RFC: Change Node.js default version from v0.12 to v4

[Dannyzen]

Hi There,

Currently, the Node.js buildpack will assume that a user who has not explicitly defined a version of node.js in their package.json will want to use v0.12. As of April 2016 [1] the Node.js long term support release schedule will only support 0.12 in a maintenance capacity.

In order to provide users with a longer active LTS schedule we are proposing to change the default version from v0.12 to v4.

Our preference is to move forward with the change to the buildpack by 3/15/2016. If you have any concerns or feedback please comment on this issue.

[1] - https://github.com/raw/nodejs/LTS/master/schedule.png

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this. You can view the current status of your issue at: https://www.pivotaltracker.com/story/show/114726087.

[flavorjones]

Potentially relevant to the Node community's decision to consent to this change is the fact that Node 4.x and later vendors openssl 1.0.2.

This means that, with Node 4.x and later, when there's a security vulnerability in openssl (like the one about to be patched), that a rootfs upgrade is not sufficient to address the vulnerability.

This was discussed in detail in the original RFC for Node 4.x support.

With that in mind, I'd really like to hear "yay" votes from the CF Node developer community.

[Dannyzen]

Update: We've received two comments supporting this change.

• The original pull request Latest stable version number incorrect #46
• A +1 on the announcement thread

We plan to make this change later this week. If there are any concerns please comment on this issue.

[RochesterinNYC]

Closing this as this has been implemented (https://www.pivotaltracker.com/story/show/115599647) and has been released on master and release v1.5.9 of the node-js buildpack.