STOPTIMER node removed from Node Red 12; 5yrs+ since last update; Should I even be using it as I am?; Alternatives?

Third party integrations Node-RED
42

You are more than welcome. I did test this option today so it is needed in the automation example I gave.

43

I agree, I was away on a business trip and this pull completely halted all automations. My wife had no idea what to do, but thankfully we figured something out.
NOT a great way of promoting a reliable and future-proof solution - Some prior warning is required in the future, and despite what some may think, the systems some implement are serious, with an awful lot of effort put into making their solutions robust.

1 Like
44

There was as always

2 Likes
45

Not being mean here. If you are concerned about reliability, you should not auto-update everything. Breaking changes will always happen.

2 Likes
46

There was a warning on the update.

For those who have automatic updates for Node Red I would warmly recommend turning that OFF. An automatic update on NR is just asking for trouble :slight_smile:

2 Likes
47

Sound advice, I will do that now. thanks

4 Likes
48

Errm, looking into this now. Is there a specific way of disabling Node-Red Palette updates, or do I make that change at the node-red add-on level? Forgive me, probably a very silly, over-asked question

49

Node Red Addon level.

2 Likes
50

Yes. Heā€™s the maintainer, he can choose what he does and does not want to support. Also itā€™s common practice to remove unmaintained dependencies from software as they tend to create security vulnerabilities and the ones he removed look pretty unmaintained at this point.

Also he expects people to read the release notes and prepare before updating. If you donā€™t do that or have auto update turned on for addons then the assumption is you would prefer to fix your stuff after it breaks rather then keep it from breaking. Obviously thatā€™s your choice but bear in mind itā€™s not uncommon for addons to have breaking changes and the release notes are your only protection.

3 Likes
51

Now that HA provides such good advice on update availability I have turned off all addon auto updates.

1 Like
52

Too many arenā€™t turning on Analytics?

53

Does analytics include what node red nodes you are using?

54

Or alternatively that simply wasnā€™t the reason for the decision. No updates in almost 6 years suggests it is unmaintained. Unmaintained dependencies tend to become a security risk which means you should remove them even if doing so is a breaking change. Better to get rid of it now while itā€™s just an inconvenience then wait until a vulnerability is discovered and isnā€™t fixed.

1 Like
55

The weekly downloads of node-red-contrib-stoptimer went from 153 to 3575, after it was dropped as built in palette in the addon, so many people are definitely still using it.

Screenshot_20220611-213834_Chrome
Screenshot_20220611-213834_Chrome1080Ɨ2400 132 KB

I use the docker version of node red and added this awhile back on my own manually, and use it on many flows. The appearance it is unsupported with no updates in 5 years is probably more likely why it was pulled out of the addon version. Any lack of updates is a potential security concern, although this one is pretty basic so Iā€™m not really sure what it could potentially do to compromise security. Iā€™ll look at replacing it though with the trigger node.

As a side on security concerns, i ran npm audit in my node red directory. Many other actively ā€œmaintainedā€ palettes listed ā€œhighā€ vulnerabilities. Iā€™ll look into those as well. Probably also a good idea to delete any old palettes that are no longer used/needed.

1 Like
56

Unless missing recent development means it is not really needed. Then such false positive leads to removal which breaks lot of properly working flows without the reason.
I really curious how Frenk collected info about usage of those nodes, I personally use looptimer, stoplimter as well as traffic lights (btw the last one is often suggested on our forum as a solution for various use-cases)

Fortunately, I did read breaking changes, which stopped me from updating yet. But what I can read, itā€™s impossible to update first and then add missing nodes against without damaging flows (the proposal found in NR addon update notes). At the same time, I donā€™t know a way of adding those nodes to the palette from another source, prior to the update (without removal of existing nodes).

The only way of proper update which comes to my mind is, to:

  • backup flows alone
  • update
  • add missing nodes to the palette
  • import flows from backup
57

Just list them in the addon config in npm_packages. The addon setup script will install any packages listed there before starting node red.

58

Unfortunately, this is not what update docs suggest, which caused damage to several users already.

Also, I guess npm_packages could be used by the update process in order to perform this migration in a transparent manner without introducing a breaking change. isnā€™t it?
You can argue that this way users wouldnā€™t stop using ā€˜not maintainedā€™ nodes. But is breaking production application wiser way to achieve that

59

Damage? I read the alert so after updating I installed the node. The only thing that got me concerned was that all the stoptimer nodes appeared on the flow that was on my screen making a mess BUT restarting NR fixed it.

The issue is trivial and so is the fix. Maybe the way it was done is not ideal but I am glad I got a nudge into moving to the way better trigger node supported by the core developers.

This thread was not meant to be a place to debate whether or not the update was justified but rather how to move forward with a better solution. In other words a constructive thread we can all learn from instead of unhelpful repeated complaints.

2 Likes
60

Iā€™ve read comments that one who updated nodered addon, lost connections to/from removed nodes.
Have no personal experience with that since Iā€™m still tarrying the update. But the message is terrifying.

This thread was not meant to be a place to debate whether or not the update was justified but rather how to move forward with a better solution. In other words a constructive thread we can all learn from instead of unhelpful repeated complaints.

I would expect that the best possible way should be provided by the author of this fuss.
I also provided some alternative, if you missed one.

61

It could be what I saw too as all the nodes appeared on the one flow shown on my screen and thus ā€œdisconnectedā€ BUT as I mentioned before, a restart of NR fixed it. Hopefully people running into this issue will find this thread and learn what to do.

Yes, thank you. I was actually going down that path which is when I realized the problem went away on its own with the restart.