node-sass using node-gyp v3.8.0 when v5.0.3 is out is there a reason?

[jasonwilliams]

as title.

node-sass seems to be using an old version of node-gyp (which then pulls in old dependencies), but looks like node-gyp is now on v5.0.3.

Can node-sass bump to this version?

https://github.com/sass/node-sass/blob/master/package.json#L67

[xzyfer]

4.0.0 breaks support for old node.

[jeffrson]

Well, newer node-gyp can use Python3 - which is important when Python2 will be end-of-life at the end of 2019. So you definitely should move on.

[omarlara]

@xzyfer any plan to upgrade node-gyp 6.0.0? Python2 will be losing support at the end of 2019.

[jkim7]

Yes I'd also like this upgraded, it introduces a file cb-never-called-1.0.1.tgz which throws a malware warning on my antiviruse

[mitchellmebane]

@xzyfer node-gyp@6.0.1 requires Node >= 6.0.0. Node 4.x has been EOL since April 2018, and Node 5.x has been EOL since June 2018. If you're concerned about strictly following semver, could you please consider cutting a 5.x release with just a node-gyp bump? The Python 2 dependency is going to start being a very big pain point for many users in the coming months.

[LC43]

can this be reconsidered?

there's two three vulnerabilities related to old version. Latest node-gyp@6.0.1 uses tar@4.4.12 which clears :

• https://www.npmjs.com/advisories/606
• https://www.npmjs.com/advisories/803
• https://www.npmjs.com/advisories/886

[qnighy]

What is blocking this from happening other than compatibility things, which can be addressed by what @mitchellmebane said?

[boggsey]

Python 2 is now EOL and the latest versions of node-gyp now support Python 3. Node 8 is also EOL. Would love to see node-sass bump this up.