replacing deprecated optional dependency libxmljs2

[CamilleDrapier]

The libxmljs2 seems to be trying to download some files from its Github repository in its "install"/"build" (trough node-gyp, if I understand properly).

But it looks like the repository has been deleted recently, maybe after a CSV declaration that was partly covered in this issue; making installations that are trying to download the binaries fail if they do not have the ability to build the library as a fallback.

npm ERR! node-pre-gyp http GET https://github.com/marudor/libxmljs2/releases/download/v0.33.0/node-v115-linux-x64-glibc.tar.gz
npm ERR! node-pre-gyp ERR! install response status 404 Not Found on https://github.com/marudor/libxmljs2/releases/download/v0.33.0/node-v115-linux-x64-glibc.tar.gz 
npm ERR! node-pre-gyp WARN Pre-built binaries not installable for [email protected] and [email protected] (node-v115 ABI, glibc) (falling back to source compile with node-gyp) 

Since the repository has been deleted, it might be a sign that no further development/support will be made for that library and relying on it in the long run might be difficult nontheless?

Could a replacement or removal of the library be considered? In the meantime, not using the library or not executing its "build", or adjusting CI configurations in order for build to succeed from source, might be workable fallbacks for users of cyclonedx-javascript-library?

[jkowalleck]

The library libxmljs2 was used to validate XML only.

Could a replacement or removal of the library be considered?

An hour ago, the optional dependency libxmljs2 was marked as "no longer maintained", and is therefore deprecated.

This means, a replacement must be found.
Previous considerations and candidates can be found here: https://github.com/CycloneDX/cyclonedx-javascript-library/blob/main/docs/dev/decisions/XmlValidator.md.

I will work on this topic eventually.
📣 If you need a change early, please drop a comment in this very issue telling your interest in working on a solution, and collaborate to bring a pull-request for an alternative/solution. Thanks in advance.

In the meantime, not using the library or not executing its "build", or adjusting CI configurations in order for build to succeed from source, might be workable fallbacks for users of cyclonedx-javascript-library?

Sure, just use npm install --ignore-scripts or npm install --omit optional and such install options. (Our CI pipeline does the same thing, to successfully showcase how this very library works without its optional dependencies)

[CamilleDrapier]

Thanks! And sorry for the somewhat early issue creation, I thought it might have been useful of having an issue for everyone to see/found if the repo was deleted permanently 🙇

Just to add a bit of follow-up: It seems that indeed the libxmljs2 is now accessible again (cf: restore) with a deprecation message; which should let everyone a bit more leeway to transition to something else (and/or to fork that repo).

In my case, the library was installed/build on all my CI jobs, including some of them not having the necessary tools to build the binaries from source (which was problematic until the repo was restored). But since "BOM generation" happens in its own small job, the library should only be install/build there and having a CI image capable of doing this should be fairly easy. 🙇

[jkowalleck]

this is considered a breaking change for the following reasons:
Changing an optional dependency requires additional care from downstream users, to ensure the existence of the new/changed dependency, to keep functionality as expected.

[jkowalleck]

https://www.npmjs.com/package/xmlschema.js looks promising - from the projects description.
download numbers are basically 0, no change on the project since 4 years. maybe it is abandoned.

I contacted the author, @paulwardrip, to find out what is going on and gather more insight.

[jkowalleck]

I've refactored some internals; now, it should be easy to write code to allow an alternative to libxmljs2.
this is the section that does the optional feature switch:

cyclonedx-javascript-library/src/_optPlug.node/xmlValidator.ts

Lines 26 to 31 in 48cbc02

	export default opWrapper<Functionality>('XmlValidator', [
	/* eslint-disable @typescript-eslint/no-var-requires */
	['libxmljs2', () => require('./__xmlValidators/libxmljs2').default]
	// ... add others here, pull-requests welcome!
	/* eslint-enable @typescript-eslint/no-var-requires */
	]) satisfies Functionality | WillThrow

pullrequests welcome!
remember to also describe the used deps in the dev-decisions docs: https://github.com/CycloneDX/cyclonedx-javascript-library/blob/main/docs/dev/decisions/XmlValidator.md

[jkowalleck]

this issue is flagged "help wanted".
If anybody has a solution and is willing to donate the feature, feel free to step forward.

[SierraNL]

Looking around, I found a comment in the libxmljs repo pointing to https://github.com/jameslan/libxml2-wasm, could this be a possible replacement? I'm not really familiar in the typescript/javascript world, but it seems to be able to validate and is being maintained.