
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
please-upgrade-node
Advanced tools
Displays a beginner-friendly message telling your user to upgrade their version of Node
The please-upgrade-node package is designed to help Node.js developers ensure that their applications are run with a minimum required version of Node.js. It provides a simple way to enforce a version constraint, displaying a message to users to upgrade their Node.js version if the current environment does not meet the specified requirements. This is particularly useful for CLI tools or applications where the developer wants to prevent execution in unsupported Node.js environments.
Enforcing minimum Node.js version
This feature allows developers to specify a minimum Node.js version requirement in their package.json file. When the application or tool is run, please-upgrade-node checks the current Node.js version against the specified minimum version. If the current version is lower, it displays a message urging the user to upgrade their Node.js installation. The 'pkg' variable represents the package.json of the application, which should include a 'engines' field specifying the required Node.js version.
require('please-upgrade-node')(pkg)
Similar to please-upgrade-node, check-node-version allows developers to specify version requirements for Node.js, npm, and Yarn. It can be used as a command-line tool or integrated into scripts. Unlike please-upgrade-node, which is focused solely on Node.js versions, check-node-version provides broader version checking capabilities, making it suitable for projects that also need to enforce npm or Yarn version constraints.
engine-check is another package that offers functionality similar to please-upgrade-node by enforcing engine version requirements specified in the package.json file. It can be used as a preinstall or prestart script to ensure that the Node.js environment meets the specified version requirements before proceeding. Compared to please-upgrade-node, engine-check provides a more automated approach to version enforcement, directly integrating with npm lifecycle scripts.
:information_desk_person: show a message to your users to upgrade Node instead of a stacktrace
It's common for new Node users to miss or not understand engines warning when installing a CLI. This package displays a beginner-friendly message if their Node version is below the one expected.
$ node -v
0.12
$ modern-cli
modern-cli requires at least version 6 of Node, please upgrade
If you like this project, you can support me on GitHub Sponsors
npm install please-upgrade-node
Add please-upgrade-node
at the top of your CLI
#!/usr/bin/env node
const pkg = require('./package.json')
require('please-upgrade-node')(pkg) // <- Must run BEFORE requiring any other modules
// ...
Set in your package.json
the required Node version
{
"engines": {
"node": ">=6"
}
}
Important: >=
is the only operator supported by please-upgrade-node
(e.g. >=6
, >=6.0
, >=6.0.0
).
You can set custom exitCode
and message
function if needed
pleaseUpgradeNode(pkg, {
exitCode: 0, // Default: 1
message: function(requiredVersion) {
return 'Oops this program require Node ' + requiredVersion
}
})
Important: to keep message
function compatible with older versions of Node, avoid using ES6 features like =>
or string interpolation.
Thanks to zeit/serve for the error message inspiration.
MIT - Typicode :cactus: - Patreon
FAQs
Displays a beginner-friendly message telling your user to upgrade their version of Node
The npm package please-upgrade-node receives a total of 4,800,743 weekly downloads. As such, please-upgrade-node popularity was classified as popular.
We found that please-upgrade-node demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.