#:tests? #f'.

> Then node-uglify-js
> #+RESULTS:
> : starting phase `configure'
> : npm ERR! code 254
> : npm ERR! path /gnu/store/969597ncg311d3kd8vbhdlniwqg4mr2k-node-acorn-8.4.1/lib/node_modules/acorn
> : npm ERR! command failed
> : npm ERR! command sh -c -- cd ..; npm run build:main && npm run build:bin
> <snip>

This is due to the fact that the `prepare' scripts is being run for our
installed node-acorn. Apparently, the fact that it previously did not
happen was a bug that was fixed somewhere between node 14 and 18 [1][2].

I do not know what the best approach is here. Consider patching the
"scripts.prepare" entry in node-acorn, and if we find we need to do this
often, we can introduce a convenience function similar to
`delete-dependencies' to streamline this.

> One test failed after deleting node-uglify-js's configure phase.
> #+RESULTS:
> : 1 test(s) failed!
> :
> : test/reduce.js
> :   1) Should reduce test case which differs only in Error.message
> : AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
> : + actual - expected
> :
> : + `try{null[function(){}]}catch(e){console.log(e)}\n// output: TypeError: Cannot read properties of null (reading 'function(){}')\n// \n// minify: TypeError: Cannot read properties of null (reading 'function() {}')\n// \n// options: {\n//   "compress": false,\n//   "mangle": false,\n//   "output": {\n//     "beautify": true\n//   }\n// }`
> : - `try{null[function(){}]}catch(e){console.log(e)}\n// output: TypeError: Cannot read property 'function(){}' of null\n// \n// minify: TypeError: Cannot read property 'function() {}' of null\n// \n// options: {\n//   "compress": false,\n//   "mangle": false,\n//   "output": {\n//     "beautify": true\n//   }\n// }`
> :     at Function.<anonymous> (/tmp/guix-build-node-uglify-js-3.13.9.drv-0/source/test/mocha/reduce.js:285:16)
> :     at run (/tmp/guix-build-node-uglify-js-3.13.9.drv-0/source/test/mocha.js:79:18)
> :     at process.processTicksAndRejections (node:internal/process/task_queues:77:11)
> : error: in phase 'check': uncaught exception:
> : %exception #<&invoke-error program: "/gnu/store/l32l0i53ik9ja3fircdd89bgq6b1v6y5-node-18.12.1/bin/npm" arguments: ("test") exit-status: 1 term-signal: #f stop-signal: #f>
> : phase `check' failed after 264.2 seconds
> : command "/gnu/store/l32l0i53ik9ja3fircdd89bgq6b1v6y5-node-18.12.1/bin/npm" "test" failed with status 1
>
> Then node-string-decoder fails to install, I have no idea how to continue...
> #+RESULTS:
> : starting phase `install'
> : npm info using npm <at> 8.19.2
> : npm info using node <at> v18.12.1
> : npm timing npm:load:whichnode Completed in 0ms
> : npm timing config:load:defaults Completed in 1ms
> : npm timing config:load:file:/gnu/store/l32l0i53ik9ja3fircdd89bgq6b1v6y5-node-18.12.1/lib/node_modules/npm/npmrc Completed in 2ms
> : npm timing config:load:builtin Completed in 3ms
> : npm WARN config production Use `--omit=dev` instead.
> : npm timing config:load:cli Completed in 1ms
> : npm timing config:load:env Completed in 1ms
> : npm timing config:load:project Completed in 0ms
> : npm timing config:load:file:/tmp/guix-build-node-string-decoder-1.3.0.drv-0/npm-home-0/.npmrc Completed in 0ms
> : npm timing config:load:user Completed in 0ms
> : npm timing config:load:file:/gnu/store/ansccgk9y8vzd5rwsx4iz7j2n0gp8ig8-node-string-decoder-1.3.0/etc/npmrc Completed in 2ms
> : npm timing config:load:global Completed in 2ms
> : npm timing config:load:validate Completed in 0ms
> : npm timing config:load:credentials Completed in 1ms
> : npm timing config:load:setEnvs Completed in 0ms
> : npm timing config:load Completed in 9ms
> : npm timing npm:load:configload Completed in 9ms
> : npm timing npm:load:mkdirpcache Completed in 1ms
> : npm timing npm:load:mkdirplogs Completed in 1ms
> : npm timing npm:load:setTitle Completed in 0ms
> : npm timing config:load:flatten Completed in 1ms
> : npm timing npm:load:display Completed in 4ms
> : npm timing npm:load:logFile Completed in 3ms
> : npm timing npm:load:timers Completed in 0ms
> : npm timing npm:load:configScope Completed in 0ms
> : npm timing npm:load Completed in 19ms
> : npm timing arborist:ctor Completed in 0ms
> : npm timing idealTree:init Completed in 4ms
> : npm timing idealTree:userRequests Completed in 30ms
> : npm timing idealTree:#root Completed in 16ms
> : npm timing idealTree:node_modules/string_decoder Completed in 3ms
> : npm timing idealTree:node_modules/string_decoder/node_modules/safe-buffer Completed in 0ms
> : npm timing idealTree:buildDeps Completed in 20ms
> : npm timing idealTree:fixDepFlags Completed in 0ms
> : npm timing idealTree Completed in 56ms
> : npm timing reify:loadTrees Completed in 57ms
> : npm timing reify:diffTrees Completed in 1ms
> : npm timing reify:retireShallow Completed in 1ms
> : npm timing reify:createSparse Completed in 0ms
> : npm timing reify:trashOmits Completed in 0ms
> : npm timing reify:loadBundles Completed in 0ms
> : npm timing reify:audit Completed in 0ms
> : npm timing reifyNode:node_modules/string_decoder/node_modules/safe-buffer Completed in 5ms
> : npm timing reifyNode:node_modules/string_decoder Completed in 12ms
> : npm timing reify:unpack Completed in 13ms
> : npm timing reify:unretire Completed in 0ms
> : npm timing build:queue Completed in 1ms
> : npm timing build:deps Completed in 1ms
> : npm timing build:queue Completed in 1ms
> : npm timing build:links Completed in 1ms
> : npm timing build Completed in 2ms
> : npm timing reify:build Completed in 2ms
> : npm timing reify:trash Completed in 0ms
> : npm timing command:install Completed in 83ms
> : npm ERR! Cannot set properties of null (setting 'dev')

This is due to either a newly introducded bug, or perhaps more likely,
an unfortunate sequence of interactions in arborist. I've done some
bisecting, and got things to work with a hack.

Relevants parts of arborist were rewritten in version 6, whereas we are
stuck with 5.4.XYZ, making a proper backport highly unlikely.

--8<---------------cut here---------------start------------->8---
+           ;; TODO: Work around issue in that is fixed in arborist <at> 6.0.0/npm <at> 9.0.0/node <at> 19+
+           (add-after 'patch-hardcoded-program-references
+                      'patch-broken-arborist
+             (lambda* (#:key inputs #:allow-other-keys)
+               (substitute* "deps/npm/node_modules/@npmcli/arborist/lib/calc-dep-flags.js"
+                 (("if \\(node\\.isLink\\)")
+                  "if (node.isLink && node.target)"))))
--8<---------------cut here---------------end--------------->8---


In addition it some of the packages in node-xyz.scm that involve
replacing the 'configure phase are also failing. For some reason, this
updated version of npm seems to want to have access to either some
cached metadata or the actual npm packages for each of the specified
devDependencies[3]. This can be worked around by introducing a
'patch-dependencies phase for impacted packages, and patching out all
devDependencies. AFAICS this applies for (at least) these packages:

- node-buffer-crc32
- node-crx3
- node-minimist
- node-pbf
- node-protocol-buffers-schema
- node-protobuf-schema
- node-ieee754
- node-yazl

HTH

You have my gratitude for working on this Hilton! 
 - Jelle


[1]: https://github.com/npm/cli/issues/459

[2]: https://docs.npmjs.com/cli/v9/commands/npm-install

[3]: My guess: npm wants to be able to construct a 'proper'
package-lock.json, for which it needs some metadata from the npm
registry. I've already checked if adding '--no-package-lock' fixes the
issue, but while it indeed ensures no package-lock.json is generated, it
sadly doesn't address the issue. IWBN if there were some magical
invocation(s) for npm that allow these packages to actually be packaged
by distributions...

Message #53 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: "Dr. Arne Babenhauserheide" <arne_bab <at> web.de>
To: 59188 <at> debbugs.gnu.org
Subject: node-lts 18: progress? 
Date: Mon, 06 Feb 2023 14:37:19 +0100

[Message part 1 (text/plain, inline)]

Hi,

Did you make progress with this patch?

Is there a way I can help you?

Best wishes,
Arne
-- 
Unpolitisch sein
heißt politisch sein,
ohne es zu merken.
draketo.de

[signature.asc (application/pgp-signature, inline)]

Message #56 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 00/16] Updating node-lts to 18.X
Date: Wed,  8 Feb 2023 22:05:15 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

Folks,

This should at least build for x86_64, and I'm sending in a 'new' patch series
in the hopes of QA picking things up this time.

Hilton, I've taken the liberty of adding in a copyright line for your node-lts
update: I've also tweaked some versions so there would be less manual patching
and backports to do, namely:
* libuv-for-node to 1.44.2
* node-lts to 18.14.0

I needed to tweak some of our existing packages so they actually explicitly
state which dependencies they do not care about; with the npm bundled with
node < 16, things "Just Worked", but since then npm has become a bit stricter.

After applying my patches they should build with either node <at> 14 (current
packaged version) or node <at> 18 (Hilton's version).

Hilton Chain (4):
  gnu: libuv-for-node: Update to 1.44.2.
  gnu: llhttp-bootstrap: Update to 6.0.10.
  gnu: node-lts: Update to 18.14.0.
  gnu: libnode: Use node-lts as base.

Jelle Licht (12):
  gnu: node-acorn: Disable tests.
  gnu: node-acorn: Remove lifecycle script.
  gnu: node-acorn: Fix broken transpilation.
  gnu: node-buffer-crc32: Ignore development dependencies.
  gnu: node-crx3: Ignore development dependencies.
  gnu: node-minimist: Ignore development dependencies.
  gnu: node-pbf: Ignore development dependencies.
  gnu: node-protocol-buffers-schema: Ignore development dependencies.
  gnu: node-resolve-protobuf-schema: Ignore development dependencies.
  gnu: node-ieee754: Ignore development dependencies.
  gnu: node-yazl: Ignore development dependencies.
  gnu: node-uglify-js: Update to 3.14.2.

 gnu/local.mk                                  |   1 -
 gnu/packages/cran.scm                         |   2 +-
 gnu/packages/libevent.scm                     |   4 +-
 gnu/packages/node-xyz.scm                     | 110 +++++++++++++-----
 gnu/packages/node.scm                         |  49 +++++---
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ----------------
 gnu/packages/uglifyjs.scm                     |   4 +-
 7 files changed, 121 insertions(+), 149 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch


base-commit: 07e74b63d4969de0b51c48edb586f0d7d8c08db7
-- 
2.39.1

Message #59 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 02/16] gnu: node-acorn: Remove lifecycle script.
Date: Wed,  8 Feb 2023 22:05:17 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[arguments]<modules>: New argument.
<phases>: Patch out unused 'prepare' script that breaks dependents.
---
 gnu/packages/node-xyz.scm | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 51ea110e8c..5e7e6ae4d9 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -47,11 +47,35 @@ (define-public node-acorn
     (build-system node-build-system)
     (arguments
      '(#:tests? #f
+       #:modules
+       ((guix build node-build-system)
+        (srfi srfi-1)
+        (ice-9 match)
+        (guix build utils))
        #:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'change-directory
            (lambda _
-             (chdir "acorn"))))))
+             (chdir "acorn")))
+         (add-before 'configure 'avoid-prepare-scripts
+           (lambda _
+             ;; We need to remove the prepare script from "package.json", as
+             ;; it would try to use the build environment and would block the
+             ;; automatic building by other packages making use of node-acorn.
+             ;; TODO: Add utility function
+             (with-atomic-json-file-replacement "package.json"
+               (match-lambda
+                 (('@ . pkg-meta-alist)
+                  (cons '@ (map (match-lambda
+                                  (("scripts" @ . scripts-alist)
+                                   `("scripts" @ ,@(filter (match-lambda
+                                                             (("prepare" . _)
+                                                              #f)
+                                                             (_
+                                                              #t))
+                                                           scripts-alist)))
+                                  (other other))
+                                pkg-meta-alist))))))))))
     (home-page "https://github.com/acornjs/acorn/tree/master/acorn")
     (synopsis "Javascript-based Javascript parser")
     (description "Acornjs is a Javascript parser with many options and an
-- 
2.39.1

Message #62 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 01/16] gnu: node-acorn: Disable tests.
Date: Wed,  8 Feb 2023 22:05:16 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn): Explicitly disable tests.
---
 gnu/packages/node-xyz.scm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index a1e89f1759..51ea110e8c 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -46,7 +46,8 @@ (define-public node-acorn
         (base32 "068h5gysz8bbslq31dva8f223rdf8l7w6nxcxjnv4zdprwkzkhaa"))))
     (build-system node-build-system)
     (arguments
-     '(#:phases
+     '(#:tests? #f
+       #:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'change-directory
            (lambda _
-- 
2.39.1

Message #65 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 03/16] gnu: node-acorn: Fix broken transpilation.
Date: Wed,  8 Feb 2023 22:05:18 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[native-inputs]: Add `esbuild'.
[arguments]<phases>: Replace build phase by custom `esbuild' invocations.
---
 gnu/packages/node-xyz.scm | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 5e7e6ae4d9..c9a853616e 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2021 Charles <charles.b.jackson <at> protonmail.com>
 ;;; Copyright © 2021 Philip McGrath <philip <at> philipmcgrath.com>
 ;;; Copyright © 2022 Nicolas Graves <ngraves <at> ngraves.fr>
+;;; Copyright © 2023 Jelle Licht <jlicht <at> fsfe.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -75,7 +76,30 @@ (define-public node-acorn
                                                               #t))
                                                            scripts-alist)))
                                   (other other))
-                                pkg-meta-alist))))))))))
+                                pkg-meta-alist)))))))
+         (replace 'build
+           (lambda* (#:key inputs native-inputs #:allow-other-keys)
+             (let ((esbuild (search-input-file (or native-inputs inputs)
+                                        "/bin/esbuild")))
+               (invoke esbuild
+                     "src/index.js"
+                     "--outfile=dist/acorn.js"
+                     "--format=cjs"
+                     "--bundle"
+                     "--platform=node")
+               (invoke esbuild
+                     "src/index.js"
+                     "--outfile=dist/acorn.mjs"
+                     "--format=esm"
+                     "--bundle"
+                     "--platform=node")
+               (invoke esbuild
+                     "src/bin/acorn.js"
+                     "--outfile=dist/bin.js"
+                     "--format=cjs"
+                     "--platform=node")))))))
+    (native-inputs
+     (list esbuild))
     (home-page "https://github.com/acornjs/acorn/tree/master/acorn")
     (synopsis "Javascript-based Javascript parser")
     (description "Acornjs is a Javascript parser with many options and an
-- 
2.39.1

Message #68 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 04/16] gnu: node-buffer-crc32: Ignore development
 dependencies.
Date: Wed,  8 Feb 2023 22:05:19 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[arguments]<phases>: Explicitly patch
out development dependencies.  Re-enable configure phase.
---
 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index c9a853616e..d527e3240a 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -123,10 +123,9 @@ (define-public node-buffer-crc32
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("tap")))))))
     (home-page "https://github.com/brianloveswords/buffer-crc32")
     (synopsis "CRC32 implementation in Javascript")
     (description
-- 
2.39.1

Message #71 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 05/16] gnu: node-crx3: Ignore development dependencies.
Date: Wed,  8 Feb 2023 22:05:20 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-crx3)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---
 gnu/packages/node-xyz.scm | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index d527e3240a..325dca84ce 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -179,10 +179,16 @@ (define-public node-crx3
                       (substitute* "lib/configuration.js"
                         (("mri")
                          "minimist"))))
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("c8"
+                                             "docdash"
+                                             "eslint"
+                                             "eslint-plugin-jsdoc"
+                                             "jsdoc"
+                                             "tap-diff"
+                                             "tape"
+                                             "tape-catch")))))))
     (inputs (list node-minimist node-pbf node-yazl))
     (home-page "https://github.com/ahwayakchih/crx3")
     (synopsis "Create CRXv3 browser extensions with Javascript")
-- 
2.39.1

Message #74 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 06/16] gnu: node-minimist: Ignore development dependencies.
Date: Wed,  8 Feb 2023 22:05:21 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-minimist)[arguments]<phases>: Explicitly
patch out development dependencies. Re-enable configure phase.
---
 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 325dca84ce..a03b9b4f1c 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -313,10 +313,9 @@ (define-public node-minimist
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("covert" "tap" "tape")))))))
     (home-page "https://github.com/substack/minimist")
     (synopsis "Parse CLI arguments in Javascript")
     (description "This package can scan for CLI flags and arguments in
-- 
2.39.1

Message #77 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 07/16] gnu: node-pbf: Ignore development dependencies.
Date: Wed,  8 Feb 2023 22:05:22 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-pbf)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---
 gnu/packages/node-xyz.scm | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index a03b9b4f1c..07c5982996 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -364,10 +364,19 @@ (define-public node-pbf
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies
+                       '("benchmark"
+                         "browserify"
+                         "eslint"
+                         "eslint-config-mourner"
+                         "mkdirp"
+                         "protobufjs"
+                         "protocol-buffers"
+                         "tap"
+                         "tile-stats-runner"
+                         "uglify-js")))))))
     (inputs (list node-ieee754 node-resolve-protobuf-schema))
     (home-page "https://github.com/mapbox/pbf")
     (synopsis "Decode and encode protocol buffers in Javascript")
-- 
2.39.1

Message #80 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 08/16] gnu: node-protocol-buffers-schema: Ignore
 development dependencies.
Date: Wed,  8 Feb 2023 22:05:23 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-protocol-buffers-schema)[arguments]<phases>:
Explicitly patch out development dependencies. Re-enable configure phase.
---
 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 07c5982996..e406b55b56 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -405,10 +405,9 @@ (define-public node-protocol-buffers-schema
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("standard" "tape")))))))
     (home-page "https://github.com/mafintosh/protocol-buffers-schema")
     (synopsis "Protocol buffers schema parser written in Javascript")
     (description "This package provides a protocol buffers schema parser
-- 
2.39.1

Message #83 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 09/16] gnu: node-resolve-protobuf-schema: Ignore
 development dependencies.
Date: Wed,  8 Feb 2023 22:05:24 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-resolve-protobuf-schema)[arguments]<phases>:
Explicitly patch out development dependencies. Re-enable configure phase.
---
 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index e406b55b56..21b5390833 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -431,10 +431,9 @@ (define-public node-resolve-protobuf-schema
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("standard" "tape")))))))
     (inputs (list node-protocol-buffers-schema))
     (home-page "https://github.com/mafintosh/resolve-protobuf-schema")
     (synopsis "Resolve protobuf imports")
-- 
2.39.1

Message #86 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 10/16] gnu: node-ieee754: Ignore development dependencies.
Date: Wed,  8 Feb 2023 22:05:25 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-ieee754)[arguments]<phases>: Explicitly
patch out development dependencies. Re-enable configure phase.
---
 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 21b5390833..d8939d1469 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -623,10 +623,9 @@ (define-public node-ieee754
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("airtap" "standard" "tape")))))))
     (home-page "https://github.com/feross/ieee754")
     (synopsis "Read/write IEEE754 floating point numbers in Javascript")
     (description "This package can read and write IEEE754 floating point
-- 
2.39.1

