`corepack` installed with `node@20` but not with `node@22`

[karlhorky]

brew gist-logs <formula> link OR brew config AND brew doctor output

$ brew config
HOMEBREW_VERSION: 4.4.0-127-g3291ad4
ORIGIN: https://github.com/Homebrew/brew
HEAD: 3291ad4fc78f33f8e9bb7ce37745d2a0e697f5fb
Last commit: 14 hours ago
Core tap HEAD: 4465032b218818d8f645e17e2cf45435964bd854
Core tap last commit: 4 months ago
Core tap JSON: 12 Oct 14:02 UTC
Core cask tap HEAD: ff7c82f562e07a6613213e0daad7d36bc9af9137
Core cask tap last commit: 4 months ago
Core cask tap JSON: 12 Oct 14:02 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_MAKE_JOBS: 8
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 3.3.5 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.3.5/bin/ruby
CPU: octa-core 64-bit arm_firestorm_icestorm
Clang: 16.0.0 build 1600
Git: 2.39.2 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 15.0.1-arm64
CLT: 16.0.0.0.1.1724870825
Xcode: 16.0
Rosetta 2: false

$ brew doctor
Your system is ready to brew.

Verification

• My brew doctor output says Your system is ready to brew. and am still able to reproduce my issue.
• I ran brew update and am still able to reproduce my issue.
• I have resolved all warnings from brew doctor and that did not fix my problem.
• I searched for recent similar issues at https://github.com/Homebrew/homebrew-core/issues?q=is%3Aissue and found no duplicates.

What were you trying to do (and why)?

I was trying to use Homebrew to install Node.js v22 and use Corepack, in the same way that I installed Node.js v20 and used Corepack

What happened (include all command output)?

Following the official Node.js download page, I used Homebrew to install node@22, and then tried to enable the corepack binary as in the Node.js docs and it is not available:

$ brew install node@22

...

$ corepack enable
zsh: command not found: corepack

This is divergent behavior from node@20 (and other versions), where installation yields a working, installed Corepack out of the box:

$ brew install node@20

...

$ brew link node@20

...

$ corepack enable
$ # Completed successfully

What did you expect to happen?

node@22 should install the Corepack binary like node@20 does (Corepack is expected to be a part of Node.js)

Step-by-step reproduction instructions (by running brew commands)

Already included above

[karlhorky]

Further Background

After doing a bit of research in the Homebrew repository, I can see the following:

1. This seems to be caused by the --without-corepack flag in the node.rb Formula

   1. homebrew-core/Formula/n/node.rb

      Line 70 in 33b4fac

      --without-corepack

2. Homebrew team member @cho-m recommends usage of Homebrew to install Corepack separately with brew install corepack (which would mean the version number is managed by Homebrew). An exception is made for old versions such as node@20, node@18, etc, where the --without-corepack is not present
   1. corepack not installed with formula node #151439 (comment)
   2. This means that the Homebrew behavior will be different for different versions:
      1. node@22: corepack not installed
      2. node@20 and older: corepack installed
3. The --without-corepack flag was first added in a PR for Node.js 17.3.0, involved Homebrew members @chenrui333 @carlocab @SMillerDev @bevanjkay
   1. node 17.3.0 #91540
   2. The original reason was "Tests are failing at the moment because of a symlink collision with corepack.", so seems like a Homebrew CI problem

I originally reported this over in the Node.js repository:

• corepack not installed by default with Homebrew nodejs/node#55366

And received a response that this should be reported here.

[ovflowd]

Hey Homebrew maintainers (@carlocab @SMillerDev @bevanjkay @chenrui333 @cho-m), I'm Claudio, one of the core collaborators of Node.js, I'm chiming in here as I've never noticed that Homebrew intentionally removed core features from Node.js (https://github.com/Homebrew/homebrew-core/blob/master/Formula/n/node.rb#L69-L70) on its formulae.

This is not a sanctioned way that we (Node.js) approve of people distributing Node.js. This might cause many expectation issues and hinder how we expect community package managers to ship Node.

So, I'd like to ask Homebrew maintainers to remove those flags formally. Node.js users expect all installation methods bundled via Node.js version managers, OS package managers, or community package managers to install Node similarly.

