Deprecated dependencies in @mapbox/node-pre-gyp

[Johnwjl]

• Operating System (or Browser): macOS
• Node Version: 20.17.0
• Link to reproduction: https://stackblitz.com/edit/nuxt-starter-m7qsfv?file=README.md

Description

I noticed that @mapbox/[email protected] introduces deprecated dependencies:

• [email protected]
  • [email protected]
  • [email protected]
• [email protected]
  • glob @7.2.3

Could you please consider updating npmlog rimraf and addressing these deprecated dependencies?

Steps to reproduce

1. Install a project that depends on @mapbox/node-pre-gyp
2. Run pnpm install
3. Observe deprecation warnings about these packages.

Dependency chain:

nuxt 3.13.1
└─┬ nitropack 2.9.7
  └─┬ @vercel/nft 0.26.5
    └─┬ @mapbox/node-pre-gyp 1.0.11
      └─┬ npmlog 5.0.1
        └── are-we-there-yet 2.0.0
        └── gauge 3.0.2
      └── rimraf 3.0.2
         └── glob 7.2.3

[heath-freenome]

These deprecated dependencies are triggering Snyk warnings in our enterprise. Given that rimraf is an easy upgrade, can't you at least make that change? Not sure how hard npmlog upgrade is

[je-movers-market]

This seems to have been an issue since around July (#877), and I've been noticing it myself for quite a few months.

@mapbox/node-pre-gyp is also a subdependency of @vercel/nft so it's presumably affecting a good amount of Vercel users. In my case using @sveltejs/adapter-vercel is causing it, as it has a dependency on the nft package.

Surprising it's been like this for so long.

[Tofandel]

And also @vercel/nft is a dependency of nitropack which is itself a dependency of nuxt, so pretty much 50% of the npm ecosystem is affected

They seem to have addressed them already but haven't published a release yet
e882b7e#diff-2187cf6e5770e0f160f1d63d4a287f35d012e3dd3e08464e45490d81b20b9049R27

[leeobrum]

Do we have any solution? @cclauss

[leeobrum]

can you help us @lukekarrys?

[minenwerfer]

I hope this issue gets solved, it's spamming the console with warning messages when my package is installed.

[cclauss]

What is the status of this?

[HummingMind]

+1
Would also like to see this get fixed.

Thank you! 🍻

[benmccann]

I believe this should be fixed in 2.0.0-rc.0. npmlog was replaced with consola. rimraf is no longer a direct dependency, but unfortunately is still pulled in by minizlib. There are a couple PRs out to remove it such as isaacs/minizlib#30. But I think it's a newer version so it should at least fix the deprecation warnings

[HummingMind]

Looks like the deprication warnings are gone with 2.0.0-rc.0.

Thank you!