Yarn installation errors (and npm installation warnings) under node 4.x

[ethanherbertson]

This is a Bug Report

Description

For bug reports:

• What went wrong?
  Installing serverless with yarn under node 4.8.4 raises an error due to node version incompatibility with punycode (punycode v2.x requires node 6+).
  Installing serverless with npm under node 4.8.4 raises a warning about the same.
  (NOTE: The incompatibility comes from nested dependencies, not from serverless's direct dependency on punycode. Specifically, the problem is coming from json-refs -> uri-js -> punycode,)
• What did you expect should have happened?
  Serverless explicitly supports node 4+ according to its package.json file, so I would expect installation to succeed without errors in yarn, and to succeed without warnings in npm.
• What was the config you used?
  n/a
• What stacktrace or error message from your provider did you see?
  See screenshots below. (The npm warning shown is actually from your own Travis build.)

For feature proposals:

• What is the use case that should be solved. The more detail you describe this in the easier it is to understand for us.
• If there is additional config how would it look

Similar or dependent issues:

• n/a

Additional Data

• Serverless Framework Version you're using: 1.26.0
• Operating System: RHEL6, with node 4.8.4, npm 2.15.11, and yarn 1.0.2
• Stack Trace:
• Provider Error messages:
  
  

Further notes

There is a workaround for yarn installs, which is to add the --ignore-engines flag to the yarn installation command. The framework seems to work under node 4 despite the error/warning about punycode; it's entirely possible that Serverless does not actually hit those parts of json-refs that require those parts of uri-js that requires punycode. However, adding that flag means we are at greater risk of sudden breakages due to future incompatibilities (and without adding that flag we can't install recent versions of Serverless with our package manager of choice—yarn).

[ethanherbertson]

I have filed issues on json-refs and uri-js as well, to hopefully get them to update their engine dependencies.

whitlockjc/json-refs#132

garycourt/uri-js#27

[ethanherbertson]

Another workaround, perhaps less dangerous than the --ignore-engines flag, would be to explicitly override yarn's resolution for uri-js's dependency on punycode in our package.json:

{
  "dependencies": {
    "serverless": "^1.26.1"
  },
  "resolutions": {
    "**/uri-js/punycode": "1.4.1"
  }
}

With that resolution override in place, the error from yarn is reduced to a warning:

[kibertoad]

@ethanherbertson Do people still use Node 4 in production? I'm curious if there are any good reasons to keep supporting it.

[ethanherbertson]

The market share for node 4 is definitely dwindling, and indeed my group is mostly working with node 6 and node 8 in our projects now.

Since node 4 is no longer receiving security updates, it's probably reasonable to stop supporting it explicitly in package.json, rather than addressing this (essentially upstream) issue.

[kibertoad]

@ethanherbertson Created a PR for that: #5331

[pmuens]

Thanks for opening @ethanherbertson 👍

Yes, our current plan is to drop Node 4 support. Additionally we don't "officially" support yarn. I'll close this issue for now since @kibertoad already PRed a fix for that and we'll continue the discussion in the PR.