Message #89 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 11/16] gnu: node-yazl: Ignore development dependencies.
Date: Wed,  8 Feb 2023 22:05:26 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-yazl)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---
 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index d8939d1469..8740796a8c 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -1588,10 +1588,9 @@ (define-public node-yazl
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("airtap" "bl" "istanbul" "yauzl")))))))
     (inputs (list node-buffer-crc32))
     (home-page "https://github.com/thejoshwolfe/yazl")
     (synopsis "Yet another zip library for node")
-- 
2.39.1

Message #92 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 12/16] gnu: node-uglify-js: Update to 3.14.2.
Date: Wed,  8 Feb 2023 22:05:27 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/uglifyjs.scm (node-uglify-js): Update to 3.14.2.
---
 gnu/packages/uglifyjs.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/uglifyjs.scm b/gnu/packages/uglifyjs.scm
index b65d52b8df..1bd8bb6326 100644
--- a/gnu/packages/uglifyjs.scm
+++ b/gnu/packages/uglifyjs.scm
@@ -25,7 +25,7 @@ (define-module (gnu packages uglifyjs)
 (define-public node-uglify-js
   (package
     (name "node-uglify-js")
-    (version "3.13.9")
+    (version "3.14.2")
     (source
      (origin
        (method git-fetch)
@@ -34,7 +34,7 @@ (define-public node-uglify-js
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "0q1f91xwwm829cl5v727d4qkxy4yh7wri3pgl89f0m3a4y1n7hi4"))))
+        (base32 "1jraqpwzga4vbgq3xcn08jcfc87pm6nik7vpxvxa4rfjvz70a6k7"))))
     (build-system node-build-system)
     (native-inputs
      (list node-acorn node-semver))
-- 
2.39.1

Message #95 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>, Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 13/16] gnu: libuv-for-node: Update to 1.44.2.
Date: Wed,  8 Feb 2023 22:05:28 +0100

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/libevent.scm (libuv-for-node): Update to 1.44.2.
---
 gnu/packages/libevent.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/libevent.scm b/gnu/packages/libevent.scm
index f9722e4469..fa1e76b347 100644
--- a/gnu/packages/libevent.scm
+++ b/gnu/packages/libevent.scm
@@ -147,14 +147,14 @@ (define-public libuv-for-node
   (package
     (inherit libuv)
     (name "libuv")
-    (version "1.42.0")
+    (version "1.44.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://dist.libuv.org/dist/v" version
                                   "/libuv-v" version ".tar.gz"))
               (sha256
                (base32
-                "0wpb9pz3r8nksnrf4zbixj2kk9whr7abi45ydrwyv2js2ljrc4j3"))))
+                "1d1wy1061cf2mfygr2j6jbm0da2mhsf0l9yq4rjkqrsmijbdrz6c"))))
     (properties '((hidden? . #t)))))
 
 (define-public libuv-julia
-- 
2.39.1

Message #98 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>, Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 14/16] gnu: llhttp-bootstrap: Update to 6.0.10.
Date: Wed,  8 Feb 2023 22:05:29 +0100

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (llhttp-bootstrap): Update to 6.0.10.
* gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch: Remove file.
* gnu/local.mk: Remove it.
---
 gnu/local.mk                                  |   1 -
 gnu/packages/node.scm                         |   5 +-
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ------------------
 3 files changed, 2 insertions(+), 104 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index a5f4b83961..60219dc756 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1482,7 +1482,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/linuxdcpp-openssl-1.1.patch		\
   %D%/packages/patches/lirc-localstatedir.patch			\
   %D%/packages/patches/lirc-reproducible-build.patch		\
-  %D%/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch	\
   %D%/packages/patches/llvm-3.5-fix-clang-build-with-gcc5.patch	\
   %D%/packages/patches/llvm-3.6-fix-build-with-gcc-10.patch	\
   %D%/packages/patches/llvm-3.x.1-fix-build-with-gcc.patch	\
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index be39f3b25a..de847490a3 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -668,7 +668,7 @@ (define-public node-llparse-bootstrap
 (define-public llhttp-bootstrap
   (package
     (name "llhttp")
-    (version "2.1.4")
+    (version "6.0.10")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -677,8 +677,7 @@ (define-public llhttp-bootstrap
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "115mwyds9655p76lhglxg2blc1ksgrix6zhigaxnc2q6syy3pa6x"))
-              (patches (search-patches "llhttp-bootstrap-CVE-2020-8287.patch"))
+                "0izwqa77y007xdi0bj3ccw821n19rz89mz4hx4lg99fwkwylr6x8"))
               (modules '((guix build utils)))
               (snippet
                '(begin
diff --git a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch b/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
deleted file mode 100644
index 215c920e53..0000000000
--- a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-This patch comes from upstream.  It corresponds to a patch applied to
-the generated C source code for llhttp included in Node.js 14.16.0
-(see commit 641f786bb1a1f6eb1ff8750782ed939780f2b31a).  That commit
-fixes CVE-2020-8287.  With this patch, the output of our
-llhttp-bootstrap package matches the files included in Node.js 14.16.0
-exactly.
-
-commit e9b36ea64709c35ca66094d5cf3787f444029601
-Author: Fedor Indutny <fedor <at> indutny.com>
-Date:   Sat Oct 10 19:56:01 2020 -0700
-
-    http: unset `F_CHUNKED` on new `Transfer-Encoding`
-    
-    Duplicate `Transfer-Encoding` header should be a treated as a single,
-    but with original header values concatenated with a comma separator. In
-    the light of this, even if the past `Transfer-Encoding` ended with
-    `chunked`, we should be not let the `F_CHUNKED` to leak into the next
-    header, because mere presence of another header indicates that `chunked`
-    is not the last transfer-encoding token.
-
-diff --git a/src/llhttp/http.ts b/src/llhttp/http.ts
-index f4f1a6e..0a0c365 100644
---- a/src/llhttp/http.ts
-+++ b/src/llhttp/http.ts
-@@ -460,11 +460,19 @@ export class HTTP {
-       .match([ ' ', '\t' ], n('header_value_discard_ws'))
-       .otherwise(checkContentLengthEmptiness);
- 
-+    // Multiple `Transfer-Encoding` headers should be treated as one, but with
-+    // values separate by a comma.
-+    //
-+    // See: https://tools.ietf.org/html/rfc7230#section-3.2.2
-+    const toTransferEncoding = this.unsetFlag(
-+      FLAGS.CHUNKED,
-+      'header_value_te_chunked');
-+
-     n('header_value_start')
-       .otherwise(this.load('header_state', {
-         [HEADER_STATE.UPGRADE]: this.setFlag(FLAGS.UPGRADE, fallback),
-         [HEADER_STATE.TRANSFER_ENCODING]: this.setFlag(
--          FLAGS.TRANSFER_ENCODING, 'header_value_te_chunked'),
-+          FLAGS.TRANSFER_ENCODING, toTransferEncoding),
-         [HEADER_STATE.CONTENT_LENGTH]: n('header_value_content_length_once'),
-         [HEADER_STATE.CONNECTION]: n('header_value_connection'),
-       }, 'header_value'));
-@@ -847,6 +855,11 @@ export class HTTP {
-     return span.start(span.end(this.node(next)));
-   }
- 
-+  private unsetFlag(flag: FLAGS, next: string | Node): Node {
-+    const p = this.llparse;
-+    return p.invoke(p.code.and('flags', ~flag), this.node(next));
-+  }
-+
-   private setFlag(flag: FLAGS, next: string | Node): Node {
-     const p = this.llparse;
-     return p.invoke(p.code.or('flags', flag), this.node(next));
-diff --git a/test/request/transfer-encoding.md b/test/request/transfer-encoding.md
-index a7d1681..b0891d6 100644
---- a/test/request/transfer-encoding.md
-+++ b/test/request/transfer-encoding.md
-@@ -353,6 +353,38 @@ off=106 headers complete method=3 v=1/1 flags=200 content_length=0
- off=106 error code=15 reason="Request has invalid `Transfer-Encoding`"
- ```
- 
-+## POST with `chunked` and duplicate transfer-encoding
-+
-+<!-- meta={"type": "request", "noScan": true} -->
-+```http
-+POST /post_identity_body_world?q=search#hey HTTP/1.1
-+Accept: */*
-+Transfer-Encoding: chunked
-+Transfer-Encoding: deflate
-+
-+World
-+```
-+
-+```log
-+off=0 message begin
-+off=5 len=38 span[url]="/post_identity_body_world?q=search#hey"
-+off=44 url complete
-+off=54 len=6 span[header_field]="Accept"
-+off=61 header_field complete
-+off=62 len=3 span[header_value]="*/*"
-+off=67 header_value complete
-+off=67 len=17 span[header_field]="Transfer-Encoding"
-+off=85 header_field complete
-+off=86 len=7 span[header_value]="chunked"
-+off=95 header_value complete
-+off=95 len=17 span[header_field]="Transfer-Encoding"
-+off=113 header_field complete
-+off=114 len=7 span[header_value]="deflate"
-+off=123 header_value complete
-+off=125 headers complete method=3 v=1/1 flags=200 content_length=0
-+off=125 error code=15 reason="Request has invalid `Transfer-Encoding`"
-+```
-+
- ## POST with `chunked` before other transfer-coding (lenient)
- 
- TODO(indutny): should we allow it even in lenient mode? (Consider disabling
-- 
2.39.1

Message #101 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>, Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 15/16] gnu: node-lts: Update to 18.14.0.
Date: Wed,  8 Feb 2023 22:05:30 +0100

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (node-lts): Update to 18.14.0.
[snippet]: Keep file deps/openssl/nodejs-openssl.cnf.
[arguments]<#:configure-flags>: Enable v8 snapshot compression.
<#:phases>: Adjust problematic tests to delete accordingly.
Patch additional file with hardcoded references to /bin/sh.
[native-inputs,inputs]: Replace openssl-1.1 with openssl.
---
 gnu/packages/node.scm | 40 ++++++++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index de847490a3..03dfa8875f 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -11,6 +11,7 @@
 ;;; Copyright © 2021 Simon Tournier <zimon.toutoune <at> gmail.com>
 ;;; Copyright © 2021 Guillaume Le Vaillant <glv <at> posteo.net>
 ;;; Copyright © 2021, 2022 Philip McGrath <philip <at> philipmcgrath.com>
+;;; Copyright © 2022 Hilton Chain <hako <at> ultrarare.space>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -737,23 +738,28 @@ (define-public llhttp-bootstrap
 (define-public node-lts
   (package
     (inherit node)
-    (version "14.19.3")
+    (version "18.14.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nodejs.org/dist/v" version
-                                  "/node-v" version ".tar.xz"))
+                                  "/node-v" version ".tar.gz"))
               (sha256
                (base32
-                "15691j5zhiikyamiwwd7f282g6d9acfhq91nrwx54xya38gmpx2w"))
+                "0sscc084lbh1008zzmibaxbl7y4n6cbsnlprisckr3fc3rbdj4sa"))
               (modules '((guix build utils)))
               (snippet
                `(begin
+                  ;; openssl.cnf is required for build.
+                  (for-each delete-file-recursively
+                            (find-files "deps/openssl"
+                                        (lambda (file stat)
+                                          (if (string-contains file "nodejs-openssl.cnf")
+                                              #f #t))))
                   ;; Remove bundled software, where possible
                   (for-each delete-file-recursively
                             '("deps/cares"
                               "deps/icu-small"
                               "deps/nghttp2"
-                              "deps/openssl"
                               "deps/zlib"))
                   (substitute* "Makefile"
                     ;; Remove references to bundled software.
@@ -769,7 +775,9 @@ (define-public node-lts
            "--shared-openssl"
            "--shared-zlib"
            "--shared-brotli"
-           "--with-intl=system-icu"))
+           "--with-intl=system-icu"
+           ;;Needed for correct snapshot checksums
+           "--v8-enable-snapshot-compression"))
        ((#:phases phases)
         `(modify-phases ,phases
            (replace 'set-bootstrap-host-rpath
@@ -802,23 +810,31 @@ (define-public node-lts
                                    libuv "/lib:"
                                    zlib "/lib"
                                    "'],"))))))
+           (add-after 'patch-hardcoded-program-references
+                      'patch-additional-hardcoded-program-references
+             (lambda* (#:key inputs #:allow-other-keys)
+               (substitute* "test/parallel/test-stdin-from-file-spawn.js"
+                 (("'/bin/sh'") (string-append
+                                 "'" (search-input-file inputs "/bin/sh")
+                                 "'")))))
            (replace 'delete-problematic-tests
              (lambda* (#:key inputs #:allow-other-keys)
                ;; FIXME: These tests fail in the build container, but they don't
                ;; seem to be indicative of real problems in practice.
                (for-each delete-file
-                         '("test/parallel/test-cluster-master-error.js"
-                           "test/parallel/test-cluster-master-kill.js"))
+                         '("test/parallel/test-cluster-primary-error.js"
+                           "test/parallel/test-cluster-primary-kill.js"))
 
                ;; These require a DNS resolver.
                (for-each delete-file
                          '("test/parallel/test-dns.js"
-                           "test/parallel/test-dns-lookupService-promises.js"))
+                           "test/parallel/test-dns-lookupService-promises.js"
+                           "test/parallel/test-net-socket-connect-without-cb.js"
+                           "test/parallel/test-tcp-wrap-listen.js"))
 
                ;; These tests require networking.
                (for-each delete-file
-                         '("test/parallel/test-https-agent-unref-socket.js"
-                           "test/parallel/test-corepack-yarn-install.js"))
+                         '("test/parallel/test-https-agent-unref-socket.js"))
 
                ;; This test is timing-sensitive, and fails sporadically on
                ;; slow, busy, or even very fast machines.
@@ -868,7 +884,7 @@ (define-public node-lts
            icu4c-71
            libuv-for-node
            `(,nghttp2 "lib")
-           openssl-1.1
+           openssl
            zlib
            ;; Regular build-time dependencies.
            perl
@@ -885,7 +901,7 @@ (define-public node-lts
            llhttp-bootstrap
            brotli
            `(,nghttp2 "lib")
-           openssl-1.1
+           openssl
            python-wrapper ;; for node-gyp (supports python3)
            zlib))))
 
-- 
2.39.1

Message #104 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>, Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v3 16/16] gnu: libnode: Use node-lts as base.
Date: Wed,  8 Feb 2023 22:05:31 +0100

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (libnode): Use node-lts as base.
* gnu/packages/cran.scm (r-v8)[arguments]<#:phases>: Adjusted accordingly.
---
 gnu/packages/cran.scm | 2 +-
 gnu/packages/node.scm | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/cran.scm b/gnu/packages/cran.scm
index 7ca7ab0f9a..3cbfe0c8b1 100644
--- a/gnu/packages/cran.scm
+++ b/gnu/packages/cran.scm
@@ -1097,7 +1097,7 @@ (define-public r-v8
                (("^PKG_LIBS=.*")
                 (string-append "PKG_LIBS="
                                (assoc-ref inputs "libnode")
-                               "/lib/libnode.so.64\n")))
+                               "/lib/libnode.so.108\n")))
              (setenv "INCLUDE_DIR"
                      (string-append
                       (assoc-ref inputs "libnode")
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index 03dfa8875f..070a5b070b 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -906,10 +906,10 @@ (define-public node-lts
            zlib))))
 
 (define-public libnode
-  (package/inherit node
+  (package/inherit node-lts
     (name "libnode")
     (arguments
-     (substitute-keyword-arguments (package-arguments node)
+     (substitute-keyword-arguments (package-arguments node-lts)
        ((#:configure-flags flags ''())
         `(cons* "--shared" "--without-npm" ,flags))
        ((#:phases phases '%standard-phases)
-- 
2.39.1

Message #107 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v4 01/16] gnu: node-acorn: Disable tests.
Date: Thu,  2 Mar 2023 23:53:34 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn): Explicitly disable tests.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 991113c05b..e89117beca 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -46,7 +46,8 @@ (define-public node-acorn
         (base32 "068h5gysz8bbslq31dva8f223rdf8l7w6nxcxjnv4zdprwkzkhaa"))))
     (build-system node-build-system)
     (arguments
-     '(#:phases
+     '(#:tests? #f
+       #:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'change-directory
            (lambda _
-- 
2.39.1

Message #110 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Ricardo Wurmus <rekado <at> elephly.net>, Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v4 00/16] Updating node-lts to 18.X
Date: Thu,  2 Mar 2023 23:53:33 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

To prevent bitrot, I rebased and built it all locally.

Changes in v4:
- node-lts to 18.14.2

Hilton Chain (4):
  gnu: libuv-for-node: Update to 1.44.2.
  gnu: llhttp-bootstrap: Update to 6.0.10.
  gnu: node-lts: Update to 18.14.2.
  gnu: libnode: Use node-lts as base.

Jelle Licht (12):
  gnu: node-acorn: Disable tests.
  gnu: node-acorn: Remove lifecycle script.
  gnu: node-acorn: Fix broken transpilation.
  gnu: node-buffer-crc32: Ignore development dependencies.
  gnu: node-crx3: Ignore development dependencies.
  gnu: node-minimist: Ignore development dependencies.
  gnu: node-pbf: Ignore development dependencies.
  gnu: node-protocol-buffers-schema: Ignore development dependencies.
  gnu: node-resolve-protobuf-schema: Ignore development dependencies.
  gnu: node-ieee754: Ignore development dependencies.
  gnu: node-yazl: Ignore development dependencies.
  gnu: node-uglify-js: Update to 3.14.2.

 gnu/local.mk                                  |   1 -
 gnu/packages/cran.scm                         |   2 +-
 gnu/packages/libevent.scm                     |   4 +-
 gnu/packages/node-xyz.scm                     | 110 +++++++++++++-----
 gnu/packages/node.scm                         |  49 +++++---
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ----------------
 gnu/packages/uglifyjs.scm                     |   4 +-
 7 files changed, 121 insertions(+), 149 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch

-- 
2.39.1

Message #113 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v4 02/16] gnu: node-acorn: Remove lifecycle script.
Date: Thu,  2 Mar 2023 23:53:35 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[arguments]<modules>: New argument.
<phases>: Patch out unused 'prepare' script that breaks dependents.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index e89117beca..e3d8c7ca19 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -47,11 +47,35 @@ (define-public node-acorn
     (build-system node-build-system)
     (arguments
      '(#:tests? #f
+       #:modules
+       ((guix build node-build-system)
+        (srfi srfi-1)
+        (ice-9 match)
+        (guix build utils))
        #:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'change-directory
            (lambda _
-             (chdir "acorn"))))))
+             (chdir "acorn")))
+         (add-before 'configure 'avoid-prepare-scripts
+           (lambda _
+             ;; We need to remove the prepare script from "package.json", as
+             ;; it would try to use the build environment and would block the
+             ;; automatic building by other packages making use of node-acorn.
+             ;; TODO: Add utility function
+             (with-atomic-json-file-replacement "package.json"
+               (match-lambda
+                 (('@ . pkg-meta-alist)
+                  (cons '@ (map (match-lambda
+                                  (("scripts" @ . scripts-alist)
+                                   `("scripts" @ ,@(filter (match-lambda
+                                                             (("prepare" . _)
+                                                              #f)
+                                                             (_
+                                                              #t))
+                                                           scripts-alist)))
+                                  (other other))
+                                pkg-meta-alist))))))))))
     (home-page "https://github.com/acornjs/acorn/tree/master/acorn")
     (synopsis "Javascript-based Javascript parser")
     (description "Acornjs is a Javascript parser with many options and an
-- 
2.39.1

Message #116 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v4 03/16] gnu: node-acorn: Fix broken transpilation.
Date: Thu,  2 Mar 2023 23:53:36 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[native-inputs]: Add `esbuild'.
[arguments]<phases>: Replace build phase by custom `esbuild' invocations.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index e3d8c7ca19..d75ccc199a 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2021 Charles <charles.b.jackson <at> protonmail.com>
 ;;; Copyright © 2021 Philip McGrath <philip <at> philipmcgrath.com>
 ;;; Copyright © 2022 Nicolas Graves <ngraves <at> ngraves.fr>
+;;; Copyright © 2023 Jelle Licht <jlicht <at> fsfe.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -75,7 +76,30 @@ (define-public node-acorn
                                                               #t))
                                                            scripts-alist)))
                                   (other other))
-                                pkg-meta-alist))))))))))
+                                pkg-meta-alist)))))))
+         (replace 'build
+           (lambda* (#:key inputs native-inputs #:allow-other-keys)
+             (let ((esbuild (search-input-file (or native-inputs inputs)
+                                        "/bin/esbuild")))
+               (invoke esbuild
+                     "src/index.js"
+                     "--outfile=dist/acorn.js"
+                     "--format=cjs"
+                     "--bundle"
+                     "--platform=node")
+               (invoke esbuild
+                     "src/index.js"
+                     "--outfile=dist/acorn.mjs"
+                     "--format=esm"
+                     "--bundle"
+                     "--platform=node")
+               (invoke esbuild
+                     "src/bin/acorn.js"
+                     "--outfile=dist/bin.js"
+                     "--format=cjs"
+                     "--platform=node")))))))
+    (native-inputs
+     (list esbuild))
     (home-page "https://github.com/acornjs/acorn/tree/master/acorn")
     (synopsis "Javascript-based Javascript parser")
     (description "Acornjs is a Javascript parser with many options and an
-- 
2.39.1

Message #119 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v4 04/16] gnu: node-buffer-crc32: Ignore development
 dependencies.
Date: Thu,  2 Mar 2023 23:53:37 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[arguments]<phases>: Explicitly patch
out development dependencies.  Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index d75ccc199a..96901e7bf8 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -123,10 +123,9 @@ (define-public node-buffer-crc32
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("tap")))))))
     (home-page "https://github.com/brianloveswords/buffer-crc32")
     (synopsis "CRC32 implementation in Javascript")
     (description
-- 
2.39.1

Message #122 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v4 05/16] gnu: node-crx3: Ignore development dependencies.
Date: Thu,  2 Mar 2023 23:53:38 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-crx3)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 96901e7bf8..00d93d3185 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -179,10 +179,16 @@ (define-public node-crx3
                       (substitute* "lib/configuration.js"
                         (("mri")
                          "minimist"))))
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("c8"
+                                             "docdash"
+                                             "eslint"
+                                             "eslint-plugin-jsdoc"
+                                             "jsdoc"
+                                             "tap-diff"
+                                             "tape"
+                                             "tape-catch")))))))
     (inputs (list node-minimist node-pbf node-yazl))
     (home-page "https://github.com/ahwayakchih/crx3")
     (synopsis "Create CRXv3 browser extensions with Javascript")
-- 
2.39.1

Message #125 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v4 06/16] gnu: node-minimist: Ignore development dependencies.
Date: Thu,  2 Mar 2023 23:53:39 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-minimist)[arguments]<phases>: Explicitly
patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 00d93d3185..847004501a 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -313,10 +313,9 @@ (define-public node-minimist
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("covert" "tap" "tape")))))))
     (home-page "https://github.com/substack/minimist")
     (synopsis "Parse CLI arguments in Javascript")
     (description "This package can scan for CLI flags and arguments in
-- 
2.39.1

Message #128 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v4 07/16] gnu: node-pbf: Ignore development dependencies.
Date: Thu,  2 Mar 2023 23:53:40 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-pbf)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 847004501a..680be0ad3f 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -364,10 +364,19 @@ (define-public node-pbf
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies
+                       '("benchmark"
+                         "browserify"
+                         "eslint"
+                         "eslint-config-mourner"
+                         "mkdirp"
+                         "protobufjs"
+                         "protocol-buffers"
+                         "tap"
+                         "tile-stats-runner"
+                         "uglify-js")))))))
     (inputs (list node-ieee754 node-resolve-protobuf-schema))
     (home-page "https://github.com/mapbox/pbf")
     (synopsis "Decode and encode protocol buffers in Javascript")
-- 
2.39.1

Message #131 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v4 08/16] gnu: node-protocol-buffers-schema: Ignore
 development dependencies.
Date: Thu,  2 Mar 2023 23:53:41 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-protocol-buffers-schema)[arguments]<phases>:
Explicitly patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 680be0ad3f..1b581cf3a7 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -405,10 +405,9 @@ (define-public node-protocol-buffers-schema
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("standard" "tape")))))))
     (home-page "https://github.com/mafintosh/protocol-buffers-schema")
     (synopsis "Protocol buffers schema parser written in Javascript")
     (description "This package provides a protocol buffers schema parser
-- 
2.39.1

Message #134 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v4 09/16] gnu: node-resolve-protobuf-schema: Ignore
 development dependencies.
Date: Thu,  2 Mar 2023 23:53:42 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-resolve-protobuf-schema)[arguments]<phases>:
Explicitly patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 1b581cf3a7..cbf2665940 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -431,10 +431,9 @@ (define-public node-resolve-protobuf-schema
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("standard" "tape")))))))
     (inputs (list node-protocol-buffers-schema))
     (home-page "https://github.com/mafintosh/resolve-protobuf-schema")
     (synopsis "Resolve protobuf imports")
-- 
2.39.1

Message #137 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v4 10/16] gnu: node-ieee754: Ignore development dependencies.
Date: Thu,  2 Mar 2023 23:53:43 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-ieee754)[arguments]<phases>: Explicitly
patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index cbf2665940..628fe41d28 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -623,10 +623,9 @@ (define-public node-ieee754
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("airtap" "standard" "tape")))))))
     (home-page "https://github.com/feross/ieee754")
     (synopsis "Read/write IEEE754 floating point numbers in Javascript")
     (description "This package can read and write IEEE754 floating point
-- 
2.39.1

Message #140 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v4 11/16] gnu: node-yazl: Ignore development dependencies.
Date: Thu,  2 Mar 2023 23:53:44 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-yazl)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 628fe41d28..b85507f52f 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -1588,10 +1588,9 @@ (define-public node-yazl
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("airtap" "bl" "istanbul" "yauzl")))))))
     (inputs (list node-buffer-crc32))
     (home-page "https://github.com/thejoshwolfe/yazl")
     (synopsis "Yet another zip library for node")
-- 
2.39.1

Message #143 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v4 12/16] gnu: node-uglify-js: Update to 3.14.2.
Date: Thu,  2 Mar 2023 23:53:45 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/uglifyjs.scm (node-uglify-js): Update to 3.14.2.
---

(no changes since v1)

 gnu/packages/uglifyjs.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/uglifyjs.scm b/gnu/packages/uglifyjs.scm
index b65d52b8df..1bd8bb6326 100644
--- a/gnu/packages/uglifyjs.scm
+++ b/gnu/packages/uglifyjs.scm
@@ -25,7 +25,7 @@ (define-module (gnu packages uglifyjs)
 (define-public node-uglify-js
   (package
     (name "node-uglify-js")
-    (version "3.13.9")
+    (version "3.14.2")
     (source
      (origin
        (method git-fetch)
@@ -34,7 +34,7 @@ (define-public node-uglify-js
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "0q1f91xwwm829cl5v727d4qkxy4yh7wri3pgl89f0m3a4y1n7hi4"))))
+        (base32 "1jraqpwzga4vbgq3xcn08jcfc87pm6nik7vpxvxa4rfjvz70a6k7"))))
     (build-system node-build-system)
     (native-inputs
      (list node-acorn node-semver))
-- 
2.39.1

Message #146 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v4 13/16] gnu: libuv-for-node: Update to 1.44.2.
Date: Thu,  2 Mar 2023 23:53:46 +0100

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/libevent.scm (libuv-for-node): Update to 1.44.2.
---

(no changes since v1)

 gnu/packages/libevent.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/libevent.scm b/gnu/packages/libevent.scm
index f9722e4469..fa1e76b347 100644
--- a/gnu/packages/libevent.scm
+++ b/gnu/packages/libevent.scm
@@ -147,14 +147,14 @@ (define-public libuv-for-node
   (package
     (inherit libuv)
     (name "libuv")
-    (version "1.42.0")
+    (version "1.44.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://dist.libuv.org/dist/v" version
                                   "/libuv-v" version ".tar.gz"))
               (sha256
                (base32
-                "0wpb9pz3r8nksnrf4zbixj2kk9whr7abi45ydrwyv2js2ljrc4j3"))))
+                "1d1wy1061cf2mfygr2j6jbm0da2mhsf0l9yq4rjkqrsmijbdrz6c"))))
     (properties '((hidden? . #t)))))
 
 (define-public libuv-julia
-- 
2.39.1

Message #149 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v4 14/16] gnu: llhttp-bootstrap: Update to 6.0.10.
Date: Thu,  2 Mar 2023 23:53:47 +0100

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (llhttp-bootstrap): Update to 6.0.10.
* gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch: Remove file.
* gnu/local.mk: Remove it.
---

(no changes since v1)

 gnu/local.mk                                  |   1 -
 gnu/packages/node.scm                         |   5 +-
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ------------------
 3 files changed, 2 insertions(+), 104 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 69781a0b8b..aab630a216 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1489,7 +1489,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/linuxdcpp-openssl-1.1.patch		\
   %D%/packages/patches/lirc-localstatedir.patch			\
   %D%/packages/patches/lirc-reproducible-build.patch		\
-  %D%/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch	\
   %D%/packages/patches/llvm-3.5-fix-clang-build-with-gcc5.patch	\
   %D%/packages/patches/llvm-3.6-fix-build-with-gcc-10.patch	\
   %D%/packages/patches/llvm-3.x.1-fix-build-with-gcc.patch	\
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index be39f3b25a..de847490a3 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -668,7 +668,7 @@ (define-public node-llparse-bootstrap
 (define-public llhttp-bootstrap
   (package
     (name "llhttp")
-    (version "2.1.4")
+    (version "6.0.10")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -677,8 +677,7 @@ (define-public llhttp-bootstrap
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "115mwyds9655p76lhglxg2blc1ksgrix6zhigaxnc2q6syy3pa6x"))
-              (patches (search-patches "llhttp-bootstrap-CVE-2020-8287.patch"))
+                "0izwqa77y007xdi0bj3ccw821n19rz89mz4hx4lg99fwkwylr6x8"))
               (modules '((guix build utils)))
               (snippet
                '(begin
diff --git a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch b/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
deleted file mode 100644
index 215c920e53..0000000000
--- a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-This patch comes from upstream.  It corresponds to a patch applied to
-the generated C source code for llhttp included in Node.js 14.16.0
-(see commit 641f786bb1a1f6eb1ff8750782ed939780f2b31a).  That commit
-fixes CVE-2020-8287.  With this patch, the output of our
-llhttp-bootstrap package matches the files included in Node.js 14.16.0
-exactly.
-
-commit e9b36ea64709c35ca66094d5cf3787f444029601
-Author: Fedor Indutny <fedor <at> indutny.com>
-Date:   Sat Oct 10 19:56:01 2020 -0700
-
-    http: unset `F_CHUNKED` on new `Transfer-Encoding`
-    
-    Duplicate `Transfer-Encoding` header should be a treated as a single,
-    but with original header values concatenated with a comma separator. In
-    the light of this, even if the past `Transfer-Encoding` ended with
-    `chunked`, we should be not let the `F_CHUNKED` to leak into the next
-    header, because mere presence of another header indicates that `chunked`
-    is not the last transfer-encoding token.
-
-diff --git a/src/llhttp/http.ts b/src/llhttp/http.ts
-index f4f1a6e..0a0c365 100644
---- a/src/llhttp/http.ts
-+++ b/src/llhttp/http.ts
-@@ -460,11 +460,19 @@ export class HTTP {
-       .match([ ' ', '\t' ], n('header_value_discard_ws'))
-       .otherwise(checkContentLengthEmptiness);
- 
-+    // Multiple `Transfer-Encoding` headers should be treated as one, but with
-+    // values separate by a comma.
-+    //
-+    // See: https://tools.ietf.org/html/rfc7230#section-3.2.2
-+    const toTransferEncoding = this.unsetFlag(
-+      FLAGS.CHUNKED,
-+      'header_value_te_chunked');
-+
-     n('header_value_start')
-       .otherwise(this.load('header_state', {
-         [HEADER_STATE.UPGRADE]: this.setFlag(FLAGS.UPGRADE, fallback),
-         [HEADER_STATE.TRANSFER_ENCODING]: this.setFlag(
--          FLAGS.TRANSFER_ENCODING, 'header_value_te_chunked'),
-+          FLAGS.TRANSFER_ENCODING, toTransferEncoding),
-         [HEADER_STATE.CONTENT_LENGTH]: n('header_value_content_length_once'),
-         [HEADER_STATE.CONNECTION]: n('header_value_connection'),
-       }, 'header_value'));
-@@ -847,6 +855,11 @@ export class HTTP {
-     return span.start(span.end(this.node(next)));
-   }
- 
-+  private unsetFlag(flag: FLAGS, next: string | Node): Node {
-+    const p = this.llparse;
-+    return p.invoke(p.code.and('flags', ~flag), this.node(next));
-+  }
-+
-   private setFlag(flag: FLAGS, next: string | Node): Node {
-     const p = this.llparse;
-     return p.invoke(p.code.or('flags', flag), this.node(next));
-diff --git a/test/request/transfer-encoding.md b/test/request/transfer-encoding.md
-index a7d1681..b0891d6 100644
---- a/test/request/transfer-encoding.md
-+++ b/test/request/transfer-encoding.md
-@@ -353,6 +353,38 @@ off=106 headers complete method=3 v=1/1 flags=200 content_length=0
- off=106 error code=15 reason="Request has invalid `Transfer-Encoding`"
- ```
- 
-+## POST with `chunked` and duplicate transfer-encoding
-+
-+<!-- meta={"type": "request", "noScan": true} -->
-+```http
-+POST /post_identity_body_world?q=search#hey HTTP/1.1
-+Accept: */*
-+Transfer-Encoding: chunked
-+Transfer-Encoding: deflate
-+
-+World
-+```
-+
-+```log
-+off=0 message begin
-+off=5 len=38 span[url]="/post_identity_body_world?q=search#hey"
-+off=44 url complete
-+off=54 len=6 span[header_field]="Accept"
-+off=61 header_field complete
-+off=62 len=3 span[header_value]="*/*"
-+off=67 header_value complete
-+off=67 len=17 span[header_field]="Transfer-Encoding"
-+off=85 header_field complete
-+off=86 len=7 span[header_value]="chunked"
-+off=95 header_value complete
-+off=95 len=17 span[header_field]="Transfer-Encoding"
-+off=113 header_field complete
-+off=114 len=7 span[header_value]="deflate"
-+off=123 header_value complete
-+off=125 headers complete method=3 v=1/1 flags=200 content_length=0
-+off=125 error code=15 reason="Request has invalid `Transfer-Encoding`"
-+```
-+
- ## POST with `chunked` before other transfer-coding (lenient)
- 
- TODO(indutny): should we allow it even in lenient mode? (Consider disabling
-- 
2.39.1

