Repository navigation
@mapbox/node-pre-gyp@1.0.11 causes lots of deprecated warnings. #431
Description
npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated npmlog@5.0.1: This package is no longer supported.
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated are-we-there-yet@2.0.0: This package is no longer supported.
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated gauge@3.0.2: This package is no longer supported.
Activity
nassero commentedon Feb 9, 2026
bumping this. @mapbox/node-pre-gyp < 2.0 now has the following three CVEs due to its usage of an older version of node-tar:
CVE-2026-23950
CVE-2026-24842
CVE-2026-23745
any chance this can get updated?
Fix security vulnerabilities in dev dependencies (#431)
Fix issue #431: node-pre-gyp deprecation and CI failures
andyedwardsibm commentedon Mar 27, 2026
Add CVE-2026-26960 to the ever-expanding list of node-tar vulnerabilities. Looks like #462 has fixed it, so is there a timeframe for publishing version 1.17.0?
andyedwardsibm commentedon Apr 13, 2026
https://github.com/apache/pulsar-client-node/releases/tag/v1.17.0 was released 4 days ago
Is there a reason that there's absolute silence on issues relating to security like this one?