Skip to content

chore: update lru-memoizer to v3#476

Merged
cschetan77 merged 1 commit intoauth0:masterfrom
isidrok:feature/update-lru-memoizer-v2
Mar 2, 2026
Merged

chore: update lru-memoizer to v3#476
cschetan77 merged 1 commit intoauth0:masterfrom
isidrok:feature/update-lru-memoizer-v2

Conversation

@isidrok
Copy link
Copy Markdown
Contributor

@isidrok isidrok commented Jan 19, 2026

By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

This library is using an outdated version of lru-memoizer, which in turn has a dependency on lru-cache. The lru-cache version it is using is pretty outdated and is no longer compatible with new versions, as a result applications depending on packages that use different versions break when bundling them.

References

Fixes #424

Testing

This should be covered by existing tests

Checklist

  • I have added documentation for new/changed functionality in this PR or in auth0.com/docs
  • All active GitHub checks for tests, formatting, and security are passing
  • The correct base branch is being used, if not the default branch

@isidrok isidrok requested a review from a team as a code owner January 19, 2026 09:55
@cschetan77
Copy link
Copy Markdown
Contributor

@isidrok
Thanks for updating the PR — the changes look good to me overall.

The only concern I have is around node versions supported by lru-cache@11.
This version of lru-cache declares support for Node.js >=20, while the SDK still supports Node >=14.

At the moment, I don’t see any issues, our CI is passing on Node 14, 16, and 18, and nothing appears to be breaking. However, this does seems to introduce a real future risk. Patch releases of lru-cache@11 could start relying on newer Node APIs that aren’t available in older Node versions, which could lead to unexpected breakage for users.

Additionally, some environments enforce strict engine checks, which could cause CI or installs to fail even if the code itself still works.

@isidrok
Copy link
Copy Markdown
Contributor Author

isidrok commented Jan 26, 2026

Hi @cschetan77 that makes sense, but given that Node 20 is already in maintenance mode and the active LTS is 24, maybe consider dropping support for older versions and create a new major version of this library focusing on Node 20+

@cschetan77
Copy link
Copy Markdown
Contributor

@isidrok I agree.
There’s already PR #444 open to upgrade the minimum Node version to v20+.
Since Node ^20.19.0 and 22.12.0+ now support require(esm), we’ve been discussing internally which direction makes the most sense — either bumping the Node version and dependencies while keeping the SDK in CJS, or moving forward with the approach proposed in #444.

We’re evaluating the trade-offs carefully and will take a decision soon.
I’ll follow up on this PR once we’ve aligned internally.
Thanks for your patience.

@cschetan77
Copy link
Copy Markdown
Contributor

Hi @isidrok ,
I've updated the supported node version to be >=20 through #485.
Could you please rebase your branch.

@isidrok isidrok force-pushed the feature/update-lru-memoizer-v2 branch from f6936c7 to e11b943 Compare March 1, 2026 14:34
@isidrok
Copy link
Copy Markdown
Contributor Author

isidrok commented Mar 1, 2026

Hi @isidrok , I've updated the supported node version to be >=20 through #485. Could you please rebase your branch.

Done!

@cschetan77
Copy link
Copy Markdown
Contributor

LGTM
Thanks @isidrok for taking the time to contribute to this repo, really appreciate your effort 👍

@cschetan77 cschetan77 changed the title update lru memoizer v2 chore: update lru-memoizer to v3 Mar 2, 2026
@cschetan77 cschetan77 merged commit fee6f01 into auth0:master Mar 2, 2026
14 of 15 checks passed
@cschetan77 cschetan77 mentioned this pull request Mar 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Update lru-memoizer

2 participants