lib: promote process.binding/_tickCallback to runtime deprecation #50687

jasnell · 2023-11-12T15:04:35Z

These have been pendingDeprecation for long enough.

This also adds the --deprecated-process-binding (and matching --no-deprecated-process-binding) CLI option as a future transition path for when we do ultimately remove process.binding().

--deprecated-process-binding ensures that process.binding(...) is available and is currently the default. In the future, when we are ready to begin moving process.binding(...) to EOF, we can flip the default so that process.binding('...') is unavailable by default but still able to be switched back on if necessary, giving users an escape hatch if they really need it. This will give us a more nuanced path than abruptly removing it completely.

The current transition path would be:

Ship the runtime deprecation in Node.js v22 --deprecated-process-binding on by default.
--no-deprecated-process-binding becomes the default in Node.js v23
process.binding(...) is removed entirely in Node.js v24, with the CLI option becoming a no-op

/cc @nodejs/tsc

nodejs-github-bot · 2023-11-12T15:04:40Z

Review requested:

@nodejs/loaders
@nodejs/startup

nodejs-github-bot · 2023-11-12T15:07:35Z

CI: https://ci.nodejs.org/job/node-test-pull-request/55596/

doc/api/deprecations.md

lib/internal/process/pre_execution.js

doc/api/deprecations.md

These have been pendingDeprecation for long enough. This also adds the `--deprecated-process-binding` (and matching `--no-deprecated-process-binding`) CLI option as a future transition path for when we do ultimately remove `process.binding()`. `--deprecated-process-binding` ensures that `process.binding(...)` is available and is currently the default. In the future, when we are ready to begin moving `process.binding(...)` to EOF, we can flip the default so that `process.binding('...')` is unavailable by default *but still able to be switched back on if necessary*, giving users an escape hatch if they really need it. This will give us a more nuanced path than abruptly removing it completely.

joyeecheung · 2023-11-12T16:07:55Z

I think we should have alternative suggestions before we runtime-deprecate these. Otherwise I very much suspect that these are used commonly enough that no migration would be done (because there aren't alternatives) and many users would just disable the warnings....

jasnell · 2023-11-12T16:15:39Z

What kind of alternative suggestions would you have in mind? I'm afraid that unless we just go ahead and proceed with runtime deprecating these there's never going to be enough pressure for the ecosystem to actually move off of them. As it is these are already quite dangerous to use.

github-actions · 2023-11-12T16:22:32Z

The notable-change PRs with changes that should be highlighted in changelogs. label has been added by @jasnell.

Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment. Otherwise, the commit will be placed in the Other Notable Changes section.

joyeecheung · 2023-11-12T19:58:01Z

As it is these are already quite dangerous to use.

"These" can be a bit too generic - process.binding() contains 28 bindings, many include read-only constants that probably can't do much damage. At least I think they deserve individual deprecations, or we can classify them at least based on side effects. We already have something in place like lib/internal/legacy/processbinding.js which I think is a nicer plan compared to just deprecate all bindings at once without actually looking into them (or I don’t see strong motivation to abandon this plan).

jasnell · 2023-11-12T22:39:33Z

I remember many years ago that was the intended plan but there never seemed to be any follow up to complete that kind of effort, and it seems obvious that having it behind pendingDeprecation hasn't helped (do we actually know if anyone actually uses pendingDeprecation?). At the very least, marking these as runtime deprecations should make it far easier to find and convert those various uses to properly supported APIs where necessary, and the inclusion of the command-line flag (together with --no-deprecation) should address the cases where users aren't ready to drop these. I guess I'm just no longer convinced that a more incremental approach really advances the ball forward enough

mcollina

lgtm

joyeecheung · 2023-11-12T23:14:30Z

lib/internal/bootstrap/realm.js

@@ -144,6 +143,9 @@ const experimentalModuleList = new SafeSet();
 {
  const bindingObj = { __proto__: null };

+  // TODO(@jasnell): If the --deprecated-process-binding option is false we really


You can just expose the processBindingAllowList list, which is set to empty initially, and add things back in pre-execution. We do something similar for --expose-internals for example.

joyeecheung · 2023-11-12T23:17:13Z

lib/internal/process/pre_execution.js

+    // Ideally it wouldn't be defined at all already but realm.js does not
+    // provide a means of checking to see if the option is enabled or not,
+    // so we do it here.
+    delete process.binding;


This should at least throw a warning and tell users about the option --deprecated-process-binding.

joyeecheung

I think we haven't done the due diligence for this change. If the reason for abandoning the incremental plan is that it's not moving, then I suggest we:

