Deprecated packages during npm installation

[TWiStErRob]

What would you like help with?

I think I found a bug

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

none

Please tell us more about your question or problem

I'm using the npm renovate package for the validator, and I noticed some major version deprecations in the logs. I'm not entirely sure where these are coming from as the main renovate package.json contains newer versions. Actually from package-lock.json:

• Renovate
  • bunyan@1.8.15 <-- last release 3 years ago, last commit 2 years ago, 62 open PRs
    • mv@~2 -> 2.1.1 <-- last release 9 years ago
      • rimraf@~2.4.0 -> 2.4.5 <-- deprecated
        • glob@^6.0.1 -> 6.0.4 <-- deprecated
          • inflight@^1.0.4 -> 1.0.6 <-- deprecated

Looks like someone also found the same issue few days ago: trentm/node-bunyan#719

I think there might be two actions here:

1. Apply workaround (if possible)
2. Replace bunyan with something maintained. (older than 3 years, but regressed: https://trentm.com/2016/01/node-bunyan-maintenance.html)

Unrelated, but very relevant: #5098 (comment)

Logs (if relevant)

$ npm install renovate@37.377.6

npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated rimraf@2.4.5: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated glob@6.0.4: Glob versions prior to v9 are no longer supported

[rarkins]

How is this a bug?

[TWiStErRob]

Unexpected behavior. Deprecated warnings show, they shouldn't. Scary logs of potential security issues, memory leaks, etc. Looks like there's something very likely broken, but hard to prove either way, i.e. probably should be fixed at the origin. Since the origin is unmaintained, the user of the origin is the one who can action.

Feel free to move it as an "idea" if that tickles your fancy.

[TWiStErRob]

Any thoughts on the actual issue?

[rarkins]

Per bunyan, mv is only used for RotatingFileStream, which Renovate does not utilize. I looked at the source code and that seems correct. Therefore it seems like stubbing out mv should be fine to suppress warnings. It's definitely not worth our time to swap out a logging library unless there's an actual problem, and I disagree with both these claims:

• "there's something very likely broken"
• "hard to prove either way"

[TWiStErRob]

I disagree with both these claims:

• "there's something very likely broken"
• "hard to prove either way"

You might've skimmed over the key words there: Looks like

I meant that as an end-user of Renovate, not as an npm/js-expert/contributor/maintainer. When Dev Joe does an npm install -g renovate, all they see is these deprecation warnings. They obviously shouldn't worry (which we now know after ~1-2 hours of total investigation time), but the only way this is communicable to end users is actually hiding the warnings. (Alert fatigue and inattentional blindness comes to mind.)

... and as I write that I realize what you mean by not a bug. It's a DX improvement at best.

A personal note: my focus is on supporting and building Java/Kotlin libs and apps, so Renovate is "just a great tool we use", and from that perspective: understanding the security red flags in Renovate by the intricacies of reading Bunyan source code is a rabbit hole too deep :) This is why I reported here.

I agree on not worth replacing a lib right now.

I tried doing the stubbing, but it didn't have an effect 😕. I could be missing something trivial-ish.

My try

docker build -f .devcontainer/Dockerfile -t renovatebot_local .
docker run -it --rm -v "P:\projects\contrib\github-renovate:/usr/src/app" -w /usr/src/app renovatebot_local sudo ...
# where ... was
pnpm install
pnpm build
pnpm pack

then to test installation of it:

mkdir xxx
cd xxx
echo "{}" > package.json
npm install file:/./../renovate-0.0.0-semantic-release.tgz 

patched package.json, then cleaned up node_modules, etc, and rerun the whole flow.