error upgrading : npm ERR! Invalid comparator: npm:@rollup/wasm-node

[marmoMM]

Lychee version

?

Which PHP version are you using?

PHP 8.3

Detailed description of the problem

Hello everyone,
I encountered an error while updating lychee.
here are the orders made:

• git pull
• compose install --no-dev
• php artisan migrate
  I had no errors.

but running npm install I got the following error:
npm ERR! Invalid comparator: npm:@rollup/wasm-node

here is an extract from the generated log file:
erbose stack TypeError: Invalid comparator: npm:@rollup/wasm-node
38 verbose stack at Comparator.parse (/usr/share/nodejs/semver/classes/comparator.js:39:13)
38 verbose stack at new Comparator (/usr/share/nodejs/semver/classes/comparator.js:23:10)
38 verbose stack at /usr/share/nodejs/semver/classes/range.js:138:47
38 verbose stack at Array.map ()
38 verbose stack at Range.parseRange (/usr/share/nodejs/semver/classes/range.js:138:35)
38 verbose stack at /usr/share/nodejs/semver/classes/range.js:41:22
38 verbose stack at Array.map ()
38 verbose stack at new Range (/usr/share/nodejs/semver/classes/range.js:41:8)
38 verbose stack at Object.intersects (/usr/share/nodejs/semver/ranges/intersects.js:3:8)
38 verbose stack at OverrideSet.getEdgeRule (/usr/share/nodejs/@npmcli/arborist/lib/override-set.js:53:18)
39 verbose cwd /var/www/Lychee
40 verbose Linux 6.8.0-51-generic
41 verbose node v18.19.1
42 verbose npm v9.2.0
43 error Invalid comparator: npm:@rollup/wasm-node
44 verbose exit 1

Could you help me resolve this issue?

Steps to reproduce the issue

No response

Diagnostics [REQUIRED]

No response

Browser & System [REQUIRED]

No response

Please confirm (incomplete submissions will not be addressed)

• I have provided easy and step-by-step instructions to reproduce the bug.
• I understand my bug report will be removed if I haven't met the criteria above.

[ildyria]

Which version of npm are you using ?

[marmoMM]

Thank you for this extremely quick response.
I am using version 9.2.0

[ildyria]

Those are pretty old. you can give a try to update them.
I haven't been able to get node 11 running yet on my debian but that combination should work:

Documents/Projects/Lychee  master ✔                                                        8h35m  ⍉
▶ npm --version
10.9.2
Documents/Projects/Lychee  master ✔                                                         8h35m  
▶ node --version
v23.7.0

[ildyria]

Can you check if you have access to that link: https://github.com/LycheeOrg/Lychee/actions/runs/13084889494/artifacts/2520473695 ?

[ildyria]

That's the latest build from master. In it you will find Lychee as release state.
If you extract the public/build content to your public/build you will not need to use npm.
Not the ideal solution... but a possible work around.

[marmoMM]

Those are pretty old. you can give a try to update them. I haven't been able to get node 11 running yet on my debian but that combination should work:

Documents/Projects/Lychee  master ✔                                                        8h35m  ⍉
▶ npm --version
10.9.2
Documents/Projects/Lychee  master ✔                                                         8h35m  
▶ node --version
v23.7.0

I'm using Ubuntu.
I'm going to look into how to force an update to a newer version.

[ildyria]

https://github.com/nodesource/distributions#installation-instructions-deb < check here.

[marmoMM]

The update seems to improve things.
I no longer have the same error

node --version
v23.7.0
marc@mm-2:~$ cd /var/www/Lychee/
marc@mm-2:/var/www/Lychee$ sudo -u www-data npm install

added 77 packages, removed 3 packages, changed 31 packages, and audited 335 packages in 20s

63 packages are looking for funding
run npm fund for details

3 vulnerabilities (1 moderate, 2 high)

To address all issues, run:
npm audit fix

Run npm audit for details.

[ildyria]

That is weird, I have:

npm audit    
found 0 vulnerabilities

[ildyria]

▶ npm list 
Lychee@ /home/biv/Documents/Projects/Lychee
├── @fortawesome/[email protected]
├── @lychee-org/[email protected]
├── @popperjs/[email protected]
├── @primevue/[email protected]
├── @sidsbrmnn/[email protected]
├── @tailwindcss/[email protected]
├── @types/[email protected]
├── @types/[email protected]
├── @types/[email protected]
├── @types/[email protected]
├── @types/[email protected]
├── @types/[email protected]
├── @types/[email protected]
├── @types/[email protected]
├── @types/[email protected]
├── @types/[email protected]
├── @vitejs/[email protected]
├── @vueuse/[email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
└── [email protected]

[marmoMM]

npm audit report

cross-spawn 7.0.0 - 7.0.4
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - GHSA-3xgq-45jj-v275
fix available via npm audit fix
node_modules/cross-spawn

rollup 4.0.0 - 4.22.3
Severity: high
DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS - GHSA-gcx4-mw62-g8wm
fix available via npm audit fix
node_modules/rollup
vite
Depends on vulnerable versions of rollup
node_modules/vite

webpack 5.0.0-alpha.0 - 5.93.0
Severity: moderate
Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS - GHSA-4vvj-4cpr-p986
fix available via npm audit fix
node_modules/webpack

[marmoMM]

I've updated npm to version 11.1.0 and I still have same issues.
Copying files from your already built archive works.
I will search how to resolve my problem tomorrow.
many thanks for your help today.