Description
When installing datapackage (v1.1.10), npm emits several deprecation warnings about transitive dependencies:
npm warn deprecated @types/csv-parse@1.2.5: This is a stub types definition. csv-parse provides its own type definitions, so you do not need this installed.
npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version.
Affected dependencies
| Package |
Current |
Issue |
glob |
7.2.3 |
EOL, known security vulnerabilities. Should be updated to glob v10+ or replaced with fast-glob / Node.js fs.glob (Node 22+) |
inflight |
1.0.6 |
Memory leak, no longer maintained (transitive dep of old glob) |
@types/csv-parse |
1.2.5 |
Unnecessary — csv-parse ships its own types since v4 |
Impact
These warnings appear for every user who installs any package depending on datapackage. While they don't block functionality, they erode confidence in the package and may trigger automated security audit failures in CI pipelines (npm audit).
Suggested fix
- Remove
@types/csv-parse from dependencies
- Update
glob to v10+ (or replace with a modern alternative)
- Review and update other aging dependencies
Environment
- Node.js: v24.7.0
- npm: v11.x
datapackage: 1.1.10
Thank you for maintaining this library!
Related #122
Description
When installing
datapackage(v1.1.10), npm emits several deprecation warnings about transitive dependencies:Affected dependencies
globfast-glob/ Node.jsfs.glob(Node 22+)inflightglob)@types/csv-parsecsv-parseships its own types since v4Impact
These warnings appear for every user who installs any package depending on
datapackage. While they don't block functionality, they erode confidence in the package and may trigger automated security audit failures in CI pipelines (npm audit).Suggested fix
@types/csv-parsefrom dependenciesglobto v10+ (or replace with a modern alternative)Environment
datapackage: 1.1.10Thank you for maintaining this library!
Related #122