Updating to nodejs 8.11.3-2.fc28 is not possible if openssl-devel is already installed with error: package compat-openssl10-devel-1:1.0.2o-1.fc28.x86_64 conflicts with openssl-devel provided by openssl-devel-1:1.1.0h-3.fc28.x86_64 This is caused by the revert to OpenSSL 1.0 from bug 1607112. This break any chance to do local development modules that don't have to link with OpenSSL too if the users need openssl-devel 1.1 for another projects. Probably disabling compat-openssl10-devel temporally until OpenSSL 1.1 is used is the best action. The problem that could happen is people building NodeJS modules with wrong OpenSSL (if those use OpenSSL). Currently the update path of NodeJS is broken if the user has openssl-devel installed, they may notice it if they use dnf, but if they use GUI tools, like GNOME Software for example, they may not notice they are left with and old (probably vulnerable) NodeJS
The nodejs package does not depend on compat-openssl10-devel, it depends on compat-openssl10. However, the nodejs-devel package *does* actually require compat-openssl10 because it is useless without it. (If you wanted to build a native binary NPM against this Node.js version, you must have the same version of openssl-devel available in your environment). This is behaving exactly as it should, and if you don't need nodejs-devel, you should just remove it and the upgrade will work fine.
Sorry, but I don't need compat-openssl10-devel to build a node native module like node-sass, I only need node-devel. node-sass doesn't link with openssl, Why would I need compat-openssl10-devel installed?. On the other hand I need openssl-devel in order to link other things not related to node development, and I don't want to use old OpenSSL releases. I think *-devel packages on Fedora has a tendency to pull a lot of *-devel dependencies that aren't always needed. Can you reconsider this?
AFAIK nodejs v8.x should be fully compatible with both versions of OpenSSL.
(In reply to Zuzana Svetlikova from comment #3) > AFAIK nodejs v8.x should be fully compatible with both versions of OpenSSL. Upstream claims that it is fully compatible, but it doesn't work. See https://bugzilla.redhat.com/show_bug.cgi?id=1607112 for an example.
Looks more like a workaround for me and something that should be fixed upstream.