Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

npm install from source throws warnings: Deprecated packages #9658

Closed
sudheesh001 opened this issue Jul 13, 2016 · 2 comments
Closed

npm install from source throws warnings: Deprecated packages #9658

sudheesh001 opened this issue Jul 13, 2016 · 2 comments
Labels
External Relates to another program, environment, or user action which we cannot control.

Comments

@sudheesh001
Copy link
Contributor

This is not a major bug or a blocker but just some cleanup that needs to be done with older packages and updating the packages listing

npm WARN deprecated tsd@0.6.5: TSD is deprecated in favor of Typings (https://github.com/typings/typing s) - see https://github.com/DefinitelyTyped/tsd/issues/269 for more information
npm WARN deprecated graceful-fs@3.0.8: graceful-fs v3.0.0 and before will fail on node releases >= v7.0 . Please update to graceful-fs@^4.0.0 as soon as possible. Use 'npm ls graceful-fs' to find it in the t ree.
npm WARN deprecated minimatch@2.0.10: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS  issue
npm WARN deprecated minimatch@0.2.14: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS  issue
npm WARN deprecated lodash@1.0.2: lodash@<3.0.0 is no longer maintained. Upgrade to lodash@^4.0.0.
npm WARN deprecated graceful-fs@1.2.3: graceful-fs v3.0.0 and before will fail on node releases >= v7.0 . Please update to graceful-fs@^4.0.0 as soon as possible. Use 'npm ls graceful-fs' to find it in the t ree.
npm WARN deprecated minimatch@0.3.0: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS i ssue
npm WARN deprecated to-iso-string@0.0.2: to-iso-string has been deprecated, use @segment/to-iso-string  instead.
npm WARN deprecated jade@0.26.3: Jade has been renamed to pug, please install the latest version of pug  instead of jade
npm WARN deprecated minimatch@1.0.0: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS i ssue
@mhegazy
Copy link
Contributor

mhegazy commented Jul 13, 2016

minimatch comes from istanbule,browserify and tslint
graceful-fs and lodash come from gulp
to-iso-string and jade come from mocha

we are using latest form all these, so the bugs should be really on these package authors to publish a new package that does not depend on the depricated entries.

the only one we could remove is tsd, and we should do that soon.

@weswigham
Copy link
Member

gulp uses a new version of graceful-fs with version 4, which is still on version alpha.2 (and have stated that the vinyl-fs version and thereby the graceful fs version will not be bumped for gulp 3.x, as it would be a breaking change) - they're still working on integrating vinyl-fs 3.0.0. (Which is the outstanding issue for publishing a @next tag. Once gulp finally publishes an @next tag, I'll open a PR to convert our gulpfile to the new gulp 4 .series and .parallel style and update the dependency to @next.

Mocha should update it's iso string dep soon - we shouldn't have to do a thing. However, its jade dep may stick around for a bit as they still support old npm versions which can't handle the change.

TSLint still depends on optimist which, in turn is (unbeknownst to npm) deprecated, hence its dependence on an ancient version of minimist. There's no issue on TSLint to change this at present, so I imagine someone would need to inform them.

sudheesh001 added a commit to sudheesh001/TypeScript that referenced this issue Jul 14, 2016
sudheesh001 added a commit to sudheesh001/TypeScript that referenced this issue Jul 19, 2016
sudheesh001 added a commit to sudheesh001/TypeScript that referenced this issue Jul 21, 2016
@RyanCavanaugh RyanCavanaugh added the External Relates to another program, environment, or user action which we cannot control. label Aug 18, 2016
@microsoft microsoft locked and limited conversation to collaborators Jun 19, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
External Relates to another program, environment, or user action which we cannot control.
Projects
None yet
Development

No branches or pull requests

4 participants