EFI: Using Node.js core testing

[sheplu]

Motivation

Some testing libraries (and ecosystem) are a lot less maintained that a few years ago, and relying on them can be an issue or a maintenance burden in the coming years. Using the default test runner from Node.js core (part of Node.js 20) would give us a few advantages that ranges from better performances to lower security risks from third party libraries.
Some features may not be available now, so this discussion may be pushed back (or waiting to only keep version that support the Node.js test ecosystem).

Expectation

Slowly move and use the test runner in all libraries

Implementation

Update Node.js version
Use test runner ecosystem (test library, assertion, runner, coverage...)

Status

Part: Technical
Status:

Draft

Node.js now provides a complete (or almost) test ecosystem, including runners and reporters. Using that part of the stack to replace external dependencies for tests would lower the number of dependencies and reduce the maintenance

[dougwilson]

I think the minimum Node.js version that has the twsts in Node.js is still much too new for the Express.js project in the short to medium term.

[sheplu]

The main issue is that the version below 18 are not supported and can be at risk, for example - if my memory is right, it is a previous openSSL version running and said version is now deprecated (and may be a security issue)

[dougwilson]

Ya, but Express.js supporting them doesn't mean users have to use them. I have to use Node.js low versions for various reasons and have very strong opinion on supporting old versions I need.

[dougwilson]

The Express.js TC has always been aligned on only dropping Node.js support as strictly required, and for a test suite when the current one works perfectly fine seem a bit excessive

[UlisesGascon]

I think that this initiative will be blocked until we have a solid plan for #194

[wesleytodd]

I think we should rename the initiative which would cover both of these (and maybe a few more) to LTS Strategy. These are all related and I don't think we can discuss one without the other.

EDIT: I meant the stuff about version support, not if we used node test runner or not.

[ctcpip]

I like the node built-in test support, and embraced it, but in my attempts to adopt it very recently, I ran into some issues that indicated to me that its utility right now is limited to only very small/trivial uses. There is a lack of some basic features/support, and the design decision to throw AssertionError for any assert failure was one primary pain point. I spent time trying to wrap behavior, but it was making the code complex and more difficult to reason about, all just to get around its limitations and inherent design. So I abandoned that effort and added a light test lib instead.

[kibertoad]

Ya, but Express.js supporting them doesn't mean users have to use them. I have to use Node.js low versions for various reasons and have very strong opinion on supporting old versions I need.

What is the oldest version that you are currently running in production?

The Express.js TC has always been aligned on only dropping Node.js support as strictly required, and for a test suite when the current one works perfectly fine seem a bit excessive

And it ended up causing quite a bit of stagnation in Express space, and scared away potential contributors. Supporting old versions is painful, and drastically limits what libraries and tools could be used.

Express 4 was used forever in the space and was good enough for the community. Are there any good reasons to artificially constrain the project, if those with the need to run legacy software on legacy systems will still always have Express 4 as a fallback? One may think about providing security updates to people who can't upgrade Node, but this point is not particularly valid. Old Node by itself is a huge security vulnerability, and it locks its users out of getting updates for the majority of libraries that they are likely to be using, so being locked out of newer Express versions is but a drop in the ocean all things considered.

[dougwilson]

Hi @kibertoad I have left the Express.js project now due to personal reasons and my opinion above no longer carrier any weight from thr TC. It can be disregard really, unless someone else with the project states they share it. Thank you.

[ljharb]

I think that "using node's test runner" should be a totally separate topic from "what node versions should be supported", and even if express only supported latest node, I would suggest not using the test runner. It's improving rapidly, but is organically designed rather than holistically/cohesively designed, and I'd suggest using something more self-consistent.

[wesleytodd]

I think that "using node's test runner" should be a totally separate topic from "what node versions should be supported",

This ☝️ . If we think using node core's test runner is important it for sure means we need to decide on our LTS Strategy first. Can we move this conversation to #196?

unless someone else with the project states they share it.

I share it partly. Again, this is the wrong thread for that conversation so I will move the response over to #196.

[kibertoad]

Can we restart the conversation now? As per our LTS strategy conclusions, if we see that setting our minimum to Node 18 gives tangible benefits for the project, we can do it. And being able to use core Node.js testing functionality is a pretty big deal.

The fact that it aligns us with the currently supported Node LTS versions is an accidental, but pleasant bonus.