RFC: remove node packages

[gilligan]

I just had a look at node-packages-generated.nix. While I didn't go through every single package basically any package that I picked out was utterly outdated. I sure hope nobody is relying on those packages and so I currently see little value in having those.

In #13103 (comment) @svanderburg comments:

The only NPM packages that should be in Nixpkgs IMO are:

• Command-line utilities/end-user programs
• Library packages that are dependencies of non-NPM packages

I would thus suggest to do exactly that: remove most of node-packages.json leaving only what falls into one of the two categories above.

It is too bad that interfacing with npm is such a flakey business so the integration cannot be automated further to allow for up to date packages with less manual work. Which is exactly the reason why the scope of included node packages should be limited.

I'm happy to provide a PR if this OK with everyone.

/cc @zimbatm @lo1tuma

[zimbatm]

+1

We should take the same approach as ruby where default patches are provided for common packages, mostly for adding the missing buildInputs.

Then developers use npm2nix (bundix with ruby) to generate the dependency list for each program that is going to be added to nixpkgs (or their own programs). Each program has their own dependency set but that's fine. Building a single plane of all the node packages, all working together is not a tenable solution as it's exponential in complexity and probably even not possible.

Note that if each npm package is in it's own derivation then it's still possible to share code between projects even if the dependency set is declared independently. Hopefully in the future we will have some tool that is capable to run over all of our node projects and tries to nudge versions together to reduce the overall closure size.

[flosse]

+1

[joachifm]

So, merge it?

[garbas]

+1

i think this should also be done for python packages. any thoughts on this @domenkozar @FRidh of-course not jumping into it but to gradually going toward that.

[FRidh]

@garbas
Regarding Python, we have outdated packages, but many are still used. The problem is the burden of updating versions/urls/hashes manually, and that we have to resolve (#15480). While I don't know much about Node I suppose the problem is the same there in the end.

[bobvanderlinden]

Just to give another alternative, what I've done for my applications is generate npm-shrinkwrap.json, create a builder that runs npm install with the npm-shrinkwrap.json, remove varying files/options that npm install creates and sha256 the entirety of the resulting node_modules.

An implementation of the builder I'm using can be found here: https://gist.github.com/bobvanderlinden/4d02b7fdc6f3c52eda188f95667e3915

The downside is that this only works for dependencies without compiled binaries, as the resulting node_modules must always be exactly the same. Won't work for all purposes, but did for my projects.

[matthewbauer]

Is it okay to close this? At least this seems like a step in the wrong direction to me.

I think the root problem is that we just don't have anyone willing to put in the work to keep it updated. I think this can be solved by automating the process similar to how @r-ryantm works. If anyone is interested in this, I have opened an issue to look into it: nix-community/nixpkgs-update#12.

[stale]

Thank you for your contributions.
This has been automatically marked as stale because it has had no activity for 180 days.
If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity.
Here are suggestions that might help resolve this more quickly:

1. Search for maintainers and people that previously touched the
   related code and @ mention them in a comment.
2. Ask on the NixOS Discourse. 3. Ask on the #nixos channel on
   irc.freenode.net.

[patka-123]

I guess this is no longer an issue by now. If no one responds in a week then I'll go ahead and close this issue. Ofcourse always feel free to reopen or create a new one at any time!

(I'm going through old issues marked as stale to see what can be triaged.)

[JohnRTitor]

Closed per above discussion.