Open a tracking issue for auditing processBindingAllowList and moving them to legacyWrapperList with wrappers added in lib/internal/legacy/processbinding.js
Ask for help in the audit - this look like a list of good first contributions to me. The rule can be simple - existing read-only constants and side-effect-free helpers can be exposed as-is before we think about alternatives. Any method beyond that gets filtered out. If somehow this causes significant regression, we can get the filtered stuff back out quickly and add a TODO for proper alternative - which can just be semver-patch. This also helps to make sure that no new additions to the bindings are going to end up accessible to the user land going forward.
We set a deadline for the audit. This won't be released until next April anyway. I think we should defer the deadline until at least next February. When the deadline comes, for any of the bindings still in processBindingAllowList, process.binding returns an empty object and emits a warning if --deprecated-process-binding isn't set, or return the original one if the flag is set. Eventually, process.binding() should just return a list of harmless wrappers. We can revisit whether we should delete this list of harmless wrappers in the future.

If we get some help in the auditing, 4 months look enough for auditing to me.

RafaelGSS · 2023-11-15T15:12:58Z

Related work #48568

mcollina · 2023-11-21T07:08:52Z

@joyeecheung I think it's a solid plan if we can get volunteers for the audit. Can you open a "call to action" issue describing what needs to be done?

joyeecheung · 2023-11-21T17:24:09Z

Can you open a "call to action" issue describing what needs to be done?

I think I'll need consensus that this is the path instead before I open such issue to avoid making contributors confused/waste audit work. Should I call for a vote or something?

jasnell · 2023-11-24T14:47:52Z

Should I call for a vote or something?

We may need one, yes. Not sure how else we'll come to consensus here.

joyeecheung · 2023-12-06T15:23:50Z

Discussed again in the TSC meeting, the idea agreed on is to open an issue in the TSC repo regarding the plan of process.binding() (note that this is about process.binding(), not process._tickCallback). As least discuss about the various steps that could be taken towards the eventual deprecation, e.g.

whether we need legacy wrappers (which was the original plan from process: upgrade process.binding to runtime deprecation #37485 (review))
how the warnings can be rolled out (application-only or dependency too)
how the flags should be managed
whether assessment of ecosystem impact should be done prior to runtime deprecation
whether the 20 or so bindings should he deprecated individually or all together
whether read-only constants should be left around
whether we should provide proper alternatives before moving on with runtime deprecation

I'll try to come up with a an issue that summarizes the options and get a vote together (maybe on the steps first before we combine the steps together to form some plan to vote on)

joyeecheung · 2024-01-31T15:33:53Z

Moved to nodejs/TSC#1482

jasnell added the semver-major PRs that contain breaking changes and should be released in the next major version. label Nov 12, 2023

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Nov 12, 2023

targos reviewed Nov 12, 2023

View reviewed changes

doc/api/deprecations.md Outdated Show resolved Hide resolved

anonrig approved these changes Nov 12, 2023

View reviewed changes

targos reviewed Nov 12, 2023

View reviewed changes

lib/internal/process/pre_execution.js Outdated Show resolved Hide resolved

jasnell commented Nov 12, 2023

View reviewed changes

doc/api/deprecations.md Outdated Show resolved Hide resolved

ronag approved these changes Nov 12, 2023

View reviewed changes

jasnell force-pushed the runtime-deprecate-process-binding-next branch from dc149cd to 957fc0f Compare November 12, 2023 15:21

jasnell force-pushed the runtime-deprecate-process-binding-next branch from 957fc0f to aed9d49 Compare November 12, 2023 15:22

targos approved these changes Nov 12, 2023

View reviewed changes

jasnell added the notable-change PRs with changes that should be highlighted in changelogs. label Nov 12, 2023

mcollina approved these changes Nov 12, 2023

View reviewed changes

joyeecheung reviewed Nov 12, 2023

View reviewed changes

joyeecheung requested changes Nov 12, 2023

View reviewed changes

joyeecheung added the tsc-agenda Issues and PRs to discuss during the meetings of the TSC. label Nov 12, 2023

