Spidermonkey 91 is EOL and unsupported

[RaitoBezarius]

CouchDB 3.x series currently only support Spidermonkey 91, this dependency has been EOL for a long time now.
In nixpkgs, we have a CouchDB packaging for the branch 3.x, we would like to package it using non-EOL SM.

Do you have a timeline or any plan to move away from SM91 in the future?

cc NixOS/nixpkgs#157874

[nickva]

Thanks for the heads-up @RaitoBezarius. We're investigating using QuickJS #4448 but so far it hasn't made into a release yet. After the discussion in the Apache CouchDB meeting the plan is to release as an option first along with an automated background scanner to check users' design docs for compatibility between SM and QuickJS (or potentially any other JS engine in the future).

I had tried to bring SM 102 in with #4305 but they keep changing the C++ API almost every release so that didn't get very far.

Recent RHEL versions have removed spidermonkey from their base packages I see Debian Bookworm still supports https://packages.debian.org/bookworm/libmozjs-78-0. Presumably they have security patches for it as well? Perhaps nixpkgs can use the Debian version?

[RaitoBezarius]

@nickva I will investigate the security updates for 78, I am surprised but maybe that's the case!

[big-r81]

@nickva Bookworm has v102 now too, but v102 has no security support too and v115 will end in one year [1]. This matures fast ...

[nickva]

@big-r81 we can't use 102 they changed the C++ API

[big-r81]

I know and maybe v102 -> v115 again ... ;-)

[nickva]

Exactly!

[githubowl]

Hello,

Can you tell me what we do about this please? I have tried to update from Ubuntu 22.10 to 23.04 and my couchdb now fails because of this. Spidermonkey is not in 23.04. I can no longer build couchdb because it says Spidermonkey does not exist?

Thanks a lo for any help

[pgj]

There seems to be a libmozjs-78-0 package still for Ubuntu 23.04 and SpiderMonkey 78 is supported by CouchDB.

[nickva]

We usually support only Ubuntu LTS releases, the last one being Jammy (22.04.3).

Some OSes like RHEL had stopped including Spidermonkey in their base packages but as @pgj found (thanks!) newer Ubuntu still provides version 78. So you may have some luck building and running CouchDB on it.

[githubowl]

Ok, I'll have to check thanks

[chenrui333]

any updates on the thread?

[xnox]

I see that quickjs is merged into main branch, is there a release coming soon? or at least an rc tag? it would be interesting to try out quickjs builds.

[nickva]

@xnox we're working toward a 3.4 release. QuickJS will be released as an experimental change, off by default, with a scanner option to validate your views for compatibility.

To try it out off of the main branch using QuickJS as a default: ./configure --disable-spidermonkey (add --dev if you don't want to build Fauxton or docs). Then make && make release

Some Linux OS still maintain SM 78 packages, so that may still be an option if you can use those.

[xnox]

@nickva i am linux distribution and was hoping to axe mozjs 91 from wolfi-os =)