Message #152 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v4 15/16] gnu: node-lts: Update to 18.14.2.
Date: Thu,  2 Mar 2023 23:53:48 +0100

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (node-lts): Update to 18.14.2.
[snippet]: Keep file deps/openssl/nodejs-openssl.cnf.
[arguments]<#:configure-flags>: Enable v8 snapshot compression.
<#:phases>: Adjust problematic tests to delete accordingly.
Patch additional file with hardcoded references to /bin/sh.
[native-inputs,inputs]: Replace openssl-1.1 with openssl.
---

(no changes since v1)

 gnu/packages/node.scm | 40 ++++++++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index de847490a3..ce05276180 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -11,6 +11,7 @@
 ;;; Copyright © 2021 Simon Tournier <zimon.toutoune <at> gmail.com>
 ;;; Copyright © 2021 Guillaume Le Vaillant <glv <at> posteo.net>
 ;;; Copyright © 2021, 2022 Philip McGrath <philip <at> philipmcgrath.com>
+;;; Copyright © 2022 Hilton Chain <hako <at> ultrarare.space>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -737,23 +738,28 @@ (define-public llhttp-bootstrap
 (define-public node-lts
   (package
     (inherit node)
-    (version "14.19.3")
+    (version "18.14.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nodejs.org/dist/v" version
-                                  "/node-v" version ".tar.xz"))
+                                  "/node-v" version ".tar.gz"))
               (sha256
                (base32
-                "15691j5zhiikyamiwwd7f282g6d9acfhq91nrwx54xya38gmpx2w"))
+                "0ll2j4j46ygvs39aykxr7dvi7c4pm9f34rgyxc2dkvz3g6wfn2l5"))
               (modules '((guix build utils)))
               (snippet
                `(begin
+                  ;; openssl.cnf is required for build.
+                  (for-each delete-file-recursively
+                            (find-files "deps/openssl"
+                                        (lambda (file stat)
+                                          (if (string-contains file "nodejs-openssl.cnf")
+                                              #f #t))))
                   ;; Remove bundled software, where possible
                   (for-each delete-file-recursively
                             '("deps/cares"
                               "deps/icu-small"
                               "deps/nghttp2"
-                              "deps/openssl"
                               "deps/zlib"))
                   (substitute* "Makefile"
                     ;; Remove references to bundled software.
@@ -769,7 +775,9 @@ (define-public node-lts
            "--shared-openssl"
            "--shared-zlib"
            "--shared-brotli"
-           "--with-intl=system-icu"))
+           "--with-intl=system-icu"
+           ;;Needed for correct snapshot checksums
+           "--v8-enable-snapshot-compression"))
        ((#:phases phases)
         `(modify-phases ,phases
            (replace 'set-bootstrap-host-rpath
@@ -802,23 +810,31 @@ (define-public node-lts
                                    libuv "/lib:"
                                    zlib "/lib"
                                    "'],"))))))
+           (add-after 'patch-hardcoded-program-references
+                      'patch-additional-hardcoded-program-references
+             (lambda* (#:key inputs #:allow-other-keys)
+               (substitute* "test/parallel/test-stdin-from-file-spawn.js"
+                 (("'/bin/sh'") (string-append
+                                 "'" (search-input-file inputs "/bin/sh")
+                                 "'")))))
            (replace 'delete-problematic-tests
              (lambda* (#:key inputs #:allow-other-keys)
                ;; FIXME: These tests fail in the build container, but they don't
                ;; seem to be indicative of real problems in practice.
                (for-each delete-file
-                         '("test/parallel/test-cluster-master-error.js"
-                           "test/parallel/test-cluster-master-kill.js"))
+                         '("test/parallel/test-cluster-primary-error.js"
+                           "test/parallel/test-cluster-primary-kill.js"))
 
                ;; These require a DNS resolver.
                (for-each delete-file
                          '("test/parallel/test-dns.js"
-                           "test/parallel/test-dns-lookupService-promises.js"))
+                           "test/parallel/test-dns-lookupService-promises.js"
+                           "test/parallel/test-net-socket-connect-without-cb.js"
+                           "test/parallel/test-tcp-wrap-listen.js"))
 
                ;; These tests require networking.
                (for-each delete-file
-                         '("test/parallel/test-https-agent-unref-socket.js"
-                           "test/parallel/test-corepack-yarn-install.js"))
+                         '("test/parallel/test-https-agent-unref-socket.js"))
 
                ;; This test is timing-sensitive, and fails sporadically on
                ;; slow, busy, or even very fast machines.
@@ -868,7 +884,7 @@ (define-public node-lts
            icu4c-71
            libuv-for-node
            `(,nghttp2 "lib")
-           openssl-1.1
+           openssl
            zlib
            ;; Regular build-time dependencies.
            perl
@@ -885,7 +901,7 @@ (define-public node-lts
            llhttp-bootstrap
            brotli
            `(,nghttp2 "lib")
-           openssl-1.1
+           openssl
            python-wrapper ;; for node-gyp (supports python3)
            zlib))))
 
-- 
2.39.1

Message #155 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Ricardo Wurmus <rekado <at> elephly.net>, Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v4 16/16] gnu: libnode: Use node-lts as base.
Date: Thu,  2 Mar 2023 23:53:49 +0100

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (libnode): Use node-lts as base.
* gnu/packages/cran.scm (r-v8)[arguments]<#:phases>: Adjusted accordingly.