mhdawson mentioned this pull request Nov 13, 2023

Node.js Technical Steering Committee (TSC) Meeting 2023-11-15 nodejs/TSC#1471

Closed

github-actions bot mentioned this pull request Nov 14, 2023

CI Reliability 2023-11-14 nodejs/reliability#717

Open

25 tasks

arcanis mentioned this pull request Nov 14, 2023

Official fs overlay nodejs/loaders#172

Open

github-actions bot mentioned this pull request Nov 15, 2023

CI Reliability 2023-11-15 nodejs/reliability#718

Open

26 tasks

RafaelGSS mentioned this pull request Nov 15, 2023

lib: runtime deprecate process.binding() #48568

Closed

Qard approved these changes Nov 15, 2023

View reviewed changes

anonrig approved these changes Nov 15, 2023

View reviewed changes

mhdawson mentioned this pull request Nov 20, 2023

Node.js Technical Steering Committee (TSC) Meeting 2023-11-22 nodejs/TSC#1473

Closed

RafaelGSS approved these changes Nov 21, 2023

View reviewed changes

mhdawson mentioned this pull request Nov 27, 2023

Node.js Technical Steering Committee (TSC) Meeting 2023-11-29 nodejs/TSC#1476

Closed

mhdawson mentioned this pull request Dec 4, 2023

Node.js Technical Steering Committee (TSC) Meeting 2023-12-06 nodejs/TSC#1478

Closed

mhdawson mentioned this pull request Dec 11, 2023

Node.js Technical Steering Committee (TSC) Meeting 2023-12-13 nodejs/TSC#1480

Closed

joyeecheung mentioned this pull request Dec 12, 2023

Plan of process.binding() deprecation nodejs/TSC#1482

Open

This was referenced Dec 19, 2023

Node.js Technical Steering Committee (TSC) Meeting 2023-12-20 nodejs/TSC#1483

Closed

Node.js Technical Steering Committee (TSC) Meeting 2023-12-27 nodejs/TSC#1485

Closed

mhdawson mentioned this pull request Jan 1, 2024

Node.js Technical Steering Committee (TSC) Meeting 2024-01-03 nodejs/TSC#1487

Closed

mhdawson mentioned this pull request Jan 8, 2024

Node.js Technical Steering Committee (TSC) Meeting 2024-01-10 nodejs/TSC#1489

Closed

This was referenced Jan 15, 2024

Node.js Technical Steering Committee (TSC) Meeting 2024-01-17 nodejs/TSC#1492

Closed

Node.js Technical Steering Committee (TSC) Meeting 2024-01-24 nodejs/TSC#1495

Closed

mhdawson mentioned this pull request Jan 29, 2024

Node.js Technical Steering Committee (TSC) Meeting 2024-01-31 nodejs/TSC#1497

Closed

joyeecheung removed the tsc-agenda Issues and PRs to discuss during the meetings of the TSC. label Jan 31, 2024

mikicho mentioned this pull request Mar 3, 2024

feat(ClientRequest): use net.Socket interceptor mswjs/interceptors#515

Merged

18 tasks

jasnell closed this Apr 20, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

lib: promote process.binding/_tickCallback to runtime deprecation #50687

lib: promote process.binding/_tickCallback to runtime deprecation #50687

jasnell commented Nov 12, 2023 •

edited

Loading

nodejs-github-bot commented Nov 12, 2023

nodejs-github-bot commented Nov 12, 2023

joyeecheung commented Nov 12, 2023 •

edited

Loading

jasnell commented Nov 12, 2023

github-actions bot commented Nov 12, 2023

joyeecheung commented Nov 12, 2023 •

edited

Loading

jasnell commented Nov 12, 2023

mcollina left a comment

joyeecheung Nov 12, 2023

joyeecheung Nov 12, 2023

joyeecheung left a comment •

edited

Loading

RafaelGSS commented Nov 15, 2023

mcollina commented Nov 21, 2023

joyeecheung commented Nov 21, 2023

jasnell commented Nov 24, 2023

joyeecheung commented Dec 6, 2023 •

edited

Loading

joyeecheung commented Jan 31, 2024

lib: promote process.binding/_tickCallback to runtime deprecation #50687

lib: promote process.binding/_tickCallback to runtime deprecation #50687

Conversation

jasnell commented Nov 12, 2023 • edited Loading

nodejs-github-bot commented Nov 12, 2023

nodejs-github-bot commented Nov 12, 2023

joyeecheung commented Nov 12, 2023 • edited Loading

jasnell commented Nov 12, 2023

github-actions bot commented Nov 12, 2023

joyeecheung commented Nov 12, 2023 • edited Loading

jasnell commented Nov 12, 2023

mcollina left a comment

Choose a reason for hiding this comment

joyeecheung Nov 12, 2023

Choose a reason for hiding this comment

joyeecheung Nov 12, 2023

Choose a reason for hiding this comment

joyeecheung left a comment • edited Loading

Choose a reason for hiding this comment

RafaelGSS commented Nov 15, 2023

mcollina commented Nov 21, 2023

joyeecheung commented Nov 21, 2023

jasnell commented Nov 24, 2023

joyeecheung commented Dec 6, 2023 • edited Loading

joyeecheung commented Jan 31, 2024

jasnell commented Nov 12, 2023 •

edited

Loading

joyeecheung commented Nov 12, 2023 •

edited

Loading

joyeecheung commented Nov 12, 2023 •

edited

Loading

joyeecheung left a comment •

edited

Loading

joyeecheung commented Dec 6, 2023 •

edited

Loading