By (upstream) default, all of the following are built as static libraries:
- c-ares
- http-parser
- ICU (International Components for Unicode)
- libuv
- OpenSSL
- V8
- v8_inspector
- zlib
In openSUSE at the moment, these are already built as shared libraries (all others as static):
- OpenSSL: only on Leap 42.2+ and Tumbleweed (Node.js is not compatible with OpenSSL 1.0.1)
- zlib: all versions
In openSUSE at the moment, these are a list of system libraries Node.js should link to, but currently are not linked:
- c-ares (not 4.x): Tumbleweed only
- http-parser: Tumbleweed only
- ICU: all versions
- libuv: no versions
Below is a description of the libraries that are currently built statically and problems (if any) in using system libraries.
Node.js versions:
- 4.x LTS: fork (based on 1.10.0)
- 6.x LTS: 1.11.0 + patch for CVE-2016-5180
- 7.x: 1.11.0 + patch for CVE-2016-5180
openSUSE versions (libcares2):
- 13.2: 1.10.0
- Leap 42.1: 1.9.1
- Leap 42.2: 1.9.1
- Tumbleweed: 1.11.0
Seems to avoid API/ABI breaking changes where possible -- as far as I am aware, the last API/ABI breaking change was in 2007 (1.5.0).
It would be possible to use the system c-ares on Node.js 6.x and later if it was updated to latest upstream 1.12.0 (which includes a fix for CVE-2016-5180), or 1.11.0 with a specific patch for that vulnerability.
It is not possible at the moment to do so on Node.js 4.x, however it might be possible to patch Node.js to fix this.
Node.js versions:
- 4.x LTS: 2.7.0
- 6.x LTS: 2.7.0
- 7.x: 2.7.0
openSUSE versions (libhttp-parser-suse0):
- 13.2: N/A
- Leap 42.1: N/A
- Leap 42.2: 2.6.2
- Tumbleweed: 2.7.1
It is unclear what is upstream's policy about API/ABI compatibility -- API/ABI was last broken during an update from 2.6.0 to 2.6.1 (Feb 2016). Since then however, there has been a pull request (after the last ABI break) that states that any ABI breaking changes would require a major version update.
I have opened an issue to request clarification on this matter.
Node.js versions:
- 4.x LTS: 56.1
- 6.x LTS: 57.1
- 7.x: 57.1 (likely update to 58.1)
openSUSE versions (icu):
- 13.2: 53.1
- Leap 42.1: 52.1
- Leap 42.2: 52.1
- Tumbleweed: 57.1
API/ABI compatibility only provided for APIs listed as stable. (reference)
It seems that Node.js will build/run successfully even when linked against older versions of ICU, though this may give some different results in specific cirumstances where i18n data has been updated.
Node.js versions:
- 4.x LTS: 1.9.1
- 6.x LTS: 1.9.1
- 7.x: 1.9.1
openSUSE versions (libuv1):
- 13.2: N/A
- Leap 42.1: N/A
- Leap 42.2: 1.6.1
- Tumbleweed: 1.8.0
libuv's API follows Semantic Versioning, while ABI is meant to be stable across major versions. (reference)
If libuv was updated, it would be possible to use the system library copy of libuv.
Node.js versions:
- 4.x LTS: fork (based on 4.5.103.33)
- 6.x LTS: fork (based on 5.1.281.75)
- 7.x: fork (based on 5.4.500.36)
openSUSE versions (v8):
- 13.2: N/A
- Leap 42.1: N/A
- Leap 42.2: 5.3.171
- Tumbleweed: 5.3.171
Node.js maintains its own fork of older V8 versions to maintain compatibility, given that upstream (Chromium) frequently introduces breaking changes. This includes floating backport patches and other compatibility changes.
Using a bundled version of V8 is not supported by Node.js and would most likely fail to compile/run.
Not included in openSUSE and no support in the ./configure script for this to be unbundled. It is highly unlikely that any bundled version would be supported, given its relation to V8 and its current experimental status.