deprecated package warnings during install

[MasterJames]

I got some warnings during installation.
Installer depreciated packages warnings:

npm WARN deprecated @mapbox/gl-matrix@0.0.1: This
npm WARN deprecated nomnom@1.8.1: Package no longer supported. Contact support@npmjs.com for more info.

Should I be concerned about them?

Also getting static-eval warnings

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Sandbox Breakout / Arbitrary Code Execution                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ static-eval                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.0.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ plotly.js                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ plotly.js > gl-plot2d > gl-select-static > cwise >           │
│               │ static-module > static-eval                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/548                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Sandbox Breakout / Arbitrary Code Execution                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ static-eval                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.0.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ plotly.js                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ plotly.js > gl-plot3d > gl-select-static > cwise >           │
│               │ static-module > static-eval                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/548                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Sandbox Breakout / Arbitrary Code Execution                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ static-eval                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.0.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ plotly.js                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ plotly.js > ndarray-fill > cwise > static-module >           │
│               │ static-eval                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/548                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Sandbox Breakout / Arbitrary Code Execution                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ static-eval                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.0.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ plotly.js                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ plotly.js > ndarray-homography > ndarray-warp > cwise >      │
│               │ static-module > static-eval                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/548                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

[etpinard]

Also getting static-eval warnings

That one is in scijs/cwise#19 and only potentially affects uses bundling custom versions of plotly.js.

Installer depreciated packages warnings:

I just did a fresh npm i plotly.js and I can't replicate

would you mind sharing which npm version you're using?

[MasterJames]

Node: V10.2.1
Npm: 6.1.0

[etpinard]

Thanks @MasterJames but I still can't replicate in node v10 + npm@6.1.0.

[MasterJames]

That's interesting maybe this alternative makes the truth clearer.
https://www.npmjs.com/package/@gerhobbelt/nomnom

I guess it's a dependency within a dependency
mapbox/mapbox-gl-js#6758
It says it doesn't exists 404 ? https://github.com/mapbox/gl-matrix
looks like it needs to be mapbox-gl-js now

[thanks for catching that typo @alexjohnson I didn't even notice the different.]

https://www.npmjs.com/package/@mapbox/gl-matrix
also shows it's done.

As to the import route it's great but I'll wait until it exists in it's function form.
[Current import() polyfill has 45 dependencies]

[etpinard]

OK. Looks like both these deprecated packages are third party dep of mapbox-gl.

• Bumping to mapbox-gl@0.45.0 (in plotly_relayout on mapbox scroll #2709) appears to solve the nomnom issue.
• About gl-matrix, there's not much else we can do outside of @mapbox/gl-matrix is gone, 0.45.0 no longer works mapbox/mapbox-gl-js#6758

so, I'll close this issue.