Gitea Build Fails Due to Removed stylus@0.57.0 from npm Registry #14795

New Issue

GiteaMirror · 2025-11-02T11:23:11-06:00

GiteaMirror commented

2025-11-02 11:23:11 -06:00

Originally created by @SomanathThilak on GitHub (Jul 23, 2025).

Description

Building Gitea from source using Dockerfile.rootless fails during the frontend build step due to a transitive dependency on stylus@0.57.0, which has been unpublished from the npm registry(https://www.npmjs.com/package/stylus?activeTab=versions).

Build Logs

[2025-07-23T04:15:25.669Z] npm warn deprecated @humanwhocodes/config-array@0.11.14: Use @eslint/config-array instead
[2025-07-23T04:15:25.669Z] npm warn deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
[2025-07-23T04:15:30.950Z] npm warn deprecated eslint@8.57.0: This version is no longer supported. Please see https://eslint.org/version-support for other options.
[2025-07-23T04:15:37.534Z] npm error code E404
[2025-07-23T04:15:37.534Z] npm error 404 Not Found - GET https://registry.npmjs.org/stylus/-/stylus-0.57.0.tgz - Not found
[2025-07-23T04:15:37.534Z] npm error 404
[2025-07-23T04:15:37.534Z] npm error 404 'stylus@https://registry.npmjs.org/stylus/-/stylus-0.57.0.tgz' is not in this registry.
[2025-07-23T04:15:37.534Z] npm error 404
[2025-07-23T04:15:37.534Z] npm error 404 Note that you can also install from a
[2025-07-23T04:15:37.534Z] npm error 404 tarball, folder, http url, or git url.
[2025-07-23T04:15:37.534Z] npm error A complete log of this run can be found in: /opt/nodejs/cache/npm/_logs/2025-07-23T04_15_16_528Z-debug-0.log

Gitea Version

1.23.8

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Kubernetes Cluster

Database

None

Originally created by @SomanathThilak on GitHub (Jul 23, 2025). ### Description Building Gitea from source using Dockerfile.rootless fails during the frontend build step due to a transitive dependency on stylus@0.57.0, which has been unpublished from the npm registry(https://www.npmjs.com/package/stylus?activeTab=versions). Build Logs [2025-07-23T04:15:25.669Z] npm warn deprecated @humanwhocodes/config-array@0.11.14: Use @eslint/config-array instead [2025-07-23T04:15:25.669Z] npm warn deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead [2025-07-23T04:15:30.950Z] npm warn deprecated eslint@8.57.0: This version is no longer supported. Please see https://eslint.org/version-support for other options. [2025-07-23T04:15:37.534Z] npm error code E404 [2025-07-23T04:15:37.534Z] npm error 404 Not Found - GET https://registry.npmjs.org/stylus/-/stylus-0.57.0.tgz - Not found [2025-07-23T04:15:37.534Z] npm error 404 [2025-07-23T04:15:37.534Z] npm error 404 'stylus@https://registry.npmjs.org/stylus/-/stylus-0.57.0.tgz' is not in this registry. [2025-07-23T04:15:37.534Z] npm error 404 [2025-07-23T04:15:37.534Z] npm error 404 Note that you can also install from a [2025-07-23T04:15:37.534Z] npm error 404 tarball, folder, http url, or git url. [2025-07-23T04:15:37.534Z] npm error A complete log of this run can be found in: /opt/nodejs/cache/npm/_logs/2025-07-23T04_15_16_528Z-debug-0.log ### Gitea Version 1.23.8 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Kubernetes Cluster ### Database None

GiteaMirror added the type/bug label 2025-11-02 11:23:11 -06:00

GiteaMirror closed this issue

2025-11-02 11:23:11 -06:00

GiteaMirror commented

2025-11-02 11:23:12 -06:00

@TheFox0x7 commented on GitHub (Jul 23, 2025):

Stylus is working on restoring the package https://github.com/stylus/stylus/issues/2938, they currently wait on npmjs response.
npm audit reports it's because of https://github.com/advisories/GHSA-fh4q-jc76-r59p which from the linked above thread is not the only report of malware being in a package from first version.

@TheFox0x7 commented on GitHub (Jul 23, 2025): Stylus is working on restoring the package https://github.com/stylus/stylus/issues/2938, they currently wait on npmjs response. npm audit reports it's because of https://github.com/advisories/GHSA-fh4q-jc76-r59p which from the linked above thread is not the only report of malware being in a package from first version.

GiteaMirror commented

2025-11-02 11:23:12 -06:00

@silverwind commented on GitHub (Jul 23, 2025):

We depend on it via 2 dependency paths:

gitea
├─┬ @vitejs/plugin-vue@6.0.0
│ └─┬ vite@7.0.2
│   └── stylus@0.57.0
└─┬ eslint-plugin-vue-scoped-css@2.11.0
  └─┬ postcss-styl@0.12.3
    └── stylus@0.57.0 deduped

It's a very rare occurence that npm actually unpublishes packages. Given that vite depends on it, it has massive impact. Let's wait on how this is resolved, and then ideally update these dependencies.

@silverwind commented on GitHub (Jul 23, 2025): We depend on it via 2 dependency paths: ``` gitea ├─┬ @vitejs/plugin-vue@6.0.0 │ └─┬ vite@7.0.2 │ └── stylus@0.57.0 └─┬ eslint-plugin-vue-scoped-css@2.11.0 └─┬ postcss-styl@0.12.3 └── stylus@0.57.0 deduped ``` It's a very rare occurence that npm actually unpublishes packages. Given that vite depends on it, it has massive impact. Let's wait on how this is resolved, and then ideally update these dependencies.

GiteaMirror commented

2025-11-02 11:23:13 -06:00

@silverwind commented on GitHub (Jul 23, 2025):

From what I gather, this takedown is bogus and I expect npm admins to restore the package shortly.

If https://github.com/future-architect/eslint-plugin-vue-scoped-css/issues/402 gets resolved, we may completely drop stylus from the dependency list because its marked as optional dependency in vite.

@silverwind commented on GitHub (Jul 23, 2025): From what I gather, this takedown is bogus and I expect npm admins to restore the package shortly. If https://github.com/future-architect/eslint-plugin-vue-scoped-css/issues/402 gets resolved, we may completely drop stylus from the dependency list because its marked as optional dependency in vite.

GiteaMirror commented

2025-11-02 11:23:13 -06:00

@TheFox0x7 commented on GitHub (Jul 23, 2025):

Package is restored

@TheFox0x7 commented on GitHub (Jul 23, 2025): Package is restored

GiteaMirror commented

2025-11-02 11:23:13 -06:00

@techknowlogick commented on GitHub (Jul 23, 2025):

Thanks for the update @TheFox0x7

I will close this issue now

@techknowlogick commented on GitHub (Jul 23, 2025): Thanks for the update @TheFox0x7 I will close this issue now

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14795