# Updated sourcecred dependencies and node version

**URL:** <https://discourse.sourcecred.io/t/updated-sourcecred-dependencies-and-node-version/123>\
**Category:** Didathing\
**Created:** [July 7, 2019, 10:00am UTC](https://discourse.sourcecred.io/t/updated-sourcecred-dependencies-and-node-version/123 "2019-07-07T10:00:03Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![decentralion](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sourcecred.io/decentralion/32/7_2.png) [@decentralion](https://discourse.sourcecred.io/u/decentralion)\
**Post date:** [July 7, 2019, 10:00am UTC](https://discourse.sourcecred.io/t/updated-sourcecred-dependencies-and-node-version/123/1 "2019-07-07T10:00:03Z")

</div>

A fairly technical #didathing: over the past few days, I’ve updated almost all of SourceCred’s dependencies. I also enabled Greenkeeper, so that our deps will now get updated automatically.

Dependency upgrades are one of those things where the longer you wait, the more gnarly they become. At this point, many of the deps were months out of date, so the process was somewhat gnarly – but less gnarly than it would have been if we’d waited another half a year. 🙂

Once all the dependencies were up-to-date, I focused on adding full SourceCred support for node 10 and node 12. Prior to this work, `yarn test --full` only passed for node 8. Node 8 is pretty old (it goes out of LTS at the end of the year) and many new contributors arrive with a newer version of node. So, it’s just good form to ensure we support new versions of node.

However, supporting node 10 and above proved pretty tricky. The issue was that the test failure on recent nodes was _weird_. First, some context: we have a script [build\_static\_site.sh](https://github.com/sourcecred/sourcecred/blob/6738947083d6682ef8fb7b6b6bc4b061fde15a3b/scripts/build_static_site.sh) which is responsible for producing statically-servable versions of SourceCred. This is how we produce the website over at [sourcecred.io](https://sourcecred.io). Since it’s a vital piece of infrastructure, we also have [sharness tests](https://github.com/sourcecred/sourcecred/blob/6738947083d6682ef8fb7b6b6bc4b061fde15a3b/sharness/test_build_static_site.t) for it. One of those tests needs to verify that the site is being built with the right repositories loaded. The repositories are provided via an environment variable, and to test it, we have a fairly hacky approach: when the SourceCred server starts, it [logs that environment variable to console](https://github.com/sourcecred/sourcecred/blob/6738947083d6682ef8fb7b6b6bc4b061fde15a3b/src/homepage/server.js#L19) so that the test can [grep for it](https://github.com/sourcecred/sourcecred/blob/6738947083d6682ef8fb7b6b6bc4b061fde15a3b/sharness/test_build_static_site.t#L216) and ensure it was set properly.

That all worked fine in node 8. However, in node 10 and above, the test failed… because the server never logged anything. The code ran as expected, but the `console.log` statement had no side effect. I did some experimenting, and concluded that it had to do with the [static-site-generator-webpack-plugin](https://github.com/markdalgleish/static-site-generator-webpack-plugin) which we depended on. With some more experimentation, I created a minimal reproduction of the issue using that plugin, and then started to dive into the code for the plugin itself. (One of the wonderful things about open-source is that you can always dive into bugs to try to understand them, and perhaps fix them, yourself.) Fortunately, the plugin was only around 200 lines of code. It depended on a little-known npm package called [eval](https://www.npmjs.com/package/eval) to run the server script… and it was eval’s behavior that changed between node 8 and node 10. The root issue was that eval used `Object.keys(global)` to find the global properties (e.g. `console`) to provide to evaluated scripts. However, node 10 [made console non-enumerable](https://github.com/nodejs/node/pull/17708). And that meant that on node 10 and above, `eval`'d scripts could no longer use `console.log`.

I sent off a [fix to eval](https://github.com/pierrec/node-eval/pull/18) and the maintainer swiftly merged it and re-released it. (Open-source happy times yet again!) Once the fix was available, I [updated our lockfile](https://github.com/sourcecred/sourcecred/pull/1204) to ensure that we’d always use the version of `eval` that works properly. And with that, the last barrier to using node 10 and node 12 with SourceCred was gone!