Cannot set node_version = "14.18.0" for manual NodeJS install with 4.3.0 release.

[ghost]

This is with the 4.3.0 release on macOS.

We have in our WORKSPACE this rule,

node_repositories(
    node_repositories = {
        "14.18.0-darwin_amd64": ("node-v14.18.0-darwin-x64.tar.gz", "node-v14.18.0-darwin-x64", "6b9b4d60bcb4eba95488380be8c4da4af98fce3f4a01c9a76db881cbb736656d"),
        "14.18.0-linux_amd64": ("node-v14.18.0-linux-x64.tar.gz", "node-v14.18.0-linux-x64", "f411b8aee36d6dc6a5435906f42bd4ea59d6f678894cf562beaf115b58a318ee"),
        "14.18.0-windows_amd64": ("node-v14.18.0-win-x64.zip", "node-v14.18.0-win-x64", "2883e83ac3b1e1cb9a9bf65554043640849b39e86761e7c7ac50b664f42f20ff"),
    },
    node_urls = ["https://nodejs.org/dist/v{version}/{filename}"],
    node_version = "14.18.0",
    package_json = ["//:package.json"],
    yarn_repositories = {
        "1.22.10": ("yarn-v1.22.10.tar.gz", "yarn-v1.22.10", "7e433d4a77e2c79e6a7ae4866782608a8e8bcad3ec6783580577c59538381a6e"),
    },
    yarn_urls = ["https://github.com/yarnpkg/yarn/releases/download/v{version}/{filename}"],
    yarn_version = "1.22.10",
)

When the bazel build is run it falls back to node_version 14.17.5 which is the default. In the 4.3.0 release 14.18.0 is not in the built-ins, though I thought these attributes are sufficient for a manual install and the node version should not matter.

Same seems to happen with yarn_version, i.e. we can only install 'manually' yarn builds whose versions are in the built-in lists.

Is this user error?

[ghost]

Unfortunately this means that clients of this package cannot update to the 14.18.1 security update right now as that is not in a released version. Cannot see what in the WORKSPACE manual configuration for Node version is wrong so assuming it's a bug.

[alexeagle]

Yeah, looks like I broke this in 7f85e9f#diff-f381b656a6df80113b279e147e93a3fc60037f2d5aef1affbbc376476ea5bef0
it assumes our local NODE_VERSIONS mapping is sufficient to lookup what versions exist. We skip downloads of anything we don't know about.

Tricky to make an integration test for this, since any version not in the map will be soon added, then you don't have coverage for unknown version anymore.

[ghost]

Thank you for investigating.

[alexeagle]

The automation brought in new yarn, node, and esbuild versions yesterday so as a quick security fix I published https://github.com/bazelbuild/rules_nodejs/releases/tag/4.4.1

[ghost]

Saw that. Awesome stuff. V. much appreciated. We'll be updating our NodeJS version today to pick up the CVE fixes.

[mattem]

Fixed via #3339