Raise npm min version to 8.x.x

[skjnldsv]

To not pollute the main ticket.
from @vinicius73

All current installation of Node 16 will use NPM v8
And NPM v8 have some important particularities who look relevant.

npm@8 will refuse to install in node versions it doesn't work with
npm/rfcs#445

This particular behaviour is very important to prevent more correlated issues about NPM and Node version in any project.

The first LTS version of Node 16 uses NPM8

Version	LTS	Date	npm
Node.js 16.15.1	Gallium	2022-06-01	8.11.0
Node.js 16.15.0	Gallium	2022-04-26	8.5.5
Node.js 16.14.2	Gallium	2022-03-17	8.5.0
Node.js 16.14.1	Gallium	2022-03-16	8.5.0
Node.js 16.14.0	Gallium	2022-02-08	8.3.1
Node.js 16.13.2	Gallium	2022-01-10	8.1.2
Node.js 16.13.1	Gallium	2021-12-01	8.1.2
Node.js 16.13.0	Gallium	2021-10-26	8.1.0
Node.js 16.12.0		2021-10-20	8.1.0

[skjnldsv]

npm@8 will refuse to install in node versions it doesn't work with

npm/rfcs#445

Which is all good, npm8 supports 12 and above 🤷

npm@8 drops support for node<12
npm@8 will refuse to install in node versions it doesn't work with

You can still install older node16 versions. I wanted to stay safe.

[skjnldsv]

From @st3iny

Also, some distros still ship NPM 7 by default (e.g. Debian).

[st3iny]

To elaborate on my point: Ideally, we should all use NVM to manage our node versions independently of our distros. However, we should also pay attention to default NPM versions of popular distros to make it easier for new contributors.

[vinicius73]

I've checked the Debian Node and NPM versions.
As expected, Debian Stable/LTS version do not use Node v16, also the testing versions uses Node v16 and NPM v8.

Debian	Released At	Status	Node	NPM
Stretch v9	2017-06	Old Stable	Node v4.8	-
Buster v10	2019-07	Old Stable	Node v10.24	NPM v5.8
Bullseye v11	2021-08	Stable	Node v12.22	NPM v7.5
Bookworm	-	Testing	Node v16.15	NPM v8.13
Sid	-	Experimental	Node v16.15	NPM v8.13

In Node download pages we are redirected to NodeSource binaries and install scripts.

After install Node v16, we got NPM 8

curl -fsSL https://deb.nodesource.com/setup_lts.x | bash -
apt-get install -y nodejs

node --version 
#> v16.15.1

npm --version 
#> 8.11.0

Do not look reasonable to me, keep the NPM v7, when it is not used in any combination of those examples.

---

Docker images test

For my suprise, even if Ubuntu 22.04 uses Node v14, its ships NPM v8 inspead of NPM v7
Fedora 36 uses Node 16 and NPM v8

apt update
apt install nodejs -y
apt install npm -y

Stretch v9

docker run -it --rm debian:stretch bash

nodejs --version 
#> v4.8.2

npm --version 
#> npm: command not found

Buster v10

docker run -it --rm debian:buster bash

nodejs --version 
#> v10.24.0

npm --version 
#> 5.8.0

Bullseye v11

docker run -it --rm debian:bullseye bash

nodejs --version 
#> v12.22.12

npm --version 
#> 7.5.2

Debian Bookworm

docker run -it --rm debian:bookworm bash

node --version 
#> v16.15.1

npm --version 
#> 8.13.1

Debian Sid

docker run -it --rm debian:sid bash

node --version 
#> v16.15.1

npm --version 
#> 8.13.2

Ubuntu 22.04

docker run -it --rm ubuntu:22.04 bash

node --version 
#> v12.22.9

npm --version 
#> 8.5.1

Fedora 36

docker run -it --rm fedora:36 bash

dfn update
dnf install node

node --version 
#> v16.14.0

npm --version 
#> 8.3.1

OpenSuse Leap 15

docker run -it --rm opensuse/leap:15 bash

zypper install nodejs16
zypper install npm

node --version 
#> v16.14.1

npm --version 
#> 8.5.0

OpenSuse allows to choose any version of Node.
Onse I've installed npm16 package where available, and install npm v8

[vinicius73]

I'm used to using n to manage my Node versions.
Every time when I change Node version, N uses the correlated version of NPM

sudo n lts
#> installed : v16.15.1 (with npm 8.11.0)

sudo n 14
#> installed : v14.19.3 (with npm 6.14.17)

[skjnldsv]

What if I want a specific version of node 16? 🤷

10:42 [admin@workstation] ~% nvm install 16.2.0                                                                                                                                                                                                                                                                     -3- 
Downloading and installing node v16.2.0...
Downloading https://nodejs.org/dist/v16.2.0/node-v16.2.0-linux-x64.tar.xz...
######################################################################################################################################################################################################################################################### 100,0%
Computing checksum with sha256sum
Checksums matched!
Now using node v16.2.0 (npm v7.13.0)

[st3iny]

Wow, Bullseye is still on Node 12?! Thanks for your in-depth research.

[max-nextcloud]

What if I want a specific version of node 16? shrug

wouldn't npm install npm@8 do the trick on node v16.2.0?

[skjnldsv]

What if I want a specific version of node 16? shrug

wouldn't npm install npm@8 do the trick on node v16.2.0?

Yes, but that's beyond my point of "staying compatible with all node versions" :)
I'm also fine raising to npm 8, just stating that the versions out there are much wider and various that we thought 🙈

[jotoeri]

Ok - so i think i would also still keep npm MIN-version at 7. Just because there are Versions of Node 16, that install by default with npm 7 and that should work out of the box (and as far as i see, 'out of the box' is a common argument). Alternative would imo only be to increase the node version further to ^16.11, thus to explicitely exclude all versions, that come with npm7.

( ... comment to be continued in #7 )

[vinicius73]

Can we move forward with NPM v8?