Why does npm(and programs in general) have deprecate issue even when installed from official website?

user_4972737 0
Viewed 177

I downloaded nodejs from its official website, and npm with it.

When I tried to run Gatsby:

npm install --save gatsby

npm WARN deprecated core-js@2.6.11: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.
npm WARN deprecated chokidar@2.1.8: Chokidar 2 will break on node v14+. Upgrade to chokidar 3 with 15x less dependencies.

...and so on

I can reinstall them one by one. But it makes me wonder why official website installation gives deprecated warnings. Is there something I'm missing?

npm gatsby node.js
1 Answers

Is there something I'm missing?

Let me turn the question around: can you 100% guarantee that for every project you have ever published, every dependency of your project is up-to-date, every dependency of every dependency of your project is up-to-date, every dependency of every dependency of every dependency of every project is up-to-date, and so on, and so forth?

I know I can't! In fact, I know that some of my projects have dependencies that in turn have dependencies that are no longer maintained. The problem is simply that I do those projects in my free time and re-designing the project to use a different dependency would take too much time that I don't have. I even know that some of my projects have dependencies that have unfixed security holes! But, the version which fixes that security hole has a backwards-incompatible API change, and I simply don't have the time to do the necessary re-write.

Remember that most of those projects are open source community projects, so, as a member of the community, it is in some sense even your job to fix those issues.

Gatsby has 85 direct dependencies. The transitive closure of dependencies, i.e. the set of Gatsby's dependencies, the dependencies of those dependencies, the dependencies of the dependencies of those dependencies, and so on, is 787 packages. Now, isn't it possible that the developers of Gatsby simply don't have time to constantly track every single one of those 787 packages to make sure that every single one is up-to-date?

user_29880
Related