---

(no changes since v1)

 gnu/packages/cran.scm | 2 +-
 gnu/packages/node.scm | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/cran.scm b/gnu/packages/cran.scm
index 16314b33d7..d21a207f16 100644
--- a/gnu/packages/cran.scm
+++ b/gnu/packages/cran.scm
@@ -1304,7 +1304,7 @@ (define-public r-v8
                (("^PKG_LIBS=.*")
                 (string-append "PKG_LIBS="
                                (assoc-ref inputs "libnode")
-                               "/lib/libnode.so.64\n")))
+                               "/lib/libnode.so.108\n")))
              (setenv "INCLUDE_DIR"
                      (string-append
                       (assoc-ref inputs "libnode")
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index ce05276180..7a2eb5f280 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -906,10 +906,10 @@ (define-public node-lts
            zlib))))
 
 (define-public libnode
-  (package/inherit node
+  (package/inherit node-lts
     (name "libnode")
     (arguments
-     (substitute-keyword-arguments (package-arguments node)
+     (substitute-keyword-arguments (package-arguments node-lts)
        ((#:configure-flags flags ''())
         `(cons* "--shared" "--without-npm" ,flags))
        ((#:phases phases '%standard-phases)
-- 
2.39.1

Message #158 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v5 01/17] build-system: node: Use `--install-links' with `npm
 install'.
Date: Wed, 15 Mar 2023 01:55:16 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

Later versions of npm need to explicitly install a copy of local dependencies,
instead of only a symlink.

* guix/build/node-build-system.scm (configure): Add `--install-links' to npm
install invocation.
(install): Ditto.
---

(no changes since v1)

 guix/build/node-build-system.scm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/guix/build/node-build-system.scm b/guix/build/node-build-system.scm
index bee3792e93..93f7efbb2b 100644
--- a/guix/build/node-build-system.scm
+++ b/guix/build/node-build-system.scm
@@ -223,7 +223,7 @@ (define* (delete-lockfiles #:key inputs #:allow-other-keys)
 
 (define* (configure #:key outputs inputs #:allow-other-keys)
   (let ((npm (string-append (assoc-ref inputs "node") "/bin/npm")))
-    (invoke npm "--offline" "--ignore-scripts" "install")
+    (invoke npm "--offline" "--ignore-scripts" "--install-links" "install")
     #t))
 
 (define* (build #:key inputs #:allow-other-keys)
@@ -262,6 +262,7 @@ (define* (install #:key outputs inputs #:allow-other-keys)
             "--offline"
             "--loglevel" "info"
             "--production"
+            "--install-links"
             "install" "../package.tgz")
     #t))
 
-- 
2.39.2

Message #161 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v5 02/17] gnu: node-acorn: Disable tests.
Date: Wed, 15 Mar 2023 01:55:17 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn): Explicitly disable tests.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 991113c05b..e89117beca 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -46,7 +46,8 @@ (define-public node-acorn
         (base32 "068h5gysz8bbslq31dva8f223rdf8l7w6nxcxjnv4zdprwkzkhaa"))))
     (build-system node-build-system)
     (arguments
-     '(#:phases
+     '(#:tests? #f
+       #:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'change-directory
            (lambda _
-- 
2.39.2

Message #164 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Ricardo Wurmus <rekado <at> elephly.net>, Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v5 00/17] Updating node-lts to 18.X
Date: Wed, 15 Mar 2023 01:55:15 +0100

From: Jelle Licht <jlicht <at> fsfe.org>



Changes in v5:
- node build system needs an additional --install-links to work with newer npm.
- node-lts to 18.15.0

Hilton Chain (4):
  gnu: libuv-for-node: Update to 1.44.2.
  gnu: llhttp-bootstrap: Update to 6.0.10.
  gnu: node-lts: Update to 18.15.0.
  gnu: libnode: Use node-lts as base.

Jelle Licht (13):
  build-system: node: Use `--install-links' with `npm install'.
  gnu: node-acorn: Disable tests.
  gnu: node-acorn: Remove lifecycle script.
  gnu: node-acorn: Fix broken transpilation.
  gnu: node-buffer-crc32: Ignore development dependencies.
  gnu: node-crx3: Ignore development dependencies.
  gnu: node-minimist: Ignore development dependencies.
  gnu: node-pbf: Ignore development dependencies.
  gnu: node-protocol-buffers-schema: Ignore development dependencies.
  gnu: node-resolve-protobuf-schema: Ignore development dependencies.
  gnu: node-ieee754: Ignore development dependencies.
  gnu: node-yazl: Ignore development dependencies.
  gnu: node-uglify-js: Update to 3.14.2.

 gnu/local.mk                                  |   1 -
 gnu/packages/cran.scm                         |   2 +-
 gnu/packages/libevent.scm                     |   4 +-
 gnu/packages/node-xyz.scm                     | 110 +++++++++++++-----
 gnu/packages/node.scm                         |  49 +++++---
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ----------------
 gnu/packages/uglifyjs.scm                     |   4 +-
 guix/build/node-build-system.scm              |   3 +-
 8 files changed, 123 insertions(+), 150 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch

-- 
2.39.2

Message #167 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v5 03/17] gnu: node-acorn: Remove lifecycle script.
Date: Wed, 15 Mar 2023 01:55:18 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[arguments]<modules>: New argument.
<phases>: Patch out unused 'prepare' script that breaks dependents.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index e89117beca..e3d8c7ca19 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -47,11 +47,35 @@ (define-public node-acorn
     (build-system node-build-system)
     (arguments
      '(#:tests? #f
+       #:modules
+       ((guix build node-build-system)
+        (srfi srfi-1)
+        (ice-9 match)
+        (guix build utils))
        #:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'change-directory
            (lambda _
-             (chdir "acorn"))))))
+             (chdir "acorn")))
+         (add-before 'configure 'avoid-prepare-scripts
+           (lambda _
+             ;; We need to remove the prepare script from "package.json", as
+             ;; it would try to use the build environment and would block the
+             ;; automatic building by other packages making use of node-acorn.
+             ;; TODO: Add utility function
+             (with-atomic-json-file-replacement "package.json"
+               (match-lambda
+                 (('@ . pkg-meta-alist)
+                  (cons '@ (map (match-lambda
+                                  (("scripts" @ . scripts-alist)
+                                   `("scripts" @ ,@(filter (match-lambda
+                                                             (("prepare" . _)
+                                                              #f)
+                                                             (_
+                                                              #t))
+                                                           scripts-alist)))
+                                  (other other))
+                                pkg-meta-alist))))))))))
     (home-page "https://github.com/acornjs/acorn/tree/master/acorn")
     (synopsis "Javascript-based Javascript parser")
     (description "Acornjs is a Javascript parser with many options and an
-- 
2.39.2

Message #170 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v5 04/17] gnu: node-acorn: Fix broken transpilation.
Date: Wed, 15 Mar 2023 01:55:19 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[native-inputs]: Add `esbuild'.
[arguments]<phases>: Replace build phase by custom `esbuild' invocations.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index e3d8c7ca19..d75ccc199a 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2021 Charles <charles.b.jackson <at> protonmail.com>
 ;;; Copyright © 2021 Philip McGrath <philip <at> philipmcgrath.com>
 ;;; Copyright © 2022 Nicolas Graves <ngraves <at> ngraves.fr>
+;;; Copyright © 2023 Jelle Licht <jlicht <at> fsfe.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -75,7 +76,30 @@ (define-public node-acorn
                                                               #t))
                                                            scripts-alist)))
                                   (other other))
-                                pkg-meta-alist))))))))))
+                                pkg-meta-alist)))))))
+         (replace 'build
+           (lambda* (#:key inputs native-inputs #:allow-other-keys)
+             (let ((esbuild (search-input-file (or native-inputs inputs)
+                                        "/bin/esbuild")))
+               (invoke esbuild
+                     "src/index.js"
+                     "--outfile=dist/acorn.js"
+                     "--format=cjs"
+                     "--bundle"
+                     "--platform=node")
+               (invoke esbuild
+                     "src/index.js"
+                     "--outfile=dist/acorn.mjs"
+                     "--format=esm"
+                     "--bundle"
+                     "--platform=node")
+               (invoke esbuild
+                     "src/bin/acorn.js"
+                     "--outfile=dist/bin.js"
+                     "--format=cjs"
+                     "--platform=node")))))))
+    (native-inputs
+     (list esbuild))
     (home-page "https://github.com/acornjs/acorn/tree/master/acorn")
     (synopsis "Javascript-based Javascript parser")
     (description "Acornjs is a Javascript parser with many options and an
-- 
2.39.2

Message #173 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v5 05/17] gnu: node-buffer-crc32: Ignore development
 dependencies.
Date: Wed, 15 Mar 2023 01:55:20 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[arguments]<phases>: Explicitly patch
out development dependencies.  Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index d75ccc199a..96901e7bf8 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -123,10 +123,9 @@ (define-public node-buffer-crc32
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("tap")))))))
     (home-page "https://github.com/brianloveswords/buffer-crc32")
     (synopsis "CRC32 implementation in Javascript")
     (description
-- 
2.39.2

Message #176 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v5 06/17] gnu: node-crx3: Ignore development dependencies.
Date: Wed, 15 Mar 2023 01:55:21 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-crx3)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 96901e7bf8..00d93d3185 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -179,10 +179,16 @@ (define-public node-crx3
                       (substitute* "lib/configuration.js"
                         (("mri")
                          "minimist"))))
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("c8"
+                                             "docdash"
+                                             "eslint"
+                                             "eslint-plugin-jsdoc"
+                                             "jsdoc"
+                                             "tap-diff"
+                                             "tape"
+                                             "tape-catch")))))))
     (inputs (list node-minimist node-pbf node-yazl))
     (home-page "https://github.com/ahwayakchih/crx3")
     (synopsis "Create CRXv3 browser extensions with Javascript")
-- 
2.39.2

Message #179 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v5 07/17] gnu: node-minimist: Ignore development dependencies.
Date: Wed, 15 Mar 2023 01:55:22 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-minimist)[arguments]<phases>: Explicitly
patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 00d93d3185..847004501a 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -313,10 +313,9 @@ (define-public node-minimist
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("covert" "tap" "tape")))))))
     (home-page "https://github.com/substack/minimist")
     (synopsis "Parse CLI arguments in Javascript")
     (description "This package can scan for CLI flags and arguments in
-- 
2.39.2

Message #182 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v5 08/17] gnu: node-pbf: Ignore development dependencies.
Date: Wed, 15 Mar 2023 01:55:23 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-pbf)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 847004501a..680be0ad3f 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -364,10 +364,19 @@ (define-public node-pbf
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies
+                       '("benchmark"
+                         "browserify"
+                         "eslint"
+                         "eslint-config-mourner"
+                         "mkdirp"
+                         "protobufjs"
+                         "protocol-buffers"
+                         "tap"
+                         "tile-stats-runner"
+                         "uglify-js")))))))
     (inputs (list node-ieee754 node-resolve-protobuf-schema))
     (home-page "https://github.com/mapbox/pbf")
     (synopsis "Decode and encode protocol buffers in Javascript")
-- 
2.39.2

Message #185 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v5 09/17] gnu: node-protocol-buffers-schema: Ignore
 development dependencies.
Date: Wed, 15 Mar 2023 01:55:24 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-protocol-buffers-schema)[arguments]<phases>:
Explicitly patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 680be0ad3f..1b581cf3a7 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -405,10 +405,9 @@ (define-public node-protocol-buffers-schema
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("standard" "tape")))))))
     (home-page "https://github.com/mafintosh/protocol-buffers-schema")
     (synopsis "Protocol buffers schema parser written in Javascript")
     (description "This package provides a protocol buffers schema parser
-- 
2.39.2

Message #188 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v5 10/17] gnu: node-resolve-protobuf-schema: Ignore
 development dependencies.
Date: Wed, 15 Mar 2023 01:55:25 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-resolve-protobuf-schema)[arguments]<phases>:
Explicitly patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 1b581cf3a7..cbf2665940 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -431,10 +431,9 @@ (define-public node-resolve-protobuf-schema
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("standard" "tape")))))))
     (inputs (list node-protocol-buffers-schema))
     (home-page "https://github.com/mafintosh/resolve-protobuf-schema")
     (synopsis "Resolve protobuf imports")
-- 
2.39.2

Message #191 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v5 11/17] gnu: node-ieee754: Ignore development dependencies.
Date: Wed, 15 Mar 2023 01:55:26 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-ieee754)[arguments]<phases>: Explicitly
patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index cbf2665940..628fe41d28 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -623,10 +623,9 @@ (define-public node-ieee754
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("airtap" "standard" "tape")))))))
     (home-page "https://github.com/feross/ieee754")
     (synopsis "Read/write IEEE754 floating point numbers in Javascript")
     (description "This package can read and write IEEE754 floating point
-- 
2.39.2

Message #194 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v5 12/17] gnu: node-yazl: Ignore development dependencies.
Date: Wed, 15 Mar 2023 01:55:27 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-yazl)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 628fe41d28..b85507f52f 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -1588,10 +1588,9 @@ (define-public node-yazl
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("airtap" "bl" "istanbul" "yauzl")))))))
     (inputs (list node-buffer-crc32))
     (home-page "https://github.com/thejoshwolfe/yazl")
     (synopsis "Yet another zip library for node")
-- 
2.39.2

Message #197 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v5 13/17] gnu: node-uglify-js: Update to 3.14.2.
Date: Wed, 15 Mar 2023 01:55:28 +0100

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/uglifyjs.scm (node-uglify-js): Update to 3.14.2.
---

(no changes since v1)

 gnu/packages/uglifyjs.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/uglifyjs.scm b/gnu/packages/uglifyjs.scm
index b65d52b8df..1bd8bb6326 100644
--- a/gnu/packages/uglifyjs.scm
+++ b/gnu/packages/uglifyjs.scm
@@ -25,7 +25,7 @@ (define-module (gnu packages uglifyjs)
 (define-public node-uglify-js
   (package
     (name "node-uglify-js")
-    (version "3.13.9")
+    (version "3.14.2")
     (source
      (origin
        (method git-fetch)
@@ -34,7 +34,7 @@ (define-public node-uglify-js
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "0q1f91xwwm829cl5v727d4qkxy4yh7wri3pgl89f0m3a4y1n7hi4"))))
+        (base32 "1jraqpwzga4vbgq3xcn08jcfc87pm6nik7vpxvxa4rfjvz70a6k7"))))
     (build-system node-build-system)
     (native-inputs
      (list node-acorn node-semver))
-- 
2.39.2

Message #200 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v5 14/17] gnu: libuv-for-node: Update to 1.44.2.
Date: Wed, 15 Mar 2023 01:55:29 +0100

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/libevent.scm (libuv-for-node): Update to 1.44.2.
---

(no changes since v1)

 gnu/packages/libevent.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/libevent.scm b/gnu/packages/libevent.scm
index f9722e4469..fa1e76b347 100644
--- a/gnu/packages/libevent.scm
+++ b/gnu/packages/libevent.scm
@@ -147,14 +147,14 @@ (define-public libuv-for-node
   (package
     (inherit libuv)
     (name "libuv")
-    (version "1.42.0")
+    (version "1.44.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://dist.libuv.org/dist/v" version
                                   "/libuv-v" version ".tar.gz"))
               (sha256
                (base32
-                "0wpb9pz3r8nksnrf4zbixj2kk9whr7abi45ydrwyv2js2ljrc4j3"))))
+                "1d1wy1061cf2mfygr2j6jbm0da2mhsf0l9yq4rjkqrsmijbdrz6c"))))
     (properties '((hidden? . #t)))))
 
 (define-public libuv-julia
-- 
2.39.2

Message #203 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v5 15/17] gnu: llhttp-bootstrap: Update to 6.0.10.
Date: Wed, 15 Mar 2023 01:55:30 +0100

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (llhttp-bootstrap): Update to 6.0.10.
* gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch: Remove file.
* gnu/local.mk: Remove it.
---