We cannot endorse Homebrew as a way of installing Node.js if Homebrew intentionally changes (without the user's explicit consent and knowledge) what gets shipped when they install Node. (Note that this is not a threat, although it might sound; We just want to ensure that the official ways we recommend on our website all have the same behaviour)

Even worse, Homebrew is deliberately changing which npm version gets installed with the Node.js formula, which should always contain the npm version that comes with the respective Node.js binary. Otherwise, it is incorrect to advertise to the end-user that a specific version of Node.js is being installed when certain components are being modified. This also violates our LICENSE, as you are distributing Node.js in a way that sounds and looks like it is binary but changes the result. On a separate note, I can understand why these args are being passed, but anything else is definitely, let's say "not cool".

I'd certainly appreciate it if this behavior is undone.

Edit: My side assumed that different versions are shipped, which is incorrect. However, Homebrew is still discouraged from manually bundling npmin an extraneous way.

Edit 2: It is important to mention that my statements are not a representation of Node.js as a whole but as someone who is deeply involved with its infrastructure and development.

[ovflowd]

I've made a PR here: #194041 but no idea yet if it passes, if the changes are correct; I'll test on my MacBook later :)

[carlocab]

Even worse, Homebrew is deliberately changing which npm version gets installed with the Node.js formula

That's not actually accurate -- we always make sure that the npm version matches what's shipped with Node:

homebrew-core/Formula/n/node.rb

Lines 49 to 50 in 4a0d38c

	# We track major/minor from upstream Node releases.
	# We will accept *important* npm patch releases when necessary.

If there's been a mismatch historically then that was an oversight.

[ovflowd]

That's not actually accurate -- we always make sure that the npm version matches what's shipped with Node:

Appreciate for chiming in. I raised a question within my PR OOC to better understand Homebrew's deliberate decision here; Apologies for my lack of context here 🙇

[Bo98]

This also violates our LICENSE, as you are distributing Node.js in a way that sounds and looks like it is binary but changes the result.

This is quite an alarming sentence to deliver to send to downstreams and implies NodeJS has a very strong stance against https://opensource.org/osd.

---

Focussing on the pull request in isolation: I'm ok with making changes. The corepack decision came at a time where corepack was still experimental several years ago (and the corepack build flags didn't actually exist yet). I recognise things have changed - it's simply been that nobody has raised the question since, perhaps in part because the % of users that install corepack is very low.

Node 23 is in a couple days and is an excellent opportunity to make any big changes along with a fresh node@22.

npm was actually done in response to upstream reported issues: npm/npm#3794. The default npm build within Node didn't work properly under Homebrew so we needed to build it separately for it to work. It's possible things have improved since - I'll need to figure out what the test case for that is as 10 years is a long time. Note that we have for years guaranteed that we will always match upstream versions (unless there's some critical bugfix but that hasn't been the case for many years). I do however agree that using the bundled version is nicer if it works better nowadays.

But I'm overall OK for removing --without-corepack (but only if we delete the separate corepack formula too and merge it in).

[cho-m]

Node.js users expect all installation methods bundled via Node.js version managers, OS package managers, or community package managers to install Node the same way.

Based on quick check through Repology, this statement doesn't seem to hold up:

• Debian (disable both¹). Separate packages that track latest versions for:
  • corepack - https://packages.debian.org/source/sid/node-corepack
  • npm - https://packages.debian.org/source/sid/npm
• Fedora (disable corepack²)
• Alpine (disable npm³) - Separate package that track latest version for:
  • npm - https://pkgs.alpinelinux.org/package/edge/community/x86_64/npm
• Arch Linux (disable npm⁴). Separate package that track latest version for:
  • npm - https://archlinux.org/packages/extra/any/npm/
• MacPorts (disable npm⁵, don't install corepack in files⁶). Separate package that track latest version for:
  • npm - https://ports.macports.org/port/npm10/
  • NOTE: corepack never merged - corepack: new Portfile macports/macports-ports#16615

Footnotes

1. https://salsa.debian.org/js-team/nodejs/-/blob/master-20.x/debian/rules#L26-27 ↩

2. https://src.fedoraproject.org/rpms/nodejs22/blob/rawhide/f/nodejs22.spec#_591 ↩

3. https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/community/nodejs-current/APKBUILD#L133 ↩

4. https://gitlab.archlinux.org/archlinux/packaging/packages/nodejs/-/blob/main/PKGBUILD?ref_type=heads#L53 ↩

5. https://github.com/macports/macports-ports/blob/master/devel/nodejs22/Portfile#L102 ↩

6. https://ports.macports.org/port/nodejs22/details/ ↩

[carlocab]

This also violates our LICENSE, as you are distributing Node.js in a way that sounds and looks like it is binary but changes the result.

