npm install warnings >= 11.0.3

# `@adobe/aio-cli` — Deprecation Warning Analysis

## Warnings:
```
❯ npm install -g @adobe/aio-cli
npm warn Unknown user config "always-auth" (//artifactory-no1.corp.adobe.com/artifactory/api/npm/npm-wxp-dev/:always-auth). This will stop working in the next major version of npm.
npm warn deprecated debuglog@1.0.1: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
npm warn deprecated readdir-scoped-modules@1.1.0: This functionality has been moved to @npmcli/fs
npm warn deprecated @npmcli/move-file@1.1.2: This functionality has been moved to @npmcli/fs
npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated read-package-json@6.0.4: This package is no longer supported. Please use @npmcli/package-json instead.
npm warn deprecated npmlog@5.0.1: This package is no longer supported.
npm warn deprecated @npmcli/move-file@2.0.1: This functionality has been moved to @npmcli/fs
npm warn deprecated @npmcli/move-file@2.0.1: This functionality has been moved to @npmcli/fs
npm warn deprecated rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported
npm warn deprecated npmlog@6.0.2: This package is no longer supported.
npm warn deprecated npmlog@6.0.2: This package is no longer supported.
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated are-we-there-yet@2.0.0: This package is no longer supported.
npm warn deprecated are-we-there-yet@3.0.1: This package is no longer supported.
npm warn deprecated are-we-there-yet@3.0.1: This package is no longer supported.
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@8.1.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@8.1.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@8.1.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@8.1.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated gauge@3.0.2: This package is no longer supported.
npm warn deprecated gauge@4.0.4: This package is no longer supported.
npm warn deprecated gauge@4.0.4: This package is no longer supported.
npm warn deprecated fstream@1.0.12: This package is no longer supported.
npm warn deprecated tar@6.2.1: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated uuid@8.3.2: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
npm warn deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me

added 1955 packages, and changed 1 package in 1m

321 packages are looking for funding
run `npm fund` for details
```

## Key Finding: `overrides` Won't Help End Users

The `overrides` field in `package.json` (which already sets `rimraf: ^5` and `tar: ^7`)
**only applies when the package is the root project** (i.e., local dev installs).
When users run `npm install -g @adobe/aio-cli`, npm ignores these overrides entirely.
This is why users still see rimraf@2/3 warnings despite the override being present.

## Root Causes by Source

### `@adobe/aio-cli-plugin-app@14.8.0` — main culprit

| Old dependency in plugin-app | Deprecated packages it brings in |
|---|---|
| `yeoman-environment@^3.2.0` | `npmlog@5`, `are-we-there-yet@2`, `gauge@3`, `readdir-scoped-modules`, `debuglog`, `@npmcli/arborist@4`, `@npmcli/move-file@1` |
| `archiver@^5.3.1` | `archiver-utils@2/3` → `glob@7`, `inflight` |
| `unzipper@^0.10.11` | `fstream@1` → `rimraf@2` |

Their transitive `node-gyp@8/9` additionally brings in: `npmlog@6`, `are-we-there-yet@3`,
`gauge@4`, `@npmcli/move-file@2`, `glob@8`

### `@adobe/aio-cli-plugin-app-dev@2.3.0`

- `archiver@6` → `archiver-utils@4` → `glob@8`

### `@adobe/aio-lib-state` → `@azure/cosmos@4.9.3`

- Pins `uuid@^8.3.0` directly — even the latest v4.x does this

### `jest-junit@16` _(devDep only — does not affect end users)_

- `uuid@8`

---

## What Can Be Fixed in This Repo

Very little — the deprecated packages all originate in plugin repos:

- **`jest-junit@17`** — upgrading won't help; it still depends on `uuid@^14` per its manifest
- **`glob@10.5.0`** — comes from `rimraf@5.0.10` (direct devDep); no rimraf@6+ exists yet that uses glob@11

---

## What Needs to Be Fixed in Plugin / Lib Repos

| Repo & change | Warnings eliminated |
|---|---|
| `@adobe/aio-cli-plugin-app`: `yeoman-environment@^3` → `^4` | `npmlog@5`, `are-we-there-yet@2`, `gauge@3`, `readdir-scoped-modules`, `debuglog`, `@npmcli/arborist@4`, `@npmcli/move-file@1` |
| `@adobe/aio-cli-plugin-app`: `archiver@^5` → `^7` | `glob@7`, `inflight` |
| `@adobe/aio-cli-plugin-app`: `unzipper@^0.10` → `^0.12`+ or replace with `fflate` | `fstream`, `rimraf@2` |
| `@adobe/aio-cli-plugin-app-dev`: `archiver@^6` → `^7` | `glob@8` (via archiver-utils@4) |
| `@adobe/aio-lib-state`: update `@azure/cosmos` once they drop uuid@8 | `uuid@8` |

> **Priority:** Upgrading `yeoman-environment@3 → 4` in `plugin-app` alone would
> eliminate roughly half of all warnings. The `archiver` and `unzipper` upgrades
> cover most of the rest.

Start by reproducing the global npm install and reviewing package.json and the dependency manifests named in the report. Trace the warnings to the plugin-app, plugin-app-dev, and aio-lib-state repositories, then verify that the relevant dependency upgrades remove the reported deprecated packages; much of the work is outside aio-cli.

Written by the indexing model from the issue text.