F43 Change Proposal: Nodejs node_modules path (self contained)

Project Discussion Change Proposals
,
1

Nodejs node_modules path

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Wiki
Announced

:link: Summary

Nodejs needs a new shared stream agnostic installation folder for modules.

:link: Owner

:link: Detailed Description

This proposal is a part of a larger effort to improve the way we package Nodejs for Fedora and RHEL. The other parts are Changes/NodejsAlternativesSystem and Changes/NodeJSMetapackages.

This effort is specifically focused on allowing users to install any supported version of Nodejs, without specifying a major version.

:link: Current Nodejs Situation

Currently, Fedora’s Node.js setup uses a symlink: %{_libdir}/node_modules points to a version-specific folder like %{_libdir}/node_modulesXX (e.g., %{_libdir}/node_modules20 or %{_libdir}/node_modules22).

Primary motivation for change is an ongoing effort to de-bundle certain parts of Node.js, particularly NPM packages that include pre-built WebAssembly (WASM) binary blobs.

With multiple Nodejs versions present in Fedora, and upstream recommendations against globally shared NPM packages in consideration, we need a better way to store these de-bundled packages which could be shared between multiple streams.

:link: Suggested Change

Proposed way of doing this is to change %{_libdir}/node_modules from a symlink to a static shared folder.

This static %{_libdir}/node_modules path will be used for version-agnostic modules that can be shared across multiple Nodejs versions.

For version-specific dependencies, the existing %{_libdir}/node_modulesXX folders (e.g., %{_libdir}/node_modules20, %{_libdir}/node_modules22) will continue to be used.

:link: Alternative path options

If the change of %{_libdir}/node_modules from a symlink to a shared folder is not agreeable a alternative path could also be used for the same purpose e.g.:

  • %{_libdir}/nodejs/packages/shared for NPM packages that can be shared between multiple NodeJS major versions. This should be the default path for the unbundled packages unless a stream is identified to need a specific version.
  • %{_libdir}/nodejs/packages/<major_version> for NPM packages that are specifically used by a single NodeJS major version. Reserved for compat-style packages.

Packages installed in these paths are assumed to be used by a non-npm-related loading mechanism; for NodeJS specifically, via the “Shared builtins” mechanism (upstream docs).

:link: Feedback

:link: Benefit to Fedora

By having downstream-standartized path for “Shared builtins” modules, we can start removing potentially unsafe pre-build WASM (binary) blobs from the NodeJS sources, rebuilding them on our infrastructure from trusted sources.

Accommodating single default shared directory will reduce work necessary for unbundling the packages from several NodeJS major versions at once, while the preservation of version-specific paths will allow for compatibility packages where necessary.

:link: Scope

  • Proposal owners: Adding a small %pretrans scriptlet for turning /usr/lib/node_modules into a separate directory in all active nodejs streams

  • Other developers: Any developers who package npm packages will need to verify, that their RPM will be functional after the %{_libdir}/node_modules will change from a symlink to a folder and if necessary rebuild their packages so that the files are present in %{_libdir}/node_modules and rather then in e.g. %{_libdir}/node_modules_22.

  • Release engineering: N/A

  • Policies and guidelines: N/A.

  • Trademark approval: N/A (not needed for this Change)

  • Alignment with the Fedora Strategy:

:link: Upgrade/compatibility impact

There should be no need for manual intervention.

:link: Early Testing (Optional)

Do you require ‘QA Blueprint’ support? N

:link: How To Test

Allow to install nodejs dependencies like nodejs-cjs-module-lexer into a shared static folder.

:link: User Experience

User experience should not be affected in any way.

:link: Dependencies

None

:link: Contingency Plan

  • Contingency mechanism: Reverting the change back to using %{_libdir}/node_modules as a symlink pointing to version specific folders.
  • Contingency deadline: N/A
  • Block release: N/A

:link: Documentation

This Page.

:link: Release Notes

Last edited by @amoloney 2025-07-07T14:39:02Z

Last edited by @amoloney 2025-07-07T14:39:02Z

2

How do you feel about the proposal as written?

  • Strongly in favor
  • In favor, with reservations
  • Neutral
  • Opposed, but could be convinced
  • Strongly opposed
0 voters

If you are in favor but have reservations, or are opposed but something could change your mind, please explain in a reply.

We want everyone to be heard, but many posts repeating the same thing actually makes that harder. If you have something new to say, please say it. If, instead, you find someone has already covered what you’d like to express, please simply give that post a :heart: instead of reiterating. You can even do this by email, by replying with the heart emoji or just “+1”. This will make long topics easier to follow.

Please note that this is an advisory “straw poll” meant to gauge sentiment. It isn’t a vote or a scientific survey. See About the Change Proposals category for more about the Change Process and moderation policy.

3

This change proposal has now been submitted to FESCo with ticket #3438 for voting.

To find out more, please visit our Changes Policy documentation.