[Bug]: winston3.3.3 resolves to @dabh/diagnostics@^2 → pulls @so-ric/colorspace (ES2021 ||=) and crashes on Node 12

[fuqi1001]

🔎 Search Terms

denpendency

The problem

winston@3.3.3 depends on @dabh/diagnostics:^2.0.2. Recently, npm started resolving this to @dabh/diagnostics@2.0.8, which in turn depends on @so-ric/colorspace@1.1.x. That package uses the ES2021 logical-OR assignment operator (||=), which causes a syntax error on Node 12:

https://github.com/so-ric/colorspace/blob/57ead2fa29f93d738e944155751d67619676a43d/dist/index.cjs.js#L1976

/app/node_modules/@so-ric/colorspace/dist/index.cjs.js:1976
                (limiters[m] ||= [])[channel] = modifier;
                               ^

SyntaxError: Unexpected token '='
    at wrapSafe (internal/modules/cjs/loader.js:1072:16)
    at Module._compile (internal/modules/cjs/loader.js:1122:27)
    at Module._compile (/app/node_modules/pirates/lib/index.js:129:24)
    at Module._extensions..js (internal/modules/cjs/loader.js:1178:10)
    at Object.newLoader [as .js] (/app/node_modules/pirates/lib/index.js:134:7)
    at Module.load (internal/modules/cjs/loader.js:1002:32)
    at Function.Module._load (internal/modules/cjs/loader.js:901:14)
    at Module.require (internal/modules/cjs/loader.js:1044:19)
    at require (internal/modules/cjs/helpers.js:77:18)
    at Object.<anonymous> (/app/node_modules/@dabh/diagnostics/modifiers/namespace-ansi.js:1:18)

Previously, older @dabh/diagnostics did not pull @so-ric/colorspace and worked fine on Node 12.

Environment

Node: v12.16.1 (npm 6.13.4) — legacy runtime we still need to support

winston: 3.3.3 (also reproducible when a newer 3.x is hoisted)

@dabh/diagnostics: resolved to 2.0.8 via ^2.0.2

OS: Debian-based container

Expected behavior

Installing winston@3.x should not introduce syntax that breaks on Node 12, or the compatibility constraints should be clearly documented.

Actual behavior

Transitive dependency upgrade to @dabh/diagnostics@2.0.8 → @so-ric/colorspace introduces ES2021 syntax and crashes at startup on Node 12.

Workarounds tried

Pinning with overrides/resolutions to @dabh/diagnostics@2.0.3 (works).

Upgrading runtime to Node 18 (works, but not immediately feasible for all environments).

Request

Consider pinning a Node-12-compatible range for @dabh/diagnostics in winston@3.x, or

Document minimum Node version more prominently for current transitive tree, or

Provide guidance on recommended versions for users still on Node 12.

Thanks!

What version of Winston presents the issue?

v3.3.3

What version of Node are you using?

12.16.1

If this worked in a previous version of Winston, which was it?

No response

Minimum Working Example

No response

Additional information

No response

[DABH]

Hi @fuqi1001 , thanks for the report. Due to limitations of GitHub actions, as well as limited funding for maintenance, winston as a policy does not support EOL node versions or consider such versions when releasing new versions. However, we are happy to try and be accommodating. If you'd like to make a PR to @so-ric/colorspace that uses more compatible syntax, we could get that merged in and then update the dependency tree and cut a new winston version that would still be 12-compatible. Or, we could add a section to the README of winston (or somewhere like that) that indicates the last winston version known to be compatible with a given Node version. Thanks!

[fuqi1001]

Hi @fuqi1001 , thanks for the report. Due to limitations of GitHub actions, as well as limited funding for maintenance, winston as a policy does not support EOL node versions or consider such versions when releasing new versions. However, we are happy to try and be accommodating. If you'd like to make a PR to @so-ric/colorspace that uses more compatible syntax, we could get that merged in and then update the dependency tree and cut a new winston version that would still be 12-compatible. Or, we could add a section to the README of winston (or somewhere like that) that indicates the last winston version known to be compatible with a given Node version. Thanks!

Thanks for replying! I will try to update node version for these old projects first.

[manuelguzmandao]

I've forced version 2.0.2 of @dabh/diagnostics in this fork: https://github.com/manuelguzmandao/winston/releases/tag/v3.13.0.0001 as a temporary workarround while waiting for the PR to be merged. This is temporary and will not be maintained.

[fuqi1001]

I've forced version 2.0.2 of @dabh/diagnostics in this fork: https://github.com/manuelguzmandao/winston/releases/tag/v3.13.0.0001 as a temporary workarround while waiting for the PR to be merged. This is temporary and will not be maintained.

Thank you so much!

We have upgrade our legacy projects to updated node version and resolved the dependency issues.

[IamLizu]

We also faced this in a legacy project running on Node 14, we patched @so-ric/colorspace@1.1.6,

diff --git a/node_modules/@so-ric/colorspace/dist/index.cjs.js b/node_modules/@so-ric/colorspace/dist/index.cjs.js
index 5524824..977deb3 100644
--- a/node_modules/@so-ric/colorspace/dist/index.cjs.js
+++ b/node_modules/@so-ric/colorspace/dist/index.cjs.js
@@ -155,7 +155,7 @@ const reverseNames = Object.create(null);
 
 // Create a list of reverse color names
 for (const name in cssKeywords) {
-	if (Object.hasOwn(cssKeywords, name)) {
+	if (Object.prototype.hasOwnProperty.call(cssKeywords, name)) {
 		reverseNames[cssKeywords[name]] = name;
 	}
 }
@@ -257,7 +257,7 @@ cs.get.rgb = function (string) {
 			return [0, 0, 0, 0];
 		}
 
-		if (!Object.hasOwn(cssKeywords, match[1])) {
+		if (!Object.prototype.hasOwnProperty.call(cssKeywords, match[1])) {
 			return null;
 		}
 
@@ -1973,7 +1973,7 @@ function getset(model, channel, modifier) {
 	model = Array.isArray(model) ? model : [model];
 
 	for (const m of model) {
-		(limiters[m] ||= [])[channel] = modifier;
+		(limiters[m] = limiters[m] || [])[channel] = modifier;
 	}
 
 	model = model[0];
@@ -2021,7 +2021,7 @@ function zeroArray(array, length) {
 }
 
 function getDefaultExportFromCjs (x) {
-	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
+	return x && x.__esModule && Object.prototype.prototype.hasOwnProperty.callProperty.call(x, 'default') ? x['default'] : x;
 }
 
 /***

[tungle203]

I fixed that bug by downgrading Winston to version 3.2.1