(no changes since v1)

 gnu/local.mk                                  |   1 -
 gnu/packages/node.scm                         |   5 +-
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ------------------
 3 files changed, 2 insertions(+), 104 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 98ac6175ae..ee9949aff0 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1492,7 +1492,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/linuxdcpp-openssl-1.1.patch		\
   %D%/packages/patches/lirc-localstatedir.patch			\
   %D%/packages/patches/lirc-reproducible-build.patch		\
-  %D%/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch	\
   %D%/packages/patches/llvm-3.5-fix-clang-build-with-gcc5.patch	\
   %D%/packages/patches/llvm-3.6-fix-build-with-gcc-10.patch	\
   %D%/packages/patches/llvm-3.x.1-fix-build-with-gcc.patch	\
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index be39f3b25a..de847490a3 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -668,7 +668,7 @@ (define-public node-llparse-bootstrap
 (define-public llhttp-bootstrap
   (package
     (name "llhttp")
-    (version "2.1.4")
+    (version "6.0.10")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -677,8 +677,7 @@ (define-public llhttp-bootstrap
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "115mwyds9655p76lhglxg2blc1ksgrix6zhigaxnc2q6syy3pa6x"))
-              (patches (search-patches "llhttp-bootstrap-CVE-2020-8287.patch"))
+                "0izwqa77y007xdi0bj3ccw821n19rz89mz4hx4lg99fwkwylr6x8"))
               (modules '((guix build utils)))
               (snippet
                '(begin
diff --git a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch b/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
deleted file mode 100644
index 215c920e53..0000000000
--- a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-This patch comes from upstream.  It corresponds to a patch applied to
-the generated C source code for llhttp included in Node.js 14.16.0
-(see commit 641f786bb1a1f6eb1ff8750782ed939780f2b31a).  That commit
-fixes CVE-2020-8287.  With this patch, the output of our
-llhttp-bootstrap package matches the files included in Node.js 14.16.0
-exactly.
-
-commit e9b36ea64709c35ca66094d5cf3787f444029601
-Author: Fedor Indutny <fedor <at> indutny.com>
-Date:   Sat Oct 10 19:56:01 2020 -0700
-
-    http: unset `F_CHUNKED` on new `Transfer-Encoding`
-    
-    Duplicate `Transfer-Encoding` header should be a treated as a single,
-    but with original header values concatenated with a comma separator. In
-    the light of this, even if the past `Transfer-Encoding` ended with
-    `chunked`, we should be not let the `F_CHUNKED` to leak into the next
-    header, because mere presence of another header indicates that `chunked`
-    is not the last transfer-encoding token.
-
-diff --git a/src/llhttp/http.ts b/src/llhttp/http.ts
-index f4f1a6e..0a0c365 100644
---- a/src/llhttp/http.ts
-+++ b/src/llhttp/http.ts
-@@ -460,11 +460,19 @@ export class HTTP {
-       .match([ ' ', '\t' ], n('header_value_discard_ws'))
-       .otherwise(checkContentLengthEmptiness);
- 
-+    // Multiple `Transfer-Encoding` headers should be treated as one, but with
-+    // values separate by a comma.
-+    //
-+    // See: https://tools.ietf.org/html/rfc7230#section-3.2.2
-+    const toTransferEncoding = this.unsetFlag(
-+      FLAGS.CHUNKED,
-+      'header_value_te_chunked');
-+
-     n('header_value_start')
-       .otherwise(this.load('header_state', {
-         [HEADER_STATE.UPGRADE]: this.setFlag(FLAGS.UPGRADE, fallback),
-         [HEADER_STATE.TRANSFER_ENCODING]: this.setFlag(
--          FLAGS.TRANSFER_ENCODING, 'header_value_te_chunked'),
-+          FLAGS.TRANSFER_ENCODING, toTransferEncoding),
-         [HEADER_STATE.CONTENT_LENGTH]: n('header_value_content_length_once'),
-         [HEADER_STATE.CONNECTION]: n('header_value_connection'),
-       }, 'header_value'));
-@@ -847,6 +855,11 @@ export class HTTP {
-     return span.start(span.end(this.node(next)));
-   }
- 
-+  private unsetFlag(flag: FLAGS, next: string | Node): Node {
-+    const p = this.llparse;
-+    return p.invoke(p.code.and('flags', ~flag), this.node(next));
-+  }
-+
-   private setFlag(flag: FLAGS, next: string | Node): Node {
-     const p = this.llparse;
-     return p.invoke(p.code.or('flags', flag), this.node(next));
-diff --git a/test/request/transfer-encoding.md b/test/request/transfer-encoding.md
-index a7d1681..b0891d6 100644
---- a/test/request/transfer-encoding.md
-+++ b/test/request/transfer-encoding.md
-@@ -353,6 +353,38 @@ off=106 headers complete method=3 v=1/1 flags=200 content_length=0
- off=106 error code=15 reason="Request has invalid `Transfer-Encoding`"
- ```
- 
-+## POST with `chunked` and duplicate transfer-encoding
-+
-+<!-- meta={"type": "request", "noScan": true} -->
-+```http
-+POST /post_identity_body_world?q=search#hey HTTP/1.1
-+Accept: */*
-+Transfer-Encoding: chunked
-+Transfer-Encoding: deflate
-+
-+World
-+```
-+
-+```log
-+off=0 message begin
-+off=5 len=38 span[url]="/post_identity_body_world?q=search#hey"
-+off=44 url complete
-+off=54 len=6 span[header_field]="Accept"
-+off=61 header_field complete
-+off=62 len=3 span[header_value]="*/*"
-+off=67 header_value complete
-+off=67 len=17 span[header_field]="Transfer-Encoding"
-+off=85 header_field complete
-+off=86 len=7 span[header_value]="chunked"
-+off=95 header_value complete
-+off=95 len=17 span[header_field]="Transfer-Encoding"
-+off=113 header_field complete
-+off=114 len=7 span[header_value]="deflate"
-+off=123 header_value complete
-+off=125 headers complete method=3 v=1/1 flags=200 content_length=0
-+off=125 error code=15 reason="Request has invalid `Transfer-Encoding`"
-+```
-+
- ## POST with `chunked` before other transfer-coding (lenient)
- 
- TODO(indutny): should we allow it even in lenient mode? (Consider disabling
-- 
2.39.2

Message #206 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Ricardo Wurmus <rekado <at> elephly.net>, Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v5 17/17] gnu: libnode: Use node-lts as base.
Date: Wed, 15 Mar 2023 01:55:32 +0100

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (libnode): Use node-lts as base.
* gnu/packages/cran.scm (r-v8)[arguments]<#:phases>: Adjusted accordingly.

---

Changes in v5:
- node build system needs an additional --install-links to work with newer npm.
- node-lts to 18.15.0

 gnu/packages/cran.scm | 2 +-
 gnu/packages/node.scm | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/cran.scm b/gnu/packages/cran.scm
index 803c4e0b6e..50c055690f 100644
--- a/gnu/packages/cran.scm
+++ b/gnu/packages/cran.scm
@@ -1304,7 +1304,7 @@ (define-public r-v8
                (("^PKG_LIBS=.*")
                 (string-append "PKG_LIBS="
                                (assoc-ref inputs "libnode")
-                               "/lib/libnode.so.64\n")))
+                               "/lib/libnode.so.108\n")))
              (setenv "INCLUDE_DIR"
                      (string-append
                       (assoc-ref inputs "libnode")
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index f9f1c13e99..53eba8460a 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -906,10 +906,10 @@ (define-public node-lts
            zlib))))
 
 (define-public libnode
-  (package/inherit node
+  (package/inherit node-lts
     (name "libnode")
     (arguments
-     (substitute-keyword-arguments (package-arguments node)
+     (substitute-keyword-arguments (package-arguments node-lts)
        ((#:configure-flags flags ''())
         `(cons* "--shared" "--without-npm" ,flags))
        ((#:phases phases '%standard-phases)
-- 
2.39.2

Message #209 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v5 16/17] gnu: node-lts: Update to 18.15.0.
Date: Wed, 15 Mar 2023 01:55:31 +0100

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (node-lts): Update to 18.15.0.
[snippet]: Keep file deps/openssl/nodejs-openssl.cnf.
[arguments]<#:configure-flags>: Enable v8 snapshot compression.
<#:phases>: Adjust problematic tests to delete accordingly.
Patch additional file with hardcoded references to /bin/sh.
[native-inputs,inputs]: Replace openssl-1.1 with openssl.
---

(no changes since v1)

 gnu/packages/node.scm | 40 ++++++++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index de847490a3..f9f1c13e99 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -11,6 +11,7 @@
 ;;; Copyright © 2021 Simon Tournier <zimon.toutoune <at> gmail.com>
 ;;; Copyright © 2021 Guillaume Le Vaillant <glv <at> posteo.net>
 ;;; Copyright © 2021, 2022 Philip McGrath <philip <at> philipmcgrath.com>
+;;; Copyright © 2022 Hilton Chain <hako <at> ultrarare.space>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -737,23 +738,28 @@ (define-public llhttp-bootstrap
 (define-public node-lts
   (package
     (inherit node)
-    (version "14.19.3")
+    (version "18.15.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nodejs.org/dist/v" version
-                                  "/node-v" version ".tar.xz"))
+                                  "/node-v" version ".tar.gz"))
               (sha256
                (base32
-                "15691j5zhiikyamiwwd7f282g6d9acfhq91nrwx54xya38gmpx2w"))
+                "0axc4jl71wjjhwzpdc3xg607r32554d0h0lmvb65p0f8ycz4qp6n"))
               (modules '((guix build utils)))
               (snippet
                `(begin
+                  ;; openssl.cnf is required for build.
+                  (for-each delete-file-recursively
+                            (find-files "deps/openssl"
+                                        (lambda (file stat)
+                                          (if (string-contains file "nodejs-openssl.cnf")
+                                              #f #t))))
                   ;; Remove bundled software, where possible
                   (for-each delete-file-recursively
                             '("deps/cares"
                               "deps/icu-small"
                               "deps/nghttp2"
-                              "deps/openssl"
                               "deps/zlib"))
                   (substitute* "Makefile"
                     ;; Remove references to bundled software.
@@ -769,7 +775,9 @@ (define-public node-lts
            "--shared-openssl"
            "--shared-zlib"
            "--shared-brotli"
-           "--with-intl=system-icu"))
+           "--with-intl=system-icu"
+           ;;Needed for correct snapshot checksums
+           "--v8-enable-snapshot-compression"))
        ((#:phases phases)
         `(modify-phases ,phases
            (replace 'set-bootstrap-host-rpath
@@ -802,23 +810,31 @@ (define-public node-lts
                                    libuv "/lib:"
                                    zlib "/lib"
                                    "'],"))))))
+           (add-after 'patch-hardcoded-program-references
+                      'patch-additional-hardcoded-program-references
+             (lambda* (#:key inputs #:allow-other-keys)
+               (substitute* "test/parallel/test-stdin-from-file-spawn.js"
+                 (("'/bin/sh'") (string-append
+                                 "'" (search-input-file inputs "/bin/sh")
+                                 "'")))))
            (replace 'delete-problematic-tests
              (lambda* (#:key inputs #:allow-other-keys)
                ;; FIXME: These tests fail in the build container, but they don't
                ;; seem to be indicative of real problems in practice.
                (for-each delete-file
-                         '("test/parallel/test-cluster-master-error.js"
-                           "test/parallel/test-cluster-master-kill.js"))
+                         '("test/parallel/test-cluster-primary-error.js"
+                           "test/parallel/test-cluster-primary-kill.js"))
 
                ;; These require a DNS resolver.
                (for-each delete-file
                          '("test/parallel/test-dns.js"
-                           "test/parallel/test-dns-lookupService-promises.js"))
+                           "test/parallel/test-dns-lookupService-promises.js"
+                           "test/parallel/test-net-socket-connect-without-cb.js"
+                           "test/parallel/test-tcp-wrap-listen.js"))
 
                ;; These tests require networking.
                (for-each delete-file
-                         '("test/parallel/test-https-agent-unref-socket.js"
-                           "test/parallel/test-corepack-yarn-install.js"))
+                         '("test/parallel/test-https-agent-unref-socket.js"))
 
                ;; This test is timing-sensitive, and fails sporadically on
                ;; slow, busy, or even very fast machines.
@@ -868,7 +884,7 @@ (define-public node-lts
            icu4c-71
            libuv-for-node
            `(,nghttp2 "lib")
-           openssl-1.1
+           openssl
            zlib
            ;; Regular build-time dependencies.
            perl
@@ -885,7 +901,7 @@ (define-public node-lts
            llhttp-bootstrap
            brotli
            `(,nghttp2 "lib")
-           openssl-1.1
+           openssl
            python-wrapper ;; for node-gyp (supports python3)
            zlib))))
 
-- 
2.39.2

Message #212 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Ricardo Wurmus <rekado <at> elephly.net>, Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 00/19] Updating node-lts to 18.X
Date: Thu, 30 Mar 2023 14:31:31 +0200

From: Jelle Licht <jlicht <at> fsfe.org>



Changes in v6:
- Fix build of node-openzwave-shared
- Fix build of node-serialport
- Rebase on master

Hilton Chain (4):
  gnu: libuv-for-node: Update to 1.44.2.
  gnu: llhttp-bootstrap: Update to 6.0.10.
  gnu: node-lts: Update to 18.15.0.
  gnu: libnode: Use node-lts as base.

Jelle Licht (15):
  build-system: node: Use `--install-links' with `npm install'.
  gnu: node-acorn: Disable tests.
  gnu: node-acorn: Remove lifecycle script.
  gnu: node-acorn: Fix broken transpilation.
  gnu: node-buffer-crc32: Ignore development dependencies.
  gnu: node-crx3: Ignore development dependencies.
  gnu: node-minimist: Ignore development dependencies.
  gnu: node-pbf: Ignore development dependencies.
  gnu: node-protocol-buffers-schema: Ignore development dependencies.
  gnu: node-resolve-protobuf-schema: Ignore development dependencies.
  gnu: node-ieee754: Ignore development dependencies.
  gnu: node-yazl: Ignore development dependencies.
  gnu: node-uglify-js: Update to 3.14.2.
  gnu: node-serialport: Avoid gyp rebuilds.
  gnu: node-openzwave-shared: Fix compilation for new versions of node

 gnu/local.mk                                  |   1 -
 gnu/packages/cran.scm                         |   2 +-
 gnu/packages/libevent.scm                     |   4 +-
 gnu/packages/node-xyz.scm                     | 112 ++++++++++++++----
 gnu/packages/node.scm                         |  49 +++++---
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ----------------
 gnu/packages/uglifyjs.scm                     |   4 +-
 gnu/packages/zwave.scm                        |   5 +
 guix/build/node-build-system.scm              |   3 +-
 9 files changed, 130 insertions(+), 150 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch

-- 
2.39.2

Message #215 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 01/19] build-system: node: Use `--install-links' with `npm
 install'.
Date: Thu, 30 Mar 2023 14:31:32 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

Later versions of npm need to explicitly install a copy of local dependencies,
instead of only a symlink.

* guix/build/node-build-system.scm (configure): Add `--install-links' to npm
install invocation.
(install): Ditto.
---

(no changes since v1)

 guix/build/node-build-system.scm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/guix/build/node-build-system.scm b/guix/build/node-build-system.scm
index bee3792e93..93f7efbb2b 100644
--- a/guix/build/node-build-system.scm
+++ b/guix/build/node-build-system.scm
@@ -223,7 +223,7 @@ (define* (delete-lockfiles #:key inputs #:allow-other-keys)
 
 (define* (configure #:key outputs inputs #:allow-other-keys)
   (let ((npm (string-append (assoc-ref inputs "node") "/bin/npm")))
-    (invoke npm "--offline" "--ignore-scripts" "install")
+    (invoke npm "--offline" "--ignore-scripts" "--install-links" "install")
     #t))
 
 (define* (build #:key inputs #:allow-other-keys)
@@ -262,6 +262,7 @@ (define* (install #:key outputs inputs #:allow-other-keys)
             "--offline"
             "--loglevel" "info"
             "--production"
+            "--install-links"
             "install" "../package.tgz")
     #t))
 
-- 
2.39.2

Message #218 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 02/19] gnu: node-acorn: Disable tests.
Date: Thu, 30 Mar 2023 14:31:33 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn): Explicitly disable tests.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 991113c05b..e89117beca 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -46,7 +46,8 @@ (define-public node-acorn
         (base32 "068h5gysz8bbslq31dva8f223rdf8l7w6nxcxjnv4zdprwkzkhaa"))))
     (build-system node-build-system)
     (arguments
-     '(#:phases
+     '(#:tests? #f
+       #:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'change-directory
            (lambda _
-- 
2.39.2

Message #221 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 03/19] gnu: node-acorn: Remove lifecycle script.
Date: Thu, 30 Mar 2023 14:31:34 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[arguments]<modules>: New argument.
<phases>: Patch out unused 'prepare' script that breaks dependents.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index e89117beca..e3d8c7ca19 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -47,11 +47,35 @@ (define-public node-acorn
     (build-system node-build-system)
     (arguments
      '(#:tests? #f
+       #:modules
+       ((guix build node-build-system)
+        (srfi srfi-1)
+        (ice-9 match)
+        (guix build utils))
        #:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'change-directory
            (lambda _
-             (chdir "acorn"))))))
+             (chdir "acorn")))
+         (add-before 'configure 'avoid-prepare-scripts
+           (lambda _
+             ;; We need to remove the prepare script from "package.json", as
+             ;; it would try to use the build environment and would block the
+             ;; automatic building by other packages making use of node-acorn.
+             ;; TODO: Add utility function
+             (with-atomic-json-file-replacement "package.json"
+               (match-lambda
+                 (('@ . pkg-meta-alist)
+                  (cons '@ (map (match-lambda
+                                  (("scripts" @ . scripts-alist)
+                                   `("scripts" @ ,@(filter (match-lambda
+                                                             (("prepare" . _)
+                                                              #f)
+                                                             (_
+                                                              #t))
+                                                           scripts-alist)))
+                                  (other other))
+                                pkg-meta-alist))))))))))
     (home-page "https://github.com/acornjs/acorn/tree/master/acorn")
     (synopsis "Javascript-based Javascript parser")
     (description "Acornjs is a Javascript parser with many options and an
-- 
2.39.2

Message #224 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 04/19] gnu: node-acorn: Fix broken transpilation.
Date: Thu, 30 Mar 2023 14:31:35 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[native-inputs]: Add `esbuild'.
[arguments]<phases>: Replace build phase by custom `esbuild' invocations.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index e3d8c7ca19..d75ccc199a 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2021 Charles <charles.b.jackson <at> protonmail.com>
 ;;; Copyright © 2021 Philip McGrath <philip <at> philipmcgrath.com>
 ;;; Copyright © 2022 Nicolas Graves <ngraves <at> ngraves.fr>
+;;; Copyright © 2023 Jelle Licht <jlicht <at> fsfe.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -75,7 +76,30 @@ (define-public node-acorn
                                                               #t))
                                                            scripts-alist)))
                                   (other other))
-                                pkg-meta-alist))))))))))
+                                pkg-meta-alist)))))))
+         (replace 'build
+           (lambda* (#:key inputs native-inputs #:allow-other-keys)
+             (let ((esbuild (search-input-file (or native-inputs inputs)
+                                        "/bin/esbuild")))
+               (invoke esbuild
+                     "src/index.js"
+                     "--outfile=dist/acorn.js"
+                     "--format=cjs"
+                     "--bundle"
+                     "--platform=node")
+               (invoke esbuild
+                     "src/index.js"
+                     "--outfile=dist/acorn.mjs"
+                     "--format=esm"
+                     "--bundle"
+                     "--platform=node")
+               (invoke esbuild
+                     "src/bin/acorn.js"
+                     "--outfile=dist/bin.js"
+                     "--format=cjs"
+                     "--platform=node")))))))
+    (native-inputs
+     (list esbuild))
     (home-page "https://github.com/acornjs/acorn/tree/master/acorn")
     (synopsis "Javascript-based Javascript parser")
     (description "Acornjs is a Javascript parser with many options and an
-- 
2.39.2

Message #227 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 05/19] gnu: node-buffer-crc32: Ignore development
 dependencies.
Date: Thu, 30 Mar 2023 14:31:36 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[arguments]<phases>: Explicitly patch
out development dependencies.  Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index d75ccc199a..96901e7bf8 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -123,10 +123,9 @@ (define-public node-buffer-crc32
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("tap")))))))
     (home-page "https://github.com/brianloveswords/buffer-crc32")
     (synopsis "CRC32 implementation in Javascript")
     (description
-- 
2.39.2

Message #230 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 06/19] gnu: node-crx3: Ignore development dependencies.
Date: Thu, 30 Mar 2023 14:31:37 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-crx3)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 96901e7bf8..00d93d3185 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -179,10 +179,16 @@ (define-public node-crx3
                       (substitute* "lib/configuration.js"
                         (("mri")
                          "minimist"))))
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("c8"
+                                             "docdash"
+                                             "eslint"
+                                             "eslint-plugin-jsdoc"
+                                             "jsdoc"
+                                             "tap-diff"
+                                             "tape"
+                                             "tape-catch")))))))
     (inputs (list node-minimist node-pbf node-yazl))
     (home-page "https://github.com/ahwayakchih/crx3")
     (synopsis "Create CRXv3 browser extensions with Javascript")
-- 
2.39.2

Message #233 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 07/19] gnu: node-minimist: Ignore development dependencies.
Date: Thu, 30 Mar 2023 14:31:38 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-minimist)[arguments]<phases>: Explicitly
patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 00d93d3185..847004501a 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -313,10 +313,9 @@ (define-public node-minimist
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("covert" "tap" "tape")))))))
     (home-page "https://github.com/substack/minimist")
     (synopsis "Parse CLI arguments in Javascript")
     (description "This package can scan for CLI flags and arguments in
-- 
2.39.2

Message #236 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 08/19] gnu: node-pbf: Ignore development dependencies.
Date: Thu, 30 Mar 2023 14:31:39 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-pbf)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 847004501a..680be0ad3f 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -364,10 +364,19 @@ (define-public node-pbf
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies
+                       '("benchmark"
+                         "browserify"
+                         "eslint"
+                         "eslint-config-mourner"
+                         "mkdirp"
+                         "protobufjs"
+                         "protocol-buffers"
+                         "tap"
+                         "tile-stats-runner"
+                         "uglify-js")))))))
     (inputs (list node-ieee754 node-resolve-protobuf-schema))
     (home-page "https://github.com/mapbox/pbf")
     (synopsis "Decode and encode protocol buffers in Javascript")
-- 
2.39.2

Message #239 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 09/19] gnu: node-protocol-buffers-schema: Ignore
 development dependencies.
Date: Thu, 30 Mar 2023 14:31:40 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-protocol-buffers-schema)[arguments]<phases>:
Explicitly patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 680be0ad3f..1b581cf3a7 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -405,10 +405,9 @@ (define-public node-protocol-buffers-schema
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("standard" "tape")))))))
     (home-page "https://github.com/mafintosh/protocol-buffers-schema")
     (synopsis "Protocol buffers schema parser written in Javascript")
     (description "This package provides a protocol buffers schema parser
-- 
2.39.2

Message #242 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 10/19] gnu: node-resolve-protobuf-schema: Ignore
 development dependencies.
Date: Thu, 30 Mar 2023 14:31:41 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-resolve-protobuf-schema)[arguments]<phases>:
Explicitly patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 1b581cf3a7..cbf2665940 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -431,10 +431,9 @@ (define-public node-resolve-protobuf-schema
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("standard" "tape")))))))
     (inputs (list node-protocol-buffers-schema))
     (home-page "https://github.com/mafintosh/resolve-protobuf-schema")
     (synopsis "Resolve protobuf imports")
-- 
2.39.2

Message #245 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 11/19] gnu: node-ieee754: Ignore development dependencies.
Date: Thu, 30 Mar 2023 14:31:42 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-ieee754)[arguments]<phases>: Explicitly
patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index cbf2665940..628fe41d28 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -623,10 +623,9 @@ (define-public node-ieee754
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("airtap" "standard" "tape")))))))
     (home-page "https://github.com/feross/ieee754")
     (synopsis "Read/write IEEE754 floating point numbers in Javascript")
     (description "This package can read and write IEEE754 floating point
-- 
2.39.2

Message #248 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 12/19] gnu: node-yazl: Ignore development dependencies.
Date: Thu, 30 Mar 2023 14:31:43 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-yazl)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 628fe41d28..b85507f52f 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -1588,10 +1588,9 @@ (define-public node-yazl
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("airtap" "bl" "istanbul" "yauzl")))))))
     (inputs (list node-buffer-crc32))
     (home-page "https://github.com/thejoshwolfe/yazl")
     (synopsis "Yet another zip library for node")
-- 
2.39.2

Message #251 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 13/19] gnu: node-uglify-js: Update to 3.14.2.
Date: Thu, 30 Mar 2023 14:31:44 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/uglifyjs.scm (node-uglify-js): Update to 3.14.2.
---

(no changes since v1)

 gnu/packages/uglifyjs.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/uglifyjs.scm b/gnu/packages/uglifyjs.scm
index b65d52b8df..1bd8bb6326 100644
--- a/gnu/packages/uglifyjs.scm
+++ b/gnu/packages/uglifyjs.scm
@@ -25,7 +25,7 @@ (define-module (gnu packages uglifyjs)
 (define-public node-uglify-js
   (package
     (name "node-uglify-js")
-    (version "3.13.9")
+    (version "3.14.2")
     (source
      (origin
        (method git-fetch)
@@ -34,7 +34,7 @@ (define-public node-uglify-js
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "0q1f91xwwm829cl5v727d4qkxy4yh7wri3pgl89f0m3a4y1n7hi4"))))
+        (base32 "1jraqpwzga4vbgq3xcn08jcfc87pm6nik7vpxvxa4rfjvz70a6k7"))))
     (build-system node-build-system)
     (native-inputs
      (list node-acorn node-semver))
-- 
2.39.2

Message #254 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 14/19] gnu: node-serialport: Avoid gyp rebuilds.
Date: Thu, 30 Mar 2023 14:31:45 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-serialport)[arguments]<phases>: Explicitly
disable gyp recompilation.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index b85507f52f..a9784dbf7a 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -1384,6 +1384,8 @@ (define-public node-serialport-bindings
                                                              (_
                                                               #t))
                                                            scripts-alist)))
+                                  (("gypfile" . _)
+                                   '("gypfile" . #f))
                                   (other
                                    other))
                                 pkg-meta-alist))))))))
-- 
2.39.2

Message #257 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v6 15/19] gnu: node-openzwave-shared: Fix compilation for new
 versions of node
Date: Thu, 30 Mar 2023 14:31:46 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/zwave.scm (node-openzwave-shared)[arguments]<#:phases>: Add
patch-compiler phase to allow compilation with node versions 16 and up.
---

(no changes since v1)

 gnu/packages/zwave.scm | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/gnu/packages/zwave.scm b/gnu/packages/zwave.scm
index 3e99bd7687..a30199ec02 100644
--- a/gnu/packages/zwave.scm
+++ b/gnu/packages/zwave.scm
@@ -112,6 +112,11 @@ (define-public node-openzwave-shared
     (arguments
      `(#:phases
        (modify-phases %standard-phases
+         (add-before 'build 'patch-compiler
+           (lambda _
+             (substitute* "binding.gyp"
+               (("std=c\\+\\+11")
+                "std=c++17"))))
          (replace 'build
            ;; For some reason, `npm install` doesn't build
            ;; the addon automatically, so we do it explicitly here.
-- 
2.39.2

Message #260 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v6 16/19] gnu: libuv-for-node: Update to 1.44.2.
Date: Thu, 30 Mar 2023 14:31:47 +0200

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/libevent.scm (libuv-for-node): Update to 1.44.2.
---

(no changes since v1)

 gnu/packages/libevent.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/libevent.scm b/gnu/packages/libevent.scm
index 02b2795194..441c8a401c 100644
--- a/gnu/packages/libevent.scm
+++ b/gnu/packages/libevent.scm
@@ -148,14 +148,14 @@ (define-public libuv-for-node
   (package
     (inherit libuv)
     (name "libuv")
-    (version "1.42.0")
+    (version "1.44.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://dist.libuv.org/dist/v" version
                                   "/libuv-v" version ".tar.gz"))
               (sha256
                (base32
-                "0wpb9pz3r8nksnrf4zbixj2kk9whr7abi45ydrwyv2js2ljrc4j3"))))
+                "1d1wy1061cf2mfygr2j6jbm0da2mhsf0l9yq4rjkqrsmijbdrz6c"))))
     (properties '((hidden? . #t)))))
 
 (define-public libuv-for-r-httpuv
-- 
2.39.2

Message #263 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v6 17/19] gnu: llhttp-bootstrap: Update to 6.0.10.
Date: Thu, 30 Mar 2023 14:31:48 +0200

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (llhttp-bootstrap): Update to 6.0.10.
* gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch: Remove file.
* gnu/local.mk: Remove it.
---

(no changes since v1)

 gnu/local.mk                                  |   1 -
 gnu/packages/node.scm                         |   5 +-
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ------------------
 3 files changed, 2 insertions(+), 104 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index aee0b8a645..7deb8d8cd7 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1498,7 +1498,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/linuxdcpp-openssl-1.1.patch		\
   %D%/packages/patches/lirc-localstatedir.patch			\
   %D%/packages/patches/lirc-reproducible-build.patch		\
-  %D%/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch	\
   %D%/packages/patches/llvm-3.5-fix-clang-build-with-gcc5.patch	\
   %D%/packages/patches/llvm-3.6-fix-build-with-gcc-10.patch	\
   %D%/packages/patches/llvm-3.x.1-fix-build-with-gcc.patch	\
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index 6137ed1dd3..f613844a13 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -668,7 +668,7 @@ (define-public node-llparse-bootstrap
 (define-public llhttp-bootstrap
   (package
     (name "llhttp")
-    (version "2.1.4")
+    (version "6.0.10")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -677,8 +677,7 @@ (define-public llhttp-bootstrap
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "115mwyds9655p76lhglxg2blc1ksgrix6zhigaxnc2q6syy3pa6x"))
-              (patches (search-patches "llhttp-bootstrap-CVE-2020-8287.patch"))
+                "0izwqa77y007xdi0bj3ccw821n19rz89mz4hx4lg99fwkwylr6x8"))
               (modules '((guix build utils)))
               (snippet
                '(begin
diff --git a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch b/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
deleted file mode 100644
index 215c920e53..0000000000
--- a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-This patch comes from upstream.  It corresponds to a patch applied to
-the generated C source code for llhttp included in Node.js 14.16.0
-(see commit 641f786bb1a1f6eb1ff8750782ed939780f2b31a).  That commit
-fixes CVE-2020-8287.  With this patch, the output of our
-llhttp-bootstrap package matches the files included in Node.js 14.16.0
-exactly.
-
-commit e9b36ea64709c35ca66094d5cf3787f444029601
-Author: Fedor Indutny <fedor <at> indutny.com>
-Date:   Sat Oct 10 19:56:01 2020 -0700
-
-    http: unset `F_CHUNKED` on new `Transfer-Encoding`
-    
-    Duplicate `Transfer-Encoding` header should be a treated as a single,
-    but with original header values concatenated with a comma separator. In
-    the light of this, even if the past `Transfer-Encoding` ended with
-    `chunked`, we should be not let the `F_CHUNKED` to leak into the next
-    header, because mere presence of another header indicates that `chunked`
-    is not the last transfer-encoding token.
-
-diff --git a/src/llhttp/http.ts b/src/llhttp/http.ts
-index f4f1a6e..0a0c365 100644
---- a/src/llhttp/http.ts
-+++ b/src/llhttp/http.ts
-@@ -460,11 +460,19 @@ export class HTTP {
-       .match([ ' ', '\t' ], n('header_value_discard_ws'))
-       .otherwise(checkContentLengthEmptiness);
- 
-+    // Multiple `Transfer-Encoding` headers should be treated as one, but with
-+    // values separate by a comma.
-+    //
-+    // See: https://tools.ietf.org/html/rfc7230#section-3.2.2
-+    const toTransferEncoding = this.unsetFlag(
-+      FLAGS.CHUNKED,
-+      'header_value_te_chunked');
-+
-     n('header_value_start')
-       .otherwise(this.load('header_state', {
-         [HEADER_STATE.UPGRADE]: this.setFlag(FLAGS.UPGRADE, fallback),
-         [HEADER_STATE.TRANSFER_ENCODING]: this.setFlag(
--          FLAGS.TRANSFER_ENCODING, 'header_value_te_chunked'),
-+          FLAGS.TRANSFER_ENCODING, toTransferEncoding),
-         [HEADER_STATE.CONTENT_LENGTH]: n('header_value_content_length_once'),
-         [HEADER_STATE.CONNECTION]: n('header_value_connection'),
-       }, 'header_value'));
-@@ -847,6 +855,11 @@ export class HTTP {
-     return span.start(span.end(this.node(next)));
-   }
- 
-+  private unsetFlag(flag: FLAGS, next: string | Node): Node {
-+    const p = this.llparse;
-+    return p.invoke(p.code.and('flags', ~flag), this.node(next));
-+  }
-+
-   private setFlag(flag: FLAGS, next: string | Node): Node {
-     const p = this.llparse;
-     return p.invoke(p.code.or('flags', flag), this.node(next));
-diff --git a/test/request/transfer-encoding.md b/test/request/transfer-encoding.md
-index a7d1681..b0891d6 100644
---- a/test/request/transfer-encoding.md
-+++ b/test/request/transfer-encoding.md
-@@ -353,6 +353,38 @@ off=106 headers complete method=3 v=1/1 flags=200 content_length=0
- off=106 error code=15 reason="Request has invalid `Transfer-Encoding`"
- ```
- 
-+## POST with `chunked` and duplicate transfer-encoding
-+
-+<!-- meta={"type": "request", "noScan": true} -->
-+```http
-+POST /post_identity_body_world?q=search#hey HTTP/1.1
-+Accept: */*
-+Transfer-Encoding: chunked
-+Transfer-Encoding: deflate
-+
-+World
-+```
-+
-+```log
-+off=0 message begin
-+off=5 len=38 span[url]="/post_identity_body_world?q=search#hey"
-+off=44 url complete
-+off=54 len=6 span[header_field]="Accept"
-+off=61 header_field complete
-+off=62 len=3 span[header_value]="*/*"
-+off=67 header_value complete
-+off=67 len=17 span[header_field]="Transfer-Encoding"
-+off=85 header_field complete
-+off=86 len=7 span[header_value]="chunked"
-+off=95 header_value complete
-+off=95 len=17 span[header_field]="Transfer-Encoding"
-+off=113 header_field complete
-+off=114 len=7 span[header_value]="deflate"
-+off=123 header_value complete
-+off=125 headers complete method=3 v=1/1 flags=200 content_length=0
-+off=125 error code=15 reason="Request has invalid `Transfer-Encoding`"
-+```
-+
- ## POST with `chunked` before other transfer-coding (lenient)
- 
- TODO(indutny): should we allow it even in lenient mode? (Consider disabling
-- 
2.39.2

