npm / npm/cli

[BUG] Depends on deprecated packages path-is-absolute and read-package-tree

Open
#4,905 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Needs Triage Release 8.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

Hiya! 👋🏻

When I installed the latest npm, I was surprised to see path-is-absolute among the dependencies. Its npm page says:

This package has been deprecated
This package is no longer relevant as Node.js 0.12 is unmaintained.

On further digging, I found that read-package-tree is also deprecated:

The functionality that this package provided is now in @npmcli/arborist

Here's a quick-and-dirty command I ran to try and figure out where these dependencies came from:

$ rg path-is-absolute -l | grep package.json
node_modules/path-is-absolute/package.json
node_modules/tap/node_modules/path-is-absolute/package.json
node_modules/tap/node_modules/glob/package.json
node_modules/read-package-tree/node_modules/glob/package.json
node_modules/test-exclude/node_modules/glob/package.json
node_modules/tap-mocha-reporter/node_modules/glob/package.json
node_modules/nyc/node_modules/glob/package.json
node_modules/node-gyp/node_modules/glob/package.json
node_modules/rimraf/node_modules/glob/package.json
workspaces/arborist/test/fixtures/install-types/node_modules/glob/package.json
workspaces/arborist/test/fixtures/install-types/node_modules/path-is-absolute/package.json
workspaces/arborist/test/fixtures/global-style/lib/node_modules/rimraf/node_modules/glob/package.json
workspaces/arborist/test/fixtures/global-style/lib/node_modules/rimraf/node_modules/path-is-absolute/package.json
workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/path-is-absolute/package.json
workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/babel-core/package.json
workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/glob/package.json
$ rg read-package-tree -l | grep package.json
node_modules/read-package-tree/package.json
node_modules/licensee/package.json
workspaces/arborist/test/fixtures/root/node_modules/foo/node_modules/express/package.json

I've filed one PR on node-glob and updated one issue on licensee, but I figured I should open an overall issue on npm/cli for the main issue I'm trying to address.

Expected Behavior

No response

Steps To Reproduce

No response

Environment

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by inspecting the dependency paths listed by the rg ... package.json commands and the npm CLI package manifests. Review the referenced node-glob pull request and licensee issue, then determine which deprecated dependencies remain in npm's tree; done means the affected paths have been resolved or clearly documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.