This is the output from a npm ci run from a project I maintain (not develop!):
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out
lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more
comprehensive and powerful.
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out
lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more
comprehensive and powerful.
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated inside@1.0.0: Package no longer supported. Contact Support at https://www.npmjs.com/support
for more info.
npm WARN deprecated @babel/plugin-proposal-class-properties@7.18.6: This proposal has been merged to the ECMAScript
standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-properties instead.
npm WARN deprecated request-promise-native@1.0.9: request-promise-native has been deprecated because it extends
the now deprecated request package, see https://github.com/request/request/issues/3142
npm WARN deprecated @stylelint/postcss-markdown@0.36.2: Use the original unforked package instead: postcss-markdown
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated domexception@1.0.1: Use your platform's native DOMException instead
npm WARN deprecated debug@4.2.0: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity
ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or
4.3.1. (https://github.com/visionmedia/debug/issues/797)
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated @babel/plugin-proposal-object-rest-spread@7.20.7: This proposal has been merged to the ECMAScript
standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-object-rest-spread instead.
npm WARN deprecated glob@7.1.6: Glob versions prior to v9 are no longer supported
npm WARN deprecated w3c-hr-time@1.0.2: Use your platform's native performance.now() and performance.timeOrigin.
npm WARN deprecated domexception@4.0.0: Use your platform's native DOMException instead
npm WARN deprecated sourcemap-codec@1.4.8: Please use @jridgewell/sourcemap-codec instead
npm WARN deprecated cucumber-tag-expressions@1.1.1: Package no longer supported. Contact Support at
https://www.npmjs.com/support for more info.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random()
in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random()
in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated @stylelint/postcss-css-in-js@0.37.3: Package no longer supported. Contact Support at
https://www.npmjs.com/support for more info.
npm WARN deprecated critters@0.0.24: Ownership of Critters has moved to the Nuxt team, who will be maintaining
the project going forward. If you'd like to keep using Critters, please switch to the actively-maintained fork
at https://github.com/danielroe/beasties
npm WARN deprecated dommatrix@1.0.3: dommatrix is no longer maintained. Please use @thednp/dommatrix.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated gherkin@5.1.0: This package is now published under @cucumber/gherkin
npm WARN deprecated ng-click-outside@9.0.1: ng-click-outside is no longer maintained. See
https://github.com/arkon/ng-sidebar/issues/229
npm WARN deprecated cucumber-expressions@5.0.18: This package is now published under @cucumber/cucumber-expressions
npm WARN deprecated cucumber-expressions@6.6.2: This package is now published under @cucumber/cucumber-expressions
npm WARN deprecated cucumber-messages@8.0.0: This package is now published under @cucumber/messages
npm WARN deprecated fork-awesome@1.1.7: Package no longer supported. Contact Support at https://www.npmjs.com/support
for more info.
npm WARN deprecated gherkin@9.0.0: This package is now published under @cucumber/gherkin
npm WARN deprecated @applitools/eyes-sdk-core@12.23.12: Please see https://applitools.com/docs/api-ref/ to find
the right package for your tests
npm WARN deprecated cucumber@4.2.1: Cucumber is publishing new releases under @cucumber/cucumber
npm WARN deprecated core-js@2.6.12: core-js@<3.23.3 is no longer maintained and not recommended for usage due
to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a
slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade
your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.6.4: core-js@<3.23.3 is no longer maintained and not recommended for usage due to
the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a
slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade
your dependencies to the actual version of core-js.
This is bluntly, insane.
As a package maintainer it is technically my responsibility to ensure that I am providing functional, secure software to the people that consume my work. But that is fundamentally impossible for me, as an outsider (to the project’s development) to do here.
If I had to guess, its probably also impractical for the (paid) development team sit down and fully fix. And even if it wasn’t this code base is only ~5 years old… so what expectation does the dev team have that if they invest the weeks (months) needed to unscrew this, it remains unscrewed for long enough that it becomes a good use of time?
I don’t know.
It does seem to me however, that the NPM ecosystem is simply not ready for the challenges of writing stable software that remains usable (& secure) over decade long horizons.
I wonder how much economic damage it has done in terms of time wasted on security evaluations, constant patch bumps (and the related CI resource wasted on testing such), cognitive overhead and “stop the world” refactors required to exist in it’s sphere of influence.
Building on top of the NPM dependency tower sure looks a lot like trying to keep your head above the sewage line… and I can smell it’s stench quite strongly right now.
Reply by Email