nodejs June 2026

nodejs@lists.fedoraproject.org

1 participants
2 discussions

binary content in node_modules
by Gordon Messmer 28 Jun '26

28 Jun '26

OK, since the package review last weekend, I've been reading documentation, discussion threads, and running various experiments with LLMs. Among other things, because dependencies installed in node_modules don't necessarily have their own devDependencies installed, I think the only reasonable way to bundle dependencies is to not bundle any module that contains native binaries or Wasm files, and to require those modules to be installed as system modules. ( Ref: https://github.com/orgs/community/discussions/199880 ) To aid future package reviews of all types, I've suggested a change to fedora-review that will scan for native binaries in source archives: https://forge.fedoraproject.org/packaging/FedoraReview/pulls/553 Eventually I found "npm2rpm" which I think could reasonably replace nodejs-packaging-bundler and probably package "source.sh" scripts, if it were able to detect modules with binaries or Wasm and avoid bundling those. They'd need to be provided as system packages. I've offered such a feature to the developers of that project: https://github.com/theforeman/npm2rpm/pull/93 Additionally, I have another branch in my fork that adds more Fedora-specific changes to the spec template: https://github.com/gordonmessmer/npm2rpm/tree/fedora-spec Finally, I've written a draft update of the packaging guidelines, if npm2rpm replaces nodejs-packaging-bundler: https://forge.fedoraproject.org/packaging/guidelines/pulls/1553

1 0

binary content in node_modules
by Gordon Messmer 17 Jun '26

17 Jun '26

I've started a review of a nodejs package, and its node_modules include wasm and native binaries. I wanted to provide the packager with examples of packages that fix up their node_modules properly, but I'm actually a little confused by what I found. I picked nodejs-undici for reference, since it has a sources script: https://src.fedoraproject.org/rpms/nodejs-undici/blob/rawhide/f/undici-sour… That script removes wasm and rebundles the code, but only for the program itself. It's not stripping the node_modules directories of pre-built content. The prod directory is relatively small and I didn't see any pre-built binaries, but the dev directory contains "esbuild" ELF binaries. Shouldn't node_modules be stripped of this kind of content before uploading source? What package would you recommend as an reference example?

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

nodejs June 2026