v5.4.0 uses a git dependency

[tyroneerasmus]

Description

This package now pulls its auth0 dependency from a branch in a git project (git://github.com/auth0/node-auth0.git#actionsManager), which makes it unsuitable for production use.

See: https://github.com/auth0/auth0-deploy-cli/blob/master/package.json#L30

This branch could change making different installations of this package behave differently (which is an undesirable trait for production use). I understand if this was an alpha version of the library, but does not feel like this should be done in release versions.

Reproduction

I initially discovered this because our build environment pulls dependencies through a proxy, and it was blocking the installation of this package because we have not allowed the port that git:// uses.

Environment

• Version of this library used: 5.4.0

[brad-fitzwater]

Also, it looks like node-auth0 has a vulnerability in a dependency being tracked: auth0/node-auth0#568. PR is here: auth0/node-auth0#567.

Can we get some guidance on how the upgrade will work, given the current state of the dependency?

[brad-fitzwater]

@shushen - is it possible to use the released node-auth0 library instead of the actionsManager branch? It looks like auth0/node-auth0#567 has been merged.

Sorry if you are not the correct person to ping.

[shushen]

@brad-fitzwater The git reference was to include a beta release of node-auth0 for Actions Beta support. We will look into if we can change to https instead of git protocol for the dependency. Would that be helpful?

[brad-fitzwater]

@shushen - No, I don't think simply changing the protocol would resolve this. auth0-deploy-cli is currently at 6.0.0, which makes me think it is stable. However, it depends on a branch of node-auth0 that is currently months stale and not getting updates. In fact, auth0/node-auth0#570 is currently tagged with DO NOT MERGE, which is concerning. When will auth0/node-auth0#570 be merged?

I have used auth0-deploy-cli in our CI/CD process for a while and it works great, but I cannot upgrade until it uses the official node-auth0 dependency.

Edit: regarding the update I needed (auth0/node-auth0#567), I realized I can get this update by uninstalling, then reinstalling the same version of auth0-deploy-cli because it's a transitive dependency. I still agree with the original issue that the auth0-deploy-cli needs to use the official node-auth0 library instead of a branch.

[mendhak]

Can confirm, 5.4.0 is breaking our builds/deployments. Please can this get some attention?

I think there are two issues here -

First issue, switching to https should help those of us behind proxies.

Second is the 'stability' issue whhich @brad-fitzwater points out

[shawnmclean]

Would a short term solution of locking the version of the tool in your CI to the previous version unblock you until we sort this out?

[tyroneerasmus]

This is fine but please be aware that anyone using the new security keys MFA cannot use a version older than 5.4.0

See #288

[gavinhenderson]

We also ran into the problem that our CI would not allow us to make install a dep from a url with git://. We solved it by pinning to 5.3.0, admittedly we aren't that happy with this solution.

It seems misleading to have released a major version that depends, via git on an unstable release of a separate package. I would have hoped we could trust major versions to be stable.

[shawnmclean]

@tyroneerasmus I'm about to un-release (deprecate on npmjs) 5.4.0. However in your comment on #288 you said 5.4.0 fixes that. I am not seeing any changes in the release diffs that would explain why that works.

There is a dependency bump that may have contained a fix (still not seeing what code changed to fix your issue).

However, if you pin to 5.4.0, even though its deprecated, it should still be installed.

[shawnmclean]

👋 Hi all, so what have I done?

On NPM:

1. Deprecate 6.0.0
2. Deprecate 5.4.0
3. Made 5.3.2 the latest
4. Published 6.0.1-beta.0 on the beta tag.

On Github:

1. Remove 6.0.0 and 5.4.0 releases (tags still remain for posterity).
2. Create a new beta branch to track the actions beta changes until its production ready. [DO NOT MERGE] Actions Beta Support #306.
3. Create a 6.0.1-beta.0 pre-release for the current actions beta changes.
4. Clean up master of all beta code. Remove all actions commits. #305

Expected outcome:

• Unbreak CI who didn't pin the auth0-deploy-cli versions. Unpinned version should resolve to 5.3.2.
• Major bump of 6.0.x should be under a pre-release tag that should make it a bit clearer that the version isn't production ready (no git reference for dependencies)
• For anyone on the 6.0.0 release, they can go back. to 5.3.1 or anything labeled latest on npmjs if they are not using the actions beta features.

If the expected outcomes are not met, let us know.

We are sorry for the confusion and inconvience these set of changes have caused and hopefully this will cleanup things a bit.

[tyroneerasmus]

Thanks @shawnmclean - actions taken make sense to me