Migrate to Node 18

[henkery]

What is your suggestion?

Migrate code-server to use nodejs 18 instead of 16

Why do you want this feature?

nodejs 16 reaches EOL on september 2023 https://nodejs.org/en/blog/announcements/nodejs16-eol

Are there any workarounds to get this functionality today?

Are you interested in submitting a PR for this?

I might look into making this work in a few months from now

[code-asher]

We can do this once VS Code updates to Node 18.

[henkery]

microsoft/vscode#180466
microsoft/vscode#184021
tracking update here

[skapin]

do you have any information on when it would be available ? september is near.

[henkery]

We are waiting on vscode to migrate first
seems they moved the work to a new ticket here microsoft/vscode#188268
ofc code-server (or vscode for that matter) won't just instantly break but it will be considered a security risk

[skapin]

Yes, but looks like it will not be available for several month. Internally they are afraid of moving to electron 25....

meanwhile, node 16 and openssl1.1.1 is ending in september ><

Thank you, I'm crossing my finger.

For information, i'm bumping all my jupyterlab stack to 4.0 and node 18 is asked (but looks like not mandatory) anyway, I have the same issue with openssl 1.1.1 VS 3 ><

[benz0li]

For information, i'm bumping all my jupyterlab stack to 4.0

@skapin I stay with v3.6.x for my JupyterLab docker stacks because of jupyterlab/jupyterlab#14590.

[skapin]

@benz0li yeah, but my release plan is for sept/october, and I want to do it early, at least maximize compatibility.
thank you for the link, I will keep it !!!

It's out for several months now. I will clean old extension and co. Cleaning time :p

[benz0li]

ℹ️ Update to Electron 25 (Issue: microsoft/vscode#184021; Pull Request: microsoft/vscode#188268) is part of the Iteration Plan for August 2023 [DRAFT].

[jonathanflackUSAF]

One particularly important reason for pressing Microsoft's VSCode team on this is this specific change is required to eliminate a number of Critical and High scoring CVE's, and there is a risk in many high compliance environments that these codebases could be delisted from authorized lists if this doesn't happen quickly.

We are seeing this happen in real time with a certain Australian company who make Agile process management software. Missions in the federal government are being told to immediately isolate and cut off all access to these systems.

This is a pretty dark stain on any closed source or OSS solution.