https://kotlinlang.org logo
Join Slack
Powered by
Sorry for the noob question, but what Node.js vers...
# javascript
n
Sorry for the noob question, but what Node.js version should I use? The KMP curated version is quite old, v22.0.0 and without patches. Is it just the oldest version KMP supports, or a preferable one? I am using NodeJS just for builds, so security is less of a concern.
a
You can use any version you want. There is a small snippet in the doc on how to customize it: https://kotlinlang.org/docs/js-project-setup.html#configuring-node-js-settings The simple example is this:
Copy code
import org.jetbrains.kotlin.gradle.targets.js.nodejs.NodeJsEnvSpec
import org.jetbrains.kotlin.gradle.targets.js.nodejs.NodeJsPlugin

plugins.withType<NodeJsPlugin> {
  the<NodeJsEnvSpec>().version = "22.18.0"
}
e
https://youtrack.jetbrains.com/issue/WEB-72952 Not sure if this is still valid or not.
a
Yes, it is
thank you color 1
n
But what is recommended? Update to latest version or keep plugin curated version?
e
The correct question is "do I need the latest version?"
n
Not really. I expect better performance and security from more recent versions
e
Yes but that's the development environment. You're not going to deploy via that tooling.
n
Also true. Thanks!
blob no problem 1
j
Just ran into this. The workaround works. But why are new versions of kotlin still relying on outdated versions of node? What's the reasoning for shipping something without patch releases that presumably fix stability and security bugs applied (node is infamous for those). I just tried kotlin 2.2.20RC and it still bundles a version of node that is more one and half year out of date. Why is this not being updated more regularly? I think we were still on kotlin 1.9 at the time.
e
I think it has to strike a balance. Maybe it's time to come up with update guidelines? Much like what I proposed for ECMAScript support: picking a baseline used by the compiler and deciding when to update it (e.g., once a year? Stay on latest version - 2?, etc.)
j
I think if you ship a release, all dependencies should be current and supported. I get not switching major releases of dependencies for a minor release. But keeping the node release on the latest LTS should be fairly uncontroversial. Supported here means latest minor release, not the most unstable and risky .0 release of the LTS version so 22.18.0 instead of 22.0.0. Probably all sorts of important stuff got fixed ...
e
Yes I get what you mean, but I don't think it's that "urgent". Overriding the version isn't complex and is what I'd expect every team to do, since you most likely want to have control over it (be it because of CI, or because you're in a monorepo).
n
IMHO the most stable expierence is to use active version: https://nodejs.org/en/about/previous-releases. But the question is, why kotlin bundles the first, and supposelly the most unstable version of 
22.0.0
? I seen cached 
22.13.0
, but have no idea which project left it.
@Edoardo Luppi, yes, we can manage own versions. But is it a recomendation? Does kotlin gives the same level of stability with 22.18.0 as with 22.0.0?
e
The version was set to 22.13, and then rolled back because of the mentioned debug issue IIRC. https://github.com/jetbrains/kotlin/commit/08d1935948b074c27e6f9280363c35169e441346
Effectively you, as a user, won't see any difference. I hope you're not running your production deployment through the KMP run task!
n
Maybe some potential performance gains? But you re right, I probably won't see the difference. But seeing zeros in versions always makes that odd feeling that I am using first, not yet patched version.
j
and a lot of closed CVEs
and an increasing number of libraries that require something up-todate
2 Views
Open in Slack
PreviousNext
Powered by