[Pkg-javascript-devel] Bug#959780: Insufficint dependency on readable-stream/writable

[chrysn]

Package: node-node-sass
Version: 4.13.1-3
Severity: normal
File: /usr/bin/node-sass

On my current sid system, a plain node-sass invocation results in:

    guest at hephaistos:/tmp$ node-sass
    internal/modules/cjs/loader.js:638
        throw err;
        ^

    Error: Cannot find module 'readable-stream/writable'
        at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
        at Function.Module._load (internal/modules/cjs/loader.js:562:25)
        at Module.require (internal/modules/cjs/loader.js:692:17)
        at require (internal/modules/cjs/helpers.js:25:18)
        at Object.<anonymous> (/usr/lib/x86_64-linux-gnu/nodejs/node-sass/node_modules/stdout-stream/index.js:2:16)
        at Module._compile (internal/modules/cjs/loader.js:778:30)
        at Object.Module._extensions..js (internal/modules/cjs/loader.js:789:10)
        at Module.load (internal/modules/cjs/loader.js:653:32)
        at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
        at Function.Module._load (internal/modules/cjs/loader.js:585:3)

The node-readable-stream is installed as a depdendency (see below), but
still something internal seems not to find it.

A strace shows that node is looking for a file
/usr/lib/nodejs/readable-stream/writable.js that was present in
node-readable-stream 2.3.6-1 but is not in 3.4.0-2. (But I was not
successful in installing the stable package on the sid system as things
break in other places then.

I tried to track down the offending stdout-stream file to the upstream
sources, and found that the part that causes the dependency breakage
witht the newer readable-stream is not in the master source itself but
in stdout-stream that gets pulled in through debian/watch as a ...
dunno, shipped dependency?

From looking into what exists as latests versions, I don't quite see how
this can work for anyone (given that node-sass requires stdout-stream
^1.4.0 even in the latest version, and the latest stdout-sream is 1.4.1
which still uses readable-stream/writable which in term is absent from
the latest release. As a partial workaround, I've removed all std-stream
references from a local copy of the package (debian/gbp.conf,
package.json, bin/node-sass both the dependency and the single logging
use of stdout) -- just to end up with the same errors I got when I had
the older node-readable-stream installed, indicating that there might be
an unrelated different issue (then in node-read-pkg) waiting after this
is resolved.

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.6.0-rc4 (SMP w/8 CPU cores)
Kernel taint flags: TAINT_WARN, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages node-node-sass depends on:
ii  libc6                 2.30-4
ii  libgcc-s1             10-20200418-1
ii  libnode64             10.20.1~dfsg-1
ii  libstdc++6            10-20200418-1
ii  node-chalk            2.4.2-1
ii  node-cross-spawn      5.1.0-2
ii  node-get-stdin        6.0.0-1
ii  node-glob             7.1.6-1
ii  node-globule          1.3.0-1
ii  node-gyp              6.1.0-3
ii  node-lodash           4.17.15+dfsg-2
ii  node-meow             3.7.0-1
ii  node-mkdirp           0.5.1-2
ii  node-nan              2.14.0-1
ii  node-npmlog           4.1.2-2
ii  node-readable-stream  3.4.0-2
ii  node-request          2.88.1-4
ii  node-source-map       0.7.0++dfsg2+really.0.6.1-4
ii  node-yargs            15.3.0-1
ii  nodejs                10.20.1~dfsg-1

node-node-sass recommends no packages.

node-node-sass suggests no packages.

-- no debconf information
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-javascript-devel/attachments/20200505/1689709d/attachment.sig>