Message #266 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v6 18/19] gnu: node-lts: Update to 18.15.0.
Date: Thu, 30 Mar 2023 14:31:49 +0200

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (node-lts): Update to 18.15.0.
[snippet]: Keep file deps/openssl/nodejs-openssl.cnf.
[arguments]<#:configure-flags>: Enable v8 snapshot compression.
<#:phases>: Adjust problematic tests to delete accordingly.
Patch additional file with hardcoded references to /bin/sh.
[native-inputs,inputs]: Replace openssl-1.1 with openssl.
---

(no changes since v1)

 gnu/packages/node.scm | 40 ++++++++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index f613844a13..a9c4f463c8 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -11,6 +11,7 @@
 ;;; Copyright © 2021 Simon Tournier <zimon.toutoune <at> gmail.com>
 ;;; Copyright © 2021 Guillaume Le Vaillant <glv <at> posteo.net>
 ;;; Copyright © 2021, 2022 Philip McGrath <philip <at> philipmcgrath.com>
+;;; Copyright © 2022 Hilton Chain <hako <at> ultrarare.space>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -737,23 +738,28 @@ (define-public llhttp-bootstrap
 (define-public node-lts
   (package
     (inherit node)
-    (version "14.19.3")
+    (version "18.15.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nodejs.org/dist/v" version
-                                  "/node-v" version ".tar.xz"))
+                                  "/node-v" version ".tar.gz"))
               (sha256
                (base32
-                "15691j5zhiikyamiwwd7f282g6d9acfhq91nrwx54xya38gmpx2w"))
+                "0axc4jl71wjjhwzpdc3xg607r32554d0h0lmvb65p0f8ycz4qp6n"))
               (modules '((guix build utils)))
               (snippet
                `(begin
+                  ;; openssl.cnf is required for build.
+                  (for-each delete-file-recursively
+                            (find-files "deps/openssl"
+                                        (lambda (file stat)
+                                          (if (string-contains file "nodejs-openssl.cnf")
+                                              #f #t))))
                   ;; Remove bundled software, where possible
                   (for-each delete-file-recursively
                             '("deps/cares"
                               "deps/icu-small"
                               "deps/nghttp2"
-                              "deps/openssl"
                               "deps/zlib"))
                   (substitute* "Makefile"
                     ;; Remove references to bundled software.
@@ -769,7 +775,9 @@ (define-public node-lts
            "--shared-openssl"
            "--shared-zlib"
            "--shared-brotli"
-           "--with-intl=system-icu"))
+           "--with-intl=system-icu"
+           ;;Needed for correct snapshot checksums
+           "--v8-enable-snapshot-compression"))
        ((#:phases phases)
         `(modify-phases ,phases
            (replace 'set-bootstrap-host-rpath
@@ -802,23 +810,31 @@ (define-public node-lts
                                    libuv "/lib:"
                                    zlib "/lib"
                                    "'],"))))))
+           (add-after 'patch-hardcoded-program-references
+                      'patch-additional-hardcoded-program-references
+             (lambda* (#:key inputs #:allow-other-keys)
+               (substitute* "test/parallel/test-stdin-from-file-spawn.js"
+                 (("'/bin/sh'") (string-append
+                                 "'" (search-input-file inputs "/bin/sh")
+                                 "'")))))
            (replace 'delete-problematic-tests
              (lambda* (#:key inputs #:allow-other-keys)
                ;; FIXME: These tests fail in the build container, but they don't
                ;; seem to be indicative of real problems in practice.
                (for-each delete-file
-                         '("test/parallel/test-cluster-master-error.js"
-                           "test/parallel/test-cluster-master-kill.js"))
+                         '("test/parallel/test-cluster-primary-error.js"
+                           "test/parallel/test-cluster-primary-kill.js"))
 
                ;; These require a DNS resolver.
                (for-each delete-file
                          '("test/parallel/test-dns.js"
-                           "test/parallel/test-dns-lookupService-promises.js"))
+                           "test/parallel/test-dns-lookupService-promises.js"
+                           "test/parallel/test-net-socket-connect-without-cb.js"
+                           "test/parallel/test-tcp-wrap-listen.js"))
 
                ;; These tests require networking.
                (for-each delete-file
-                         '("test/parallel/test-https-agent-unref-socket.js"
-                           "test/parallel/test-corepack-yarn-install.js"))
+                         '("test/parallel/test-https-agent-unref-socket.js"))
 
                ;; This test is timing-sensitive, and fails sporadically on
                ;; slow, busy, or even very fast machines.
@@ -868,7 +884,7 @@ (define-public node-lts
            icu4c-71
            libuv-for-node
            `(,nghttp2 "lib")
-           openssl-1.1
+           openssl
            zlib
            ;; Regular build-time dependencies.
            perl
@@ -885,7 +901,7 @@ (define-public node-lts
            llhttp-bootstrap
            brotli
            `(,nghttp2 "lib")
-           openssl-1.1
+           openssl
            zlib))))
 
 (define-public libnode
-- 
2.39.2

Message #269 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Ricardo Wurmus <rekado <at> elephly.net>, Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v6 19/19] gnu: libnode: Use node-lts as base.
Date: Thu, 30 Mar 2023 14:31:50 +0200

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (libnode): Use node-lts as base.
* gnu/packages/cran.scm (r-v8)[arguments]<#:phases>: Adjusted accordingly.