This is quite an alarming sentence to deliver to send to downstreams and implies NodeJS has a very strong stance against opensource.org/osd.

Yes, agreed. I'll also note that a number of packages mentioned in upstream documentation do some pretty similar things as we do:

• Fedora passes --without-corepack: https://src.fedoraproject.org/rpms/nodejs22/blob/03812ccd222c2c7ffbc3721ef11dd2d45e2f0e73/f/nodejs22.spec#_591
• Debian passes both --without-npm and --without-corepack: https://salsa.debian.org/js-team/nodejs/-/blob/94873a3915ac88b3f423c44a44e90db939a151ad/debian/rules#L26
• Arch passes --without-npm: https://gitlab.archlinux.org/archlinux/packaging/packages/nodejs/-/blob/a2f9410569ec3621fc8fbe655a8ee0e479d2c6a5/PKGBUILD#L53

Are any/all of these in violation of Node's license?

Edit: Got scooped by @cho-m. Didn't see the previous comment till I submitted mine 😄

[carlocab]

But I'm overall OK for removing --without-corepack (but only if we delete the separate corepack formula too and merge it in).

Might be tricky for some dependents to both depend on node but conflict with node:

homebrew-core/Formula/c/corepack.rb

Lines 20 to 21 in 1e6e3ab

	conflicts_with "yarn", because: "both install `yarn` and `yarnpkg` binaries"
	conflicts_with "pnpm", because: "both install `pnpm` and `pnpx` binaries"

[ovflowd]

This is quite an alarming sentence to deliver to send to downstreams and implies NodeJS has a very strong stance against opensource.org/osd.

Apologies, this is indeed an unwarranted statement from my side. As per https://github.com/nodejs/node/blob/main/LICENSE, I don't think any license is actually being breached.

The corepack decision came at a time where corepack was still experimental several years ago (and the corepack build flags didn't actually exist yet). I recognise things have changed - it's simply been that nobody has raised the question since, perhaps in part because the % of users that install corepack is very low.

I understand that, but there are active conversations within the Node team about whether corepack should be removed or not; removing it from Homebrew install paths at this time is not recommended.

Based on quick check through Repology, this statement doesn't seem to hold up:

• Debian (disable both1). Separate packages that track latest versions for:

  • corepack - packages.debian.org/source/sid/node-corepack
  • npm - packages.debian.org/source/sid/npm

• Fedora (disable corepack2)

• Alpine (disable npm3) - Separate package that track latest version for:

  • npm - pkgs.alpinelinux.org/package/edge/community/x86_64/npm

• Arch Linux (disable npm4). Separate package that track latest version for:

  • npm - archlinux.org/packages/extra/any/npm

• MacPorts (disable npm5, don't install corepack in files6). Separate package that track latest version for:

  • npm - ports.macports.org/port/npm10
  • NOTE: corepack - never merged PR - corepack: new Portfile macports/macports-ports#16615

I doubt that the we are aware that this was the case. We don't have control over what package managers decide to do or not with Node, hence I'm reaching out here. I appreciate you for compiling this list, I'm actually shocked that this is the case, and I'm not sure if the Node.js release team is aware of this -- I'll reach them out and check-in.

[ovflowd]

npm was actually done in response to upstream reported issues: npm/npm#3794. The default npm build within Node didn't work properly under Homebrew so we needed to build it separately for it to work.

I imagined something like this was the case 🤔

I'll need to figure out what the test case for that is as 10 years is a long time.

I don't want to waste your volunteering time unnecessarily. I would appreciate it if you could check that, but only if that's a reasonable ask from my side.