To be clear, I'm talking about hapi, and not about dropping @hapi/hapi.
Starting with v17.9.0 and v18.2.0 the name changed from 'hapi' to '@hapi/hapi'.
hapi (the old one) is deprecated, obsolete, unmaintained and has known major security issues. IIUC it is coming up on two years being so. hapijs/hapi#4114 provides some details. Anything before @hapi/hapi@20 is in this "deprecated, ..." group.
% npm ci
npm WARN deprecated hapi@18.1.0: This version contains severe security issues and defects and should not be used! Please upgrade to the latest version of @hapi/hapi or consider a commercial license (https://github.com/hapijs/hapi/issues/4114)
...
There are maintenance and testing costs to continuing to support it. The monstrous .tav.yml block hints at some of the complexity:
|
# hapi and @hapi/hapi |
|
# - Package name: Starting with v17.9.0 and v18.2.0 the name changed from |
|
# 'hapi' to '@hapi/hapi'. |
|
# - Node version compat: |
|
# - hapi@15: supports node >=v4; breaks on node v14 (usage of `os.tmpDir()`) |
|
# - hapi@16: supports node >=v4 |
|
# - hapi@17, @hapi/hapi@17: supports node >=v8.12.0 (per its README); |
|
# the instrumentation changed significantly for this version |
|
# - hapi@18, @hapi/hapi@18: supports node >=v8.12.0 (per its README) |
|
# - @hapi/hapi@19: supports node >=v12 (judging from commit 50d8d7d) |
|
# - @hapi/hapi@20: appears (from travis template refs) to support node >=v12 |
|
hapi-v9-v15: |
|
name: hapi |
|
versions: '>=9.0.1 <16.0.0' |
|
node: '>=4 <14' |
|
commands: |
|
- node test/instrumentation/modules/hapi/basic-legacy-path.test.js |
|
- node test/instrumentation/modules/hapi/set-framework-hapi.test.js |
|
hapi-v16: |
|
name: hapi |
|
versions: '>=16.0.0 <17.0.0' |
|
node: '>=4' |
|
commands: |
|
- node test/instrumentation/modules/hapi/basic-legacy-path.test.js |
|
- node test/instrumentation/modules/hapi/set-framework-hapi.test.js |
|
hapi-prenodev15: |
|
name: hapi |
|
versions: '>=17.0.0' |
|
node: '>=8.12.0 <15.0.0' |
|
commands: |
|
- node test/instrumentation/modules/hapi/basic-legacy-path.test.js |
|
- node test/instrumentation/modules/hapi/set-framework-hapi.test.js |
|
hapi: |
|
name: hapi |
|
# Work around https://github.com/npm/cli/issues/2267 in npm@7. |
|
# Note: An alternative might be to just not test the "hapi" package with |
|
# node >= 15, given that "hapi" was deprecated before node v16. |
|
preinstall: rm -rf node_modules/hapi |
|
node: '>=15.0.0' |
|
versions: '>=17.0.0' |
|
commands: |
|
- node test/instrumentation/modules/hapi/basic-legacy-path.test.js |
|
- node test/instrumentation/modules/hapi/set-framework-hapi.test.js |
|
'@hapi/hapi-v17-v18': |
|
name: '@hapi/hapi' |
|
versions: '>=17.0.0 <19.0.0' |
|
node: '>=8.12.0' |
|
commands: |
|
- node test/instrumentation/modules/hapi/basic.test.js |
|
- node test/instrumentation/modules/hapi/set-framework-hapihapi.test.js |
|
'@hapi/hapi': |
|
name: '@hapi/hapi' |
|
versions: '>=19.0.0' |
|
node: '>=12' |
|
commands: |
|
- node test/instrumentation/modules/hapi/basic.test.js |
|
- node test/instrumentation/modules/hapi/set-framework-hapihapi.test.js |
Also, note there are lingering minor issues:
open questions
- Do we drop it now, or do we wait for a major version bump of the agent?
To be clear, I'm talking about
hapi, and not about dropping@hapi/hapi.Starting with v17.9.0 and v18.2.0 the name changed from 'hapi' to '@hapi/hapi'.
hapi(the old one) is deprecated, obsolete, unmaintained and has known major security issues. IIUC it is coming up on two years being so. hapijs/hapi#4114 provides some details. Anything before@hapi/hapi@20is in this "deprecated, ..." group.There are maintenance and testing costs to continuing to support it. The monstrous .tav.yml block hints at some of the complexity:
apm-agent-nodejs/.tav.yml
Lines 408 to 464 in a289d44
Also, note there are lingering minor issues:
npm installand older versions of hapi (versions that we do currently install and test in our TAV tests)open questions