---

Changes in v6:
- Fix build of node-openzwave-shared
- Fix build of node-serialport
- Rebase on master

 gnu/packages/cran.scm | 2 +-
 gnu/packages/node.scm | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/cran.scm b/gnu/packages/cran.scm
index c1786b7848..60336a5246 100644
--- a/gnu/packages/cran.scm
+++ b/gnu/packages/cran.scm
@@ -1334,7 +1334,7 @@ (define-public r-v8
                (("^PKG_LIBS=.*")
                 (string-append "PKG_LIBS="
                                (assoc-ref inputs "libnode")
-                               "/lib/libnode.so.64\n")))
+                               "/lib/libnode.so.108\n")))
              (setenv "INCLUDE_DIR"
                      (string-append
                       (assoc-ref inputs "libnode")
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index a9c4f463c8..399c5ff794 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -905,10 +905,10 @@ (define-public node-lts
            zlib))))
 
 (define-public libnode
-  (package/inherit node
+  (package/inherit node-lts
     (name "libnode")
     (arguments
-     (substitute-keyword-arguments (package-arguments node)
+     (substitute-keyword-arguments (package-arguments node-lts)
        ((#:configure-flags flags ''())
         `(cons* "--shared" "--without-npm" ,flags))
        ((#:phases phases '%standard-phases)
-- 
2.39.2

Message #272 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: jlicht <at> fsfe.org
Cc: Ricardo Wurmus <rekado <at> elephly.net>, 59188 <at> debbugs.gnu.org
Subject: Re: [bug#59188] [PATCH v6 00/19] Updating node-lts to 18.X
Date: Thu, 13 Apr 2023 11:55:29 -0400

On Thu, Mar 30, 2023 at 02:31:31PM +0200, jlicht <at> fsfe.org wrote:
> From: Jelle Licht <jlicht <at> fsfe.org>
> Changes in v6:
> - Fix build of node-openzwave-shared
> - Fix build of node-serialport
> - Rebase on master

Thanks! I think that if the patches are working for you and there are no
outstanding problems, you should feel free to push.

Message #275 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 01/20] build-system: node: Use `--install-links' with `npm
 install'.
Date: Mon, 17 Apr 2023 16:51:03 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

Later versions of npm need to explicitly install a copy of local dependencies,
instead of only a symlink.

* guix/build/node-build-system.scm (configure): Add `--install-links' to npm
install invocation.
(install): Ditto.
---

(no changes since v1)

 guix/build/node-build-system.scm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/guix/build/node-build-system.scm b/guix/build/node-build-system.scm
index bee3792e93..93f7efbb2b 100644
--- a/guix/build/node-build-system.scm
+++ b/guix/build/node-build-system.scm
@@ -223,7 +223,7 @@ (define* (delete-lockfiles #:key inputs #:allow-other-keys)
 
 (define* (configure #:key outputs inputs #:allow-other-keys)
   (let ((npm (string-append (assoc-ref inputs "node") "/bin/npm")))
-    (invoke npm "--offline" "--ignore-scripts" "install")
+    (invoke npm "--offline" "--ignore-scripts" "--install-links" "install")
     #t))
 
 (define* (build #:key inputs #:allow-other-keys)
@@ -262,6 +262,7 @@ (define* (install #:key outputs inputs #:allow-other-keys)
             "--offline"
             "--loglevel" "info"
             "--production"
+            "--install-links"
             "install" "../package.tgz")
     #t))
 
-- 
2.39.2

Message #278 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 02/20] gnu: node-acorn: Disable tests.
Date: Mon, 17 Apr 2023 16:51:04 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn): Explicitly disable tests.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 991113c05b..e89117beca 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -46,7 +46,8 @@ (define-public node-acorn
         (base32 "068h5gysz8bbslq31dva8f223rdf8l7w6nxcxjnv4zdprwkzkhaa"))))
     (build-system node-build-system)
     (arguments
-     '(#:phases
+     '(#:tests? #f
+       #:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'change-directory
            (lambda _
-- 
2.39.2

Message #281 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 03/20] gnu: node-acorn: Remove lifecycle script.
Date: Mon, 17 Apr 2023 16:51:05 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[arguments]<modules>: New argument.
<phases>: Patch out unused 'prepare' script that breaks dependents.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index e89117beca..e3d8c7ca19 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -47,11 +47,35 @@ (define-public node-acorn
     (build-system node-build-system)
     (arguments
      '(#:tests? #f
+       #:modules
+       ((guix build node-build-system)
+        (srfi srfi-1)
+        (ice-9 match)
+        (guix build utils))
        #:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'change-directory
            (lambda _
-             (chdir "acorn"))))))
+             (chdir "acorn")))
+         (add-before 'configure 'avoid-prepare-scripts
+           (lambda _
+             ;; We need to remove the prepare script from "package.json", as
+             ;; it would try to use the build environment and would block the
+             ;; automatic building by other packages making use of node-acorn.
+             ;; TODO: Add utility function
+             (with-atomic-json-file-replacement "package.json"
+               (match-lambda
+                 (('@ . pkg-meta-alist)
+                  (cons '@ (map (match-lambda
+                                  (("scripts" @ . scripts-alist)
+                                   `("scripts" @ ,@(filter (match-lambda
+                                                             (("prepare" . _)
+                                                              #f)
+                                                             (_
+                                                              #t))
+                                                           scripts-alist)))
+                                  (other other))
+                                pkg-meta-alist))))))))))
     (home-page "https://github.com/acornjs/acorn/tree/master/acorn")
     (synopsis "Javascript-based Javascript parser")
     (description "Acornjs is a Javascript parser with many options and an
-- 
2.39.2

Message #284 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Ricardo Wurmus <rekado <at> elephly.net>, Jelle Licht <jlicht <at> fsfe.org>,
 Liliana Marie Prikler <liliana.prikler <at> gmail.com>,
 Andrew Tropin <andrew <at> trop.in>
Subject: [PATCH v7 00/20] Updating node-lts to 18.X
Date: Mon, 17 Apr 2023 16:51:02 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

Node-based things are broken on armhf, but that has been the case for a good
while already. If nobody objects, I'm planning to push this to master after a
'green light' (modulo armhf results) from the QA service, somewhere in the
coming days.

Changes in v7:
- Build emacs-nodejs-repl with node-lts
- Rebase on master
- Update node-lts to 18.16.0

Hilton Chain (4):
  gnu: libuv-for-node: Update to 1.44.2.
  gnu: llhttp-bootstrap: Update to 6.0.10.
  gnu: node-lts: Update to 18.16.0.
  gnu: libnode: Use node-lts as base.

Jelle Licht (16):
  build-system: node: Use `--install-links' with `npm install'.
  gnu: node-acorn: Disable tests.
  gnu: node-acorn: Remove lifecycle script.
  gnu: node-acorn: Fix broken transpilation.
  gnu: node-buffer-crc32: Ignore development dependencies.
  gnu: node-crx3: Ignore development dependencies.
  gnu: node-minimist: Ignore development dependencies.
  gnu: node-pbf: Ignore development dependencies.
  gnu: node-protocol-buffers-schema: Ignore development dependencies.
  gnu: node-resolve-protobuf-schema: Ignore development dependencies.
  gnu: node-ieee754: Ignore development dependencies.
  gnu: node-yazl: Ignore development dependencies.
  gnu: node-uglify-js: Update to 3.14.2.
  gnu: node-serialport: Avoid gyp rebuilds.
  gnu: node-openzwave-shared: Fix compilation for new versions of node
  gnu: emacs-nodejs-repl: Build with node-lts.

 gnu/local.mk                                  |   1 -
 gnu/packages/cran.scm                         |   2 +-
 gnu/packages/emacs-xyz.scm                    |   2 +-
 gnu/packages/libevent.scm                     |   4 +-
 gnu/packages/node-xyz.scm                     | 112 ++++++++++++++----
 gnu/packages/node.scm                         |  49 +++++---
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ----------------
 gnu/packages/uglifyjs.scm                     |   4 +-
 gnu/packages/zwave.scm                        |   5 +
 guix/build/node-build-system.scm              |   3 +-
 10 files changed, 131 insertions(+), 151 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch

-- 
2.39.2

Message #287 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 04/20] gnu: node-acorn: Fix broken transpilation.
Date: Mon, 17 Apr 2023 16:51:06 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[native-inputs]: Add `esbuild'.
[arguments]<phases>: Replace build phase by custom `esbuild' invocations.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index e3d8c7ca19..d75ccc199a 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2021 Charles <charles.b.jackson <at> protonmail.com>
 ;;; Copyright © 2021 Philip McGrath <philip <at> philipmcgrath.com>
 ;;; Copyright © 2022 Nicolas Graves <ngraves <at> ngraves.fr>
+;;; Copyright © 2023 Jelle Licht <jlicht <at> fsfe.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -75,7 +76,30 @@ (define-public node-acorn
                                                               #t))
                                                            scripts-alist)))
                                   (other other))
-                                pkg-meta-alist))))))))))
+                                pkg-meta-alist)))))))
+         (replace 'build
+           (lambda* (#:key inputs native-inputs #:allow-other-keys)
+             (let ((esbuild (search-input-file (or native-inputs inputs)
+                                        "/bin/esbuild")))
+               (invoke esbuild
+                     "src/index.js"
+                     "--outfile=dist/acorn.js"
+                     "--format=cjs"
+                     "--bundle"
+                     "--platform=node")
+               (invoke esbuild
+                     "src/index.js"
+                     "--outfile=dist/acorn.mjs"
+                     "--format=esm"
+                     "--bundle"
+                     "--platform=node")
+               (invoke esbuild
+                     "src/bin/acorn.js"
+                     "--outfile=dist/bin.js"
+                     "--format=cjs"
+                     "--platform=node")))))))
+    (native-inputs
+     (list esbuild))
     (home-page "https://github.com/acornjs/acorn/tree/master/acorn")
     (synopsis "Javascript-based Javascript parser")
     (description "Acornjs is a Javascript parser with many options and an
-- 
2.39.2

Message #290 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 05/20] gnu: node-buffer-crc32: Ignore development
 dependencies.
Date: Mon, 17 Apr 2023 16:51:07 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-acorn)[arguments]<phases>: Explicitly patch
out development dependencies.  Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index d75ccc199a..96901e7bf8 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -123,10 +123,9 @@ (define-public node-buffer-crc32
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("tap")))))))
     (home-page "https://github.com/brianloveswords/buffer-crc32")
     (synopsis "CRC32 implementation in Javascript")
     (description
-- 
2.39.2

Message #293 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 06/20] gnu: node-crx3: Ignore development dependencies.
Date: Mon, 17 Apr 2023 16:51:08 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-crx3)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 96901e7bf8..00d93d3185 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -179,10 +179,16 @@ (define-public node-crx3
                       (substitute* "lib/configuration.js"
                         (("mri")
                          "minimist"))))
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("c8"
+                                             "docdash"
+                                             "eslint"
+                                             "eslint-plugin-jsdoc"
+                                             "jsdoc"
+                                             "tap-diff"
+                                             "tape"
+                                             "tape-catch")))))))
     (inputs (list node-minimist node-pbf node-yazl))
     (home-page "https://github.com/ahwayakchih/crx3")
     (synopsis "Create CRXv3 browser extensions with Javascript")
-- 
2.39.2

Message #296 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 07/20] gnu: node-minimist: Ignore development dependencies.
Date: Mon, 17 Apr 2023 16:51:09 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-minimist)[arguments]<phases>: Explicitly
patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 00d93d3185..847004501a 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -313,10 +313,9 @@ (define-public node-minimist
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("covert" "tap" "tape")))))))
     (home-page "https://github.com/substack/minimist")
     (synopsis "Parse CLI arguments in Javascript")
     (description "This package can scan for CLI flags and arguments in
-- 
2.39.2

Message #299 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 08/20] gnu: node-pbf: Ignore development dependencies.
Date: Mon, 17 Apr 2023 16:51:10 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-pbf)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 847004501a..680be0ad3f 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -364,10 +364,19 @@ (define-public node-pbf
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies
+                       '("benchmark"
+                         "browserify"
+                         "eslint"
+                         "eslint-config-mourner"
+                         "mkdirp"
+                         "protobufjs"
+                         "protocol-buffers"
+                         "tap"
+                         "tile-stats-runner"
+                         "uglify-js")))))))
     (inputs (list node-ieee754 node-resolve-protobuf-schema))
     (home-page "https://github.com/mapbox/pbf")
     (synopsis "Decode and encode protocol buffers in Javascript")
-- 
2.39.2

Message #302 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 09/20] gnu: node-protocol-buffers-schema: Ignore
 development dependencies.
Date: Mon, 17 Apr 2023 16:51:11 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-protocol-buffers-schema)[arguments]<phases>:
Explicitly patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 680be0ad3f..1b581cf3a7 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -405,10 +405,9 @@ (define-public node-protocol-buffers-schema
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("standard" "tape")))))))
     (home-page "https://github.com/mafintosh/protocol-buffers-schema")
     (synopsis "Protocol buffers schema parser written in Javascript")
     (description "This package provides a protocol buffers schema parser
-- 
2.39.2

Message #305 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 10/20] gnu: node-resolve-protobuf-schema: Ignore
 development dependencies.
Date: Mon, 17 Apr 2023 16:51:12 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-resolve-protobuf-schema)[arguments]<phases>:
Explicitly patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 1b581cf3a7..cbf2665940 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -431,10 +431,9 @@ (define-public node-resolve-protobuf-schema
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("standard" "tape")))))))
     (inputs (list node-protocol-buffers-schema))
     (home-page "https://github.com/mafintosh/resolve-protobuf-schema")
     (synopsis "Resolve protobuf imports")
-- 
2.39.2

Message #308 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 11/20] gnu: node-ieee754: Ignore development dependencies.
Date: Mon, 17 Apr 2023 16:51:13 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-ieee754)[arguments]<phases>: Explicitly
patch out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index cbf2665940..628fe41d28 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -623,10 +623,9 @@ (define-public node-ieee754
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("airtap" "standard" "tape")))))))
     (home-page "https://github.com/feross/ieee754")
     (synopsis "Read/write IEEE754 floating point numbers in Javascript")
     (description "This package can read and write IEEE754 floating point
-- 
2.39.2

Message #311 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 12/20] gnu: node-yazl: Ignore development dependencies.
Date: Mon, 17 Apr 2023 16:51:14 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-yazl)[arguments]<phases>: Explicitly patch
out development dependencies. Re-enable configure phase.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index 628fe41d28..b85507f52f 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -1588,10 +1588,9 @@ (define-public node-yazl
     (arguments
      '(#:tests? #f
        #:phases (modify-phases %standard-phases
-                  (replace 'configure
+                  (add-after 'patch-dependencies 'delete-dependencies
                     (lambda _
-                      (invoke "npm" "--offline" "--ignore-scripts" "install"
-                              "--production"))))))
+                      (delete-dependencies '("airtap" "bl" "istanbul" "yauzl")))))))
     (inputs (list node-buffer-crc32))
     (home-page "https://github.com/thejoshwolfe/yazl")
     (synopsis "Yet another zip library for node")
-- 
2.39.2

Message #314 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 13/20] gnu: node-uglify-js: Update to 3.14.2.
Date: Mon, 17 Apr 2023 16:51:15 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/uglifyjs.scm (node-uglify-js): Update to 3.14.2.
---

(no changes since v1)

 gnu/packages/uglifyjs.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/uglifyjs.scm b/gnu/packages/uglifyjs.scm
index b65d52b8df..1bd8bb6326 100644
--- a/gnu/packages/uglifyjs.scm
+++ b/gnu/packages/uglifyjs.scm
@@ -25,7 +25,7 @@ (define-module (gnu packages uglifyjs)
 (define-public node-uglify-js
   (package
     (name "node-uglify-js")
-    (version "3.13.9")
+    (version "3.14.2")
     (source
      (origin
        (method git-fetch)
@@ -34,7 +34,7 @@ (define-public node-uglify-js
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "0q1f91xwwm829cl5v727d4qkxy4yh7wri3pgl89f0m3a4y1n7hi4"))))
+        (base32 "1jraqpwzga4vbgq3xcn08jcfc87pm6nik7vpxvxa4rfjvz70a6k7"))))
     (build-system node-build-system)
     (native-inputs
      (list node-acorn node-semver))
-- 
2.39.2

Message #317 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 14/20] gnu: node-serialport: Avoid gyp rebuilds.
Date: Mon, 17 Apr 2023 16:51:16 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/node-xyz.scm (node-serialport)[arguments]<phases>: Explicitly
disable gyp recompilation.
---

(no changes since v1)

 gnu/packages/node-xyz.scm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/gnu/packages/node-xyz.scm b/gnu/packages/node-xyz.scm
index b85507f52f..a9784dbf7a 100644
--- a/gnu/packages/node-xyz.scm
+++ b/gnu/packages/node-xyz.scm
@@ -1384,6 +1384,8 @@ (define-public node-serialport-bindings
                                                              (_
                                                               #t))
                                                            scripts-alist)))
+                                  (("gypfile" . _)
+                                   '("gypfile" . #f))
                                   (other
                                    other))
                                 pkg-meta-alist))))))))
-- 
2.39.2

Message #320 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>
Subject: [PATCH v7 15/20] gnu: node-openzwave-shared: Fix compilation for new
 versions of node
Date: Mon, 17 Apr 2023 16:51:17 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/zwave.scm (node-openzwave-shared)[arguments]<#:phases>: Add
patch-compiler phase to allow compilation with node versions 16 and up.
---

(no changes since v1)

 gnu/packages/zwave.scm | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/gnu/packages/zwave.scm b/gnu/packages/zwave.scm
index 3e99bd7687..a30199ec02 100644
--- a/gnu/packages/zwave.scm
+++ b/gnu/packages/zwave.scm
@@ -112,6 +112,11 @@ (define-public node-openzwave-shared
     (arguments
      `(#:phases
        (modify-phases %standard-phases
+         (add-before 'build 'patch-compiler
+           (lambda _
+             (substitute* "binding.gyp"
+               (("std=c\\+\\+11")
+                "std=c++17"))))
          (replace 'build
            ;; For some reason, `npm install` doesn't build
            ;; the addon automatically, so we do it explicitly here.
-- 
2.39.2

Message #323 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Jelle Licht <jlicht <at> fsfe.org>,
 Liliana Marie Prikler <liliana.prikler <at> gmail.com>,
 Andrew Tropin <andrew <at> trop.in>
Subject: [PATCH v7 16/20] gnu: emacs-nodejs-repl: Build with node-lts.
Date: Mon, 17 Apr 2023 16:51:18 +0200

From: Jelle Licht <jlicht <at> fsfe.org>

* gnu/packages/emacs-xyz.scm (emacs-nodejs-repl)[inputs]: Replace NODE by
NODE-LTS.
---

(no changes since v1)

 gnu/packages/emacs-xyz.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/emacs-xyz.scm b/gnu/packages/emacs-xyz.scm
index c1748e7f36..7282c03dfe 100644
--- a/gnu/packages/emacs-xyz.scm
+++ b/gnu/packages/emacs-xyz.scm
@@ -12803,7 +12803,7 @@ (define-public emacs-nodejs-repl
                 "0a5mmg3cmdi73giblp07ksl06xzl9nb2m3f96ny4r3rv0ar3v1bx"))))
     (build-system emacs-build-system)
     (inputs
-     (list node))
+     (list node-lts))
     (native-inputs
      (list emacs-ert-expectations))
     (arguments
-- 
2.39.2

Message #326 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v7 17/20] gnu: libuv-for-node: Update to 1.44.2.
Date: Mon, 17 Apr 2023 16:51:19 +0200

