fix: include default max_old_space_size in binaries [HEAD-1045]

[cat2608]

• Tests written and linted ℹ︎
• Commits are squashed and tidy and are suitable to become release notes

What this does

This PR introduces a change in the packaging command for our binaries to specify a default maximum old space size for V8's memory. The change was prompted by the need to accommodate larger projects that may require more memory than the default settings allow.

A change in the pkg-fetch repository (see vercel/pkg-fetch@7f3403b) disabled the NODE_OPTIONS environment variable, which previously allowed consumers to set Node.js runtime options, including --max-old-space-size, at runtime. This has impacted users who need to increase the memory limit beyond the default when running the snyk-to-html tool.

Given that we cannot rely on NODE_OPTIONS, this PR takes the approach of setting a conservative default memory limit at build time using the --options max_old_space_size=16384 flag. This will set the old space size to 16GB, which should suffice for the majority of use cases without manual intervention.

Notes for the reviewer

To be able to test this change I added a log like the following:

async function main() {
  console.log(
    'Heap size limit:',
    v8.getHeapStatistics().heap_size_limit / 1024 / 1024,
    'MB',
  );
}

and we can see the output in the following image:

More information

HEAD-1045
HEAD-1051

[PeterSchafer]

Suggestion: I think we should pin the version and not use latest all the time.

[cat2608]

Which version do you mean? For the pkg tool?

[PeterSchafer]

yes, npm i -g pkg installs the latest version of pkg

[cat2608]

Could you please share more about the benefits you see in pinning, and what issues we're aiming to prevent?

Pinning does bring build stability, but considering that pkg is just a build tool and our pipeline doesn't run often as far as I can see, I'm more concerned about being outdated over time and missing bug fixes or improvements of the tool.

[PeterSchafer]

• Currently also major upgrades will be included even breaking changes, which is problematic.
• PKG is not just a build tool, it determines which node version is being bundled in the binaries.
• Pinning doesn't mean to not consume bugfix releases, but at least not automatically consume major changes.

[github-actions]

🎉 This PR is included in version 2.3.8 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release
• v2.3.8

Your semantic-release bot 📦🚀