[Bug]: Winston 2.4.6 is not node 4 compatible

[ansmithf5]

🔎 Search Terms

node 4, async, async 3.2.3

The problem

Winston 2.4.6 is no longer compatible with node v4. From the error messages, we believe the issue is due to this Pull Request: #2112

It seems that async 3.2.3 is not compatible with node 4, and back porting to Winston 2.X brings that incompatibility.

What version of Winston presents the issue?

v2.4.6

What version of Node are you using?

v4.9.1

If this worked in a previous version of Winston, which was it?

v2.4.5

Minimum Working Example

No response

Additional information

No response

[wbt]

I suggest updating off of node 4, and pinning prior to that if needed - the async issue is likely not your only security hole.

[ansmithf5]

Regrettably, due to legacy hardware constraints we are forced to support node 4. We have locked down our Winston version to 2.4.5, to avoid the incompatibility issue. Normally, I wouldn't have said anything, but the Winston CHANGELOG indicated that node 4 support was being phased out in Winston 3.X. So I figured I'd mention something just in case other consumers were also using node 4.

[wbt]

Do you have an alternative proposal, such as a version of async without the vulnerability which supports node 4?

[ansmithf5]

After some investigation, it seems that async 2.6.4 would have that same security fix as well as have node 4 support. We tested locally and it seems to work.

[wbt]

Feel free to make a PR using 2.x as the base branch. Maybe also change the test setup a bit to check for that.

[ansmithf5]

Thank you for your feedback. We'll begin working on getting a PR up for you to review.