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/libevent.scm (libuv-for-node): Update to 1.44.2.
---

(no changes since v1)

 gnu/packages/libevent.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/libevent.scm b/gnu/packages/libevent.scm
index 02b2795194..441c8a401c 100644
--- a/gnu/packages/libevent.scm
+++ b/gnu/packages/libevent.scm
@@ -148,14 +148,14 @@ (define-public libuv-for-node
   (package
     (inherit libuv)
     (name "libuv")
-    (version "1.42.0")
+    (version "1.44.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://dist.libuv.org/dist/v" version
                                   "/libuv-v" version ".tar.gz"))
               (sha256
                (base32
-                "0wpb9pz3r8nksnrf4zbixj2kk9whr7abi45ydrwyv2js2ljrc4j3"))))
+                "1d1wy1061cf2mfygr2j6jbm0da2mhsf0l9yq4rjkqrsmijbdrz6c"))))
     (properties '((hidden? . #t)))))
 
 (define-public libuv-for-r-httpuv
-- 
2.39.2

Message #329 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v7 18/20] gnu: llhttp-bootstrap: Update to 6.0.10.
Date: Mon, 17 Apr 2023 16:51:20 +0200

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (llhttp-bootstrap): Update to 6.0.10.
* gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch: Remove file.
* gnu/local.mk: Remove it.
---

(no changes since v1)

 gnu/local.mk                                  |   1 -
 gnu/packages/node.scm                         |   5 +-
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ------------------
 3 files changed, 2 insertions(+), 104 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 1241ab09c0..0f79acd639 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1501,7 +1501,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/linuxdcpp-openssl-1.1.patch		\
   %D%/packages/patches/lirc-localstatedir.patch			\
   %D%/packages/patches/lirc-reproducible-build.patch		\
-  %D%/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch	\
   %D%/packages/patches/llvm-3.5-fix-clang-build-with-gcc5.patch	\
   %D%/packages/patches/llvm-3.6-fix-build-with-gcc-10.patch	\
   %D%/packages/patches/llvm-3.x.1-fix-build-with-gcc.patch	\
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index 6137ed1dd3..f613844a13 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -668,7 +668,7 @@ (define-public node-llparse-bootstrap
 (define-public llhttp-bootstrap
   (package
     (name "llhttp")
-    (version "2.1.4")
+    (version "6.0.10")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -677,8 +677,7 @@ (define-public llhttp-bootstrap
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "115mwyds9655p76lhglxg2blc1ksgrix6zhigaxnc2q6syy3pa6x"))
-              (patches (search-patches "llhttp-bootstrap-CVE-2020-8287.patch"))
+                "0izwqa77y007xdi0bj3ccw821n19rz89mz4hx4lg99fwkwylr6x8"))
               (modules '((guix build utils)))
               (snippet
                '(begin
diff --git a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch b/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
deleted file mode 100644
index 215c920e53..0000000000
--- a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-This patch comes from upstream.  It corresponds to a patch applied to
-the generated C source code for llhttp included in Node.js 14.16.0
-(see commit 641f786bb1a1f6eb1ff8750782ed939780f2b31a).  That commit
-fixes CVE-2020-8287.  With this patch, the output of our
-llhttp-bootstrap package matches the files included in Node.js 14.16.0
-exactly.
-
-commit e9b36ea64709c35ca66094d5cf3787f444029601
-Author: Fedor Indutny <fedor <at> indutny.com>
-Date:   Sat Oct 10 19:56:01 2020 -0700
-
-    http: unset `F_CHUNKED` on new `Transfer-Encoding`
-    
-    Duplicate `Transfer-Encoding` header should be a treated as a single,
-    but with original header values concatenated with a comma separator. In
-    the light of this, even if the past `Transfer-Encoding` ended with
-    `chunked`, we should be not let the `F_CHUNKED` to leak into the next
-    header, because mere presence of another header indicates that `chunked`
-    is not the last transfer-encoding token.
-
-diff --git a/src/llhttp/http.ts b/src/llhttp/http.ts
-index f4f1a6e..0a0c365 100644
---- a/src/llhttp/http.ts
-+++ b/src/llhttp/http.ts
-@@ -460,11 +460,19 @@ export class HTTP {
-       .match([ ' ', '\t' ], n('header_value_discard_ws'))
-       .otherwise(checkContentLengthEmptiness);
- 
-+    // Multiple `Transfer-Encoding` headers should be treated as one, but with
-+    // values separate by a comma.
-+    //
-+    // See: https://tools.ietf.org/html/rfc7230#section-3.2.2
-+    const toTransferEncoding = this.unsetFlag(
-+      FLAGS.CHUNKED,
-+      'header_value_te_chunked');
-+
-     n('header_value_start')
-       .otherwise(this.load('header_state', {
-         [HEADER_STATE.UPGRADE]: this.setFlag(FLAGS.UPGRADE, fallback),
-         [HEADER_STATE.TRANSFER_ENCODING]: this.setFlag(
--          FLAGS.TRANSFER_ENCODING, 'header_value_te_chunked'),
-+          FLAGS.TRANSFER_ENCODING, toTransferEncoding),
-         [HEADER_STATE.CONTENT_LENGTH]: n('header_value_content_length_once'),
-         [HEADER_STATE.CONNECTION]: n('header_value_connection'),
-       }, 'header_value'));
-@@ -847,6 +855,11 @@ export class HTTP {
-     return span.start(span.end(this.node(next)));
-   }
- 
-+  private unsetFlag(flag: FLAGS, next: string | Node): Node {
-+    const p = this.llparse;
-+    return p.invoke(p.code.and('flags', ~flag), this.node(next));
-+  }
-+
-   private setFlag(flag: FLAGS, next: string | Node): Node {
-     const p = this.llparse;
-     return p.invoke(p.code.or('flags', flag), this.node(next));
-diff --git a/test/request/transfer-encoding.md b/test/request/transfer-encoding.md
-index a7d1681..b0891d6 100644
---- a/test/request/transfer-encoding.md
-+++ b/test/request/transfer-encoding.md
-@@ -353,6 +353,38 @@ off=106 headers complete method=3 v=1/1 flags=200 content_length=0
- off=106 error code=15 reason="Request has invalid `Transfer-Encoding`"
- ```
- 
-+## POST with `chunked` and duplicate transfer-encoding
-+
-+<!-- meta={"type": "request", "noScan": true} -->
-+```http
-+POST /post_identity_body_world?q=search#hey HTTP/1.1
-+Accept: */*
-+Transfer-Encoding: chunked
-+Transfer-Encoding: deflate
-+
-+World
-+```
-+
-+```log
-+off=0 message begin
-+off=5 len=38 span[url]="/post_identity_body_world?q=search#hey"
-+off=44 url complete
-+off=54 len=6 span[header_field]="Accept"
-+off=61 header_field complete
-+off=62 len=3 span[header_value]="*/*"
-+off=67 header_value complete
-+off=67 len=17 span[header_field]="Transfer-Encoding"
-+off=85 header_field complete
-+off=86 len=7 span[header_value]="chunked"
-+off=95 header_value complete
-+off=95 len=17 span[header_field]="Transfer-Encoding"
-+off=113 header_field complete
-+off=114 len=7 span[header_value]="deflate"
-+off=123 header_value complete
-+off=125 headers complete method=3 v=1/1 flags=200 content_length=0
-+off=125 error code=15 reason="Request has invalid `Transfer-Encoding`"
-+```
-+
- ## POST with `chunked` before other transfer-coding (lenient)
- 
- TODO(indutny): should we allow it even in lenient mode? (Consider disabling
-- 
2.39.2

Message #332 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v7 19/20] gnu: node-lts: Update to 18.16.0.
Date: Mon, 17 Apr 2023 16:51:21 +0200

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (node-lts): Update to 18.16.0.
[snippet]: Keep file deps/openssl/nodejs-openssl.cnf.
[arguments]<#:configure-flags>: Enable v8 snapshot compression.
<#:phases>: Adjust problematic tests to delete accordingly.
Patch additional file with hardcoded references to /bin/sh.
[native-inputs,inputs]: Replace openssl-1.1 with openssl.
---

(no changes since v1)

 gnu/packages/node.scm | 40 ++++++++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index f613844a13..35e1386844 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -11,6 +11,7 @@
 ;;; Copyright © 2021 Simon Tournier <zimon.toutoune <at> gmail.com>
 ;;; Copyright © 2021 Guillaume Le Vaillant <glv <at> posteo.net>
 ;;; Copyright © 2021, 2022 Philip McGrath <philip <at> philipmcgrath.com>
+;;; Copyright © 2022 Hilton Chain <hako <at> ultrarare.space>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -737,23 +738,28 @@ (define-public llhttp-bootstrap
 (define-public node-lts
   (package
     (inherit node)
-    (version "14.19.3")
+    (version "18.16.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nodejs.org/dist/v" version
-                                  "/node-v" version ".tar.xz"))
+                                  "/node-v" version ".tar.gz"))
               (sha256
                (base32
-                "15691j5zhiikyamiwwd7f282g6d9acfhq91nrwx54xya38gmpx2w"))
+                "0vcc132z7lkxnw5clmiz6sp6ccmw35pyb69hczphrig5frfmqkva"))
               (modules '((guix build utils)))
               (snippet
                `(begin
+                  ;; openssl.cnf is required for build.
+                  (for-each delete-file-recursively
+                            (find-files "deps/openssl"
+                                        (lambda (file stat)
+                                          (if (string-contains file "nodejs-openssl.cnf")
+                                              #f #t))))
                   ;; Remove bundled software, where possible
                   (for-each delete-file-recursively
                             '("deps/cares"
                               "deps/icu-small"
                               "deps/nghttp2"
-                              "deps/openssl"
                               "deps/zlib"))
                   (substitute* "Makefile"
                     ;; Remove references to bundled software.
@@ -769,7 +775,9 @@ (define-public node-lts
            "--shared-openssl"
            "--shared-zlib"
            "--shared-brotli"
-           "--with-intl=system-icu"))
+           "--with-intl=system-icu"
+           ;;Needed for correct snapshot checksums
+           "--v8-enable-snapshot-compression"))
        ((#:phases phases)
         `(modify-phases ,phases
            (replace 'set-bootstrap-host-rpath
@@ -802,23 +810,31 @@ (define-public node-lts
                                    libuv "/lib:"
                                    zlib "/lib"
                                    "'],"))))))
+           (add-after 'patch-hardcoded-program-references
+                      'patch-additional-hardcoded-program-references
+             (lambda* (#:key inputs #:allow-other-keys)
+               (substitute* "test/parallel/test-stdin-from-file-spawn.js"
+                 (("'/bin/sh'") (string-append
+                                 "'" (search-input-file inputs "/bin/sh")
+                                 "'")))))
            (replace 'delete-problematic-tests
              (lambda* (#:key inputs #:allow-other-keys)
                ;; FIXME: These tests fail in the build container, but they don't
                ;; seem to be indicative of real problems in practice.
                (for-each delete-file
-                         '("test/parallel/test-cluster-master-error.js"
-                           "test/parallel/test-cluster-master-kill.js"))
+                         '("test/parallel/test-cluster-primary-error.js"
+                           "test/parallel/test-cluster-primary-kill.js"))
 
                ;; These require a DNS resolver.
                (for-each delete-file
                          '("test/parallel/test-dns.js"
-                           "test/parallel/test-dns-lookupService-promises.js"))
+                           "test/parallel/test-dns-lookupService-promises.js"
+                           "test/parallel/test-net-socket-connect-without-cb.js"
+                           "test/parallel/test-tcp-wrap-listen.js"))
 
                ;; These tests require networking.
                (for-each delete-file
-                         '("test/parallel/test-https-agent-unref-socket.js"
-                           "test/parallel/test-corepack-yarn-install.js"))
+                         '("test/parallel/test-https-agent-unref-socket.js"))
 
                ;; This test is timing-sensitive, and fails sporadically on
                ;; slow, busy, or even very fast machines.
@@ -868,7 +884,7 @@ (define-public node-lts
            icu4c-71
            libuv-for-node
            `(,nghttp2 "lib")
-           openssl-1.1
+           openssl
            zlib
            ;; Regular build-time dependencies.
            perl
@@ -885,7 +901,7 @@ (define-public node-lts
            llhttp-bootstrap
            brotli
            `(,nghttp2 "lib")
-           openssl-1.1
+           openssl
            zlib))))
 
 (define-public libnode
-- 
2.39.2

Message #335 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: jlicht <at> fsfe.org
To: 59188 <at> debbugs.gnu.org
Cc: Ricardo Wurmus <rekado <at> elephly.net>, Hilton Chain <hako <at> ultrarare.space>
Subject: [PATCH v7 20/20] gnu: libnode: Use node-lts as base.
Date: Mon, 17 Apr 2023 16:51:22 +0200

From: Hilton Chain <hako <at> ultrarare.space>

* gnu/packages/node.scm (libnode): Use node-lts as base.
* gnu/packages/cran.scm (r-v8)[arguments]<#:phases>: Adjusted accordingly.

---

Changes in v7:
- Build emacs-nodejs-repl with node-lts
- Rebase on master
- Update node-lts to 18.16.0
- Still broken on armhf, but has been for years :/

 gnu/packages/cran.scm | 2 +-
 gnu/packages/node.scm | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/cran.scm b/gnu/packages/cran.scm
index 03c92e7ffd..03e0f36cdf 100644
--- a/gnu/packages/cran.scm
+++ b/gnu/packages/cran.scm
@@ -1428,7 +1428,7 @@ (define-public r-v8
                (("^PKG_LIBS=.*")
                 (string-append "PKG_LIBS="
                                (assoc-ref inputs "libnode")
-                               "/lib/libnode.so.64\n")))
+                               "/lib/libnode.so.108\n")))
              (setenv "INCLUDE_DIR"
                      (string-append
                       (assoc-ref inputs "libnode")
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index 35e1386844..37cfec8a6b 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -905,10 +905,10 @@ (define-public node-lts
            zlib))))
 
 (define-public libnode
-  (package/inherit node
+  (package/inherit node-lts
     (name "libnode")
     (arguments
-     (substitute-keyword-arguments (package-arguments node)
+     (substitute-keyword-arguments (package-arguments node-lts)
        ((#:configure-flags flags ''())
         `(cons* "--shared" "--without-npm" ,flags))
        ((#:phases phases '%standard-phases)
-- 
2.39.2

Message #338 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: Liliana Marie Prikler <liliana.prikler <at> gmail.com>
To: jlicht <at> fsfe.org, 59188 <at> debbugs.gnu.org
Cc: Andrew Tropin <andrew <at> trop.in>
Subject: Re: [PATCH v7 16/20] gnu: emacs-nodejs-repl: Build with node-lts.
Date: Mon, 17 Apr 2023 17:37:48 +0200

Am Montag, dem 17.04.2023 um 16:51 +0200 schrieb jlicht <at> fsfe.org:
> From: Jelle Licht <jlicht <at> fsfe.org>
> 
> * gnu/packages/emacs-xyz.scm (emacs-nodejs-repl)[inputs]: Replace
> NODE by NODE-LTS.
I think lowercase would be better.

> ---
> 
> (no changes since v1)
Where is v1?

>  gnu/packages/emacs-xyz.scm | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/gnu/packages/emacs-xyz.scm b/gnu/packages/emacs-xyz.scm
> index c1748e7f36..7282c03dfe 100644
> --- a/gnu/packages/emacs-xyz.scm
> +++ b/gnu/packages/emacs-xyz.scm
> @@ -12803,7 +12803,7 @@ (define-public emacs-nodejs-repl
>                 
> "0a5mmg3cmdi73giblp07ksl06xzl9nb2m3f96ny4r3rv0ar3v1bx"))))
>      (build-system emacs-build-system)
>      (inputs
> -     (list node))
> +     (list node-lts))
LGTM, I guess.  Is it expected that node-lts will see fewer rebuilds
than the other node package going forward?

Cheers

Message #341 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: Jelle Licht <jlicht <at> fsfe.org>
To: Liliana Marie Prikler <liliana.prikler <at> gmail.com>, 59188 <at> debbugs.gnu.org
Cc: Andrew Tropin <andrew <at> trop.in>
Subject: Re: [PATCH v7 16/20] gnu: emacs-nodejs-repl: Build with node-lts.
Date: Mon, 17 Apr 2023 18:03:26 +0200

Liliana Marie Prikler <liliana.prikler <at> gmail.com> writes:

> Am Montag, dem 17.04.2023 um 16:51 +0200 schrieb jlicht <at> fsfe.org:
>> From: Jelle Licht <jlicht <at> fsfe.org>
>> 
>> * gnu/packages/emacs-xyz.scm (emacs-nodejs-repl)[inputs]: Replace
>> NODE by NODE-LTS.
> I think lowercase would be better.

Addressed locally, and will take into account when applying. 

>
>> ---
>> 
>> (no changes since v1)
> Where is v1?
There is no v1.

This blurb is generated by patman, I do not know how to disable this.
Tips very much welcome.

Since I started using patman, I've listed changes in each cover letter
instead, as that's much easier to manage.

>>  gnu/packages/emacs-xyz.scm | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>> 
>> diff --git a/gnu/packages/emacs-xyz.scm b/gnu/packages/emacs-xyz.scm
>> index c1748e7f36..7282c03dfe 100644
>> --- a/gnu/packages/emacs-xyz.scm
>> +++ b/gnu/packages/emacs-xyz.scm
>> @@ -12803,7 +12803,7 @@ (define-public emacs-nodejs-repl
>>                 
>> "0a5mmg3cmdi73giblp07ksl06xzl9nb2m3f96ny4r3rv0ar3v1bx"))))
>>      (build-system emacs-build-system)
>>      (inputs
>> -     (list node))
>> +     (list node-lts))
> LGTM, I guess.  Is it expected that node-lts will see fewer rebuilds
> than the other node package going forward?

No, if anything the hope is that there will be more going on with the
node-lts package :-).

Our current "node" package should not be used, as it's an ancient (and
unsupported) version. Restructuring the node/node-lts/node-bootstrap
triad (and making sure older versions are not exposed to users) will be
my next node-related venture.

> Cheers

Thanks for the review!
- Jelle

Message #344 received at 59188 <at> debbugs.gnu.org (full text, mbox):

From: Mekeor Melire <mekeor <at> posteo.de>
To: jlicht <at> fsfe.org
Cc: 59188 <at> debbugs.gnu.org
Subject: Re: [bug#59188] [PATCH v7 00/20] Updating node-lts to 18.X
Date: Mon, 17 Apr 2023 22:08:29 +0000

2023-04-17 16:51 jlicht <at> fsfe.org:

> From: Jelle Licht <jlicht <at> fsfe.org>
>
> Node-based things are broken on armhf, but that has been the 
> case for a good while already. If nobody objects, I'm planning 
> to push this to master after a 'green light' (modulo armhf 
> results) from the QA service, somewhere in the coming days.

Thank you very much for all the hard work! I'm looking forward to 
this.

I've been guix-pulling from this branch already for some weeks, 
and everything has been working fine for me.

Message #349 received at 59188-done <at> debbugs.gnu.org (full text, mbox):

From: Jelle Licht <jlicht <at> fsfe.org>
To: 59188-done <at> debbugs.gnu.org
Subject: Updating node-lts to 18.X
Date: Sat, 06 May 2023 14:50:28 +0200

Pushed to master, with some minor adjustments to make things work after
the core-updates merge. Thanks for the patience and feedback!

- Jelle

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.