So event-stream 3.3.6 was removed from NPM because it depended on vulnerable flatmap-stream 0.1.1. But in Mastodon's dependency tree, we had event-stream 3.3.6 depending on flatmap-stream 0.1.0.

Anyway, because event-stream 3.3.6 was yanked from NPM all of our builds break right now

The unfortunate consequence is that Docker images for v2.6.3 cannot be built because of this. The upgrade will work fine for all existing non-Docker installations, but not fresh ones.

Ironically the event-stream dependency can be easily avoided. I'm removing it and then bumping to v2.6.4 so everyone can upgrade. Awkward situation though, I'm sorry.

Follow

@Gargron Thank you so much for the immediate fix!

· Tootle for Mastodon · 0 · 0 · 1
Sign in to participate in the conversation
Mastodon at crazynewworld.net

鼻毛スライサーが運営しています。
A mastodon instance run by Nasal Hair Slicer.