npm deprecated warnings in logs

[tarekoraby]

Description of the bug

Running a freshly downloaded Flow or Hilla app, I see the following in the logs

npm WARN deprecated rollup-plugin-terser@7.0.2: This package has been deprecated and is no longer maintained. Please use @rollup/plugin-terser
npm WARN deprecated sourcemap-codec@1.4.8: Please use @jridgewell/sourcemap-codec instead

Expected behavior

No warnings are shown when starting on the latest and greatest Vaadin version

Minimal reproducible example

Run a Flow or Hilla project from start.vaadin.com

Versions

• Vaadin / Flow version: 23.3
• Java version: 17
• OS version: Windows 10

[Artur-]

├─┬ workbox-build@6.5.0
│ ├─┬ rollup-plugin-terser@7.0.2

GoogleChrome/workbox#3136

├─┬ @rollup/plugin-replace@3.1.0
│ ├─┬ magic-string@0.25.9
│ │ └── sourcemap-codec@1.4.8

├─┬ @vitejs/plugin-react@2.2.0
│ ├─┬ magic-string@0.26.7
│ │ └── sourcemap-codec@1.4.8 deduped

[Artur-]

magic-string was fixed in 0.27 a year ago...

[knoobie]

Is workbox for anything used except service worker? If so, shouldn't this be only added if service worker / PWA annotation is used? I've seen this two warnings even for apps with no PWA support at all.

[tarekoraby]

I can still see the warnings in the logs with 24.0.0.alpha8. The linked workbox issue is still not fixed.

[Artur-]

workbox is fixed in #16934 but transform-ast still depends on an old version of magic-string

[Artur-]

Seems like a unreasonably large effort to get rid of all deprecation warnings.

• transform-ast would need a simple update . It has not been released in 5 years though so not holding my breath.
• workbox 7 still has multiple issues in its dependencies
  • rollup-plugin-terser. Has had a PR open for half a year now: fix(rollup-plugin): replace package rollup-plugin-terser by @rollup/plugin-terser GoogleChrome/workbox#3170
  • @surma/rollup-plugin-off-main-thread@2.2.3 depends on magic-string@0.25.9: Upgrade magic-string to avoid warnings in other projects surma/rollup-plugin-off-main-thread#57
  • @rollup/plugin-replace@2.4.2 depends on magic-string@0.25.9. Needs to be updated to 5.0.2