Fix npm deprecations.

[danez]

There are 5 deprecation notices in netlify-cli@15.0.3:

$ npm install netlify-cli@15.0.3 -g
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated string-similarity@4.0.4: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.

[MikeMcC399]

@danez

This issue is out of date as far as the latest release v15.8.0 is concerned. There are now 4 deprecation warnings instead of 6 lines of deprecation warnings shown in the original post.

$ npm install netlify-cli@latest
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated

The following no longer appear:

npm WARN deprecated string-similarity@4.0.4: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.

[MikeMcC399]

No change in the deprecations in netlify-cli@16.3.0 netlify-cli@17.10.1 compared to 15.8.0.

[kisaragi-hiu]

Of the four remaining deprecations, resolve-url@0.2.1, source-map-url@0.4.1, urix@0.1.0 are dependencies of source-map-resolve@0.5.3.

The dependency path to source-map-resolve@0.5.3 looks like:

source-map-resolve@0.5.3 ← snapdragon@0.8.2 ← (see note) ← micromatch@3.1.10 ← readdirp@2.2.1 ← copy-template-dir@1.4.0

No package/version in this list is depended on by anything else. This can be checked eg. on npmgraph: the 4 deprecated packages are around the top right corner. Click each package to trace its dependants or dependencies.

I have filed yoshuawuyts/copy-template-dir#17 to fix this by having it update to readdirp@3.

---

Note: snapdragon@0.8.2 is depended on by these packages, which all begin from micromatch@3.1.10:

• braces@2.3.2 ← micromatch@3.1.10
• micromatch@3.1.10
• extglob@2.0.4 ← micromatch@3.1.10
• expand-brackets@2.1.4 ← extglob@2.0.4 ← micromatch@3.1.10
• nanomatch@1.2.13 ← micromatch@3.1.100

[waynemaranga]

Almost five months later this is still an issue. I absolutely cannot install netlify-cli from npm:
When I try npm install netlify-cli@latest I get the following error:

npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated

added 1319 packages, and audited 1324 packages in 20s

1 moderate severity vulnerability

and running npm audit fix gives the vulnerability as

word-wrap  <1.2.4
Severity: moderate
word-wrap vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-j8xg-fqg3-53r7

[kisaragi-hiu]

word-wrap is not in the dependency tree of netlify-cli. Check your lock file or npm ls (or npm ls -g) for where it came from.

This issue is waiting for copy-template-dir to update its dependencies (namely readdirp). As I wrote above, I've filed a PR for that. (Reminder that copy-template-dir is an unpaid / volunteer / personal project.)

The deprecations are minor and do not affect security or usability, and can IMO only be an attack vector if you're providing netlify-cli as a service. While I agree it should be fixed (hence my PR here to replace string-similarity and to copy-template-dir to update readdirp), it ought not be a deal breaker for using the CLI.

[ben221199]

Why don't get rid on copy-template-dir? It hasn't been updated for over 6 years.