Deprecated glob@10.5.0 warning during npm install (via rimraf)

[ajgcvm]

Summary
During a fresh global install of @google/gemini-cli@latest, npm prints a deprecation warning for glob@10.5.0. The dependency chain shows it coming from rimraf via gaxios.

Steps to reproduce

1. NPM_CONFIG_PREFIX=/Users/antoniomello/.npm-global npm install -g @google/gemini-cli@latest

Actual behavior

npm warn deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version.

Dependency chain

@google/gemini-cli@0.27.0
└─┬ @google/genai@1.30.0
  └─┬ google-auth-library@10.5.0
    └─┬ gaxios@7.1.3
      └─┬ rimraf@5.0.10
        └── glob@10.5.0

Environment

• gemini-cli: 0.27.0
• node: v25.1.0
• npm: 11.6.2
• OS: macOS (Apple Silicon)

Let me know if you'd like any additional details.

[MarcusReimann]

Same with npm install -g @google/gemini-cli@preview.

Actual behaviour:

npm warn deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated node-domexception@1.0.0: Use your platform's native DOMException instead

Security vulnerabilities doesn't sound funny

[haseebmalik18]

/assign

[gemini-cli]

👋 @haseebmalik18, you've been assigned to this issue! Thank you for taking the time to contribute. Make sure to check out our contributing guidelines.

[haseebmalik18]

#18880 looks like this fixes it by forcing glob to ^12.0.0