Page MenuHomePhabricator

npm warnings when installing Kartotherian dependencies
Closed, DeclinedPublic

Description

The dependencies set of maps/kartotherian could use some maintenance. Installing the dependencies emit a few warnings:

npm WARN deprecated tilelive-vector@3.9.4: This module is now under the @mapbox namespace: install @mapbox/tilelive-vector instead
npm WARN deprecated tilelive@5.12.3: This module has moved: please install @mapbox/tilelive instead
npm WARN deprecated makizushi@1.4.0: This module is now under the @mapbox namespace: install @mapbox/makizushi instead
npm WARN deprecated maki@0.5.0: maki is now namespaced, install @mapbox/maki instead
npm WARN deprecated blend@1.2.0: This module has moved: please install @mapbox/blend instead
npm WARN deprecated protozero@1.4.5: protozero should no longer be used via npm, install instead via https://github.com/mapbox/mason
npm WARN deprecated sphericalmercator@1.0.5: This module is now under the @mapbox namespace: install @mapbox/sphericalmercator instead
npm WARN deprecated geojson-mapnikify@0.7.2: This module is now under the @mapbox namespace: install @mapbox/geojson-mapnikify instead
npm WARN deprecated abaculus@2.0.3: This module is now under the @mapbox namespace: install @mapbox/abaculus instead
<build fail for me eventually>

With yarn:

mapnik > protozero@1.4.5: protozero should no longer be used via npm, install instead via https://github.com/mapbox/mason
tilelive@5.12.3: This module has moved: please install @mapbox/tilelive instead 
tilelive > queue-async@1.0.7: renamed to d3-queue
tilelive > sphericalmercator@1.0.5: This module is now under the @mapbox namespace: install @mapbox/sphericalmercator instead 
tilelive > progress-stream > through2 > xtend > object-keys@0.4.0: 
tilelive-bridge > sphericalmercator@1.0.5: This module is now under the @mapbox namespace: install @mapbox/sphericalmercator instead 
tilelive-vector@3.9.4: This module is now under the @mapbox namespace: install @mapbox/tilelive-vector instead 
tilelive-vector > tilelive@5.12.3: This module has moved: please install @mapbox/tilelive instead 
tilelive-vector > sphericalmercator@1.0.5: This module is now under the @mapbox namespace: install @mapbox/sphericalmercator instead 
tilelive-vector > request > tough-cookie@2.2.2: ReDoS vulnerability parsing Set-Cookie https://nodesecurity.io/advisories/130
tilelive-vector > request > node-uuid@1.4.8: Use uuid module instead 
tilelive-vector > tiletype@0.3.0: This module is now under the @mapbox namespace: install @mapbox/tiletype instead 
kartotherian-maki > makizushi@1.4.0: This module is now under the @mapbox namespace: install @mapbox/makizushi instead 
kartotherian-maki > makizushi > maki@0.5.0: maki is now namespaced, install @mapbox/maki instead 
kartotherian-maki > makizushi > blend@1.2.0: This module has moved: please install @mapbox/blend instead 
kartotherian-snapshot > sphericalmercator@1.0.5: This module is now under the @mapbox namespace: install @mapbox/sphericalmercator instead 
kartotherian-snapshot > abaculus@2.0.3: This module is now under the @mapbox namespace: install @mapbox/abaculus instead 
kartotherian-snapshot > geojson-mapnikify@0.7.2: This module is now under the @mapbox namespace: install @mapbox/geojson-mapnikify instead 
kartotherian-snapshot > geojson-mapnikify > makizushi@1.4.0: This module is now under the @mapbox namespace: install @mapbox/makizushi instead 
kartotherian-snapshot > geojson-mapnikify > request > node-uuid@1.4.8: Use uuid module instead 
kartotherian-snapshot > tilelive-overlay > sphericalmercator@1.0.5: This module is now under the @mapbox namespace: install @mapbox/sphericalmercator instead 
kartotherian-snapshot > tilelive-overlay > geojson-mapnikify@0.7.2: This module is now under the @mapbox namespace: install @mapbox/geojson-mapnikify instead 
kartotherian-snapshot > geojson-mapnikify > geojson-normalize@0.0.1: This module is now under the @mapbox namespace: install @mapbox/geojson-normalize instead 
kartotherian-snapshot > leaflet-headless > jsdom > content-type-parser@1.0.2: This package has been renamed whatwg-mimetype; please upgrade.
mocha > glob > minimatch@0.3.0: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
mocha > to-iso-string@0.0.2: to-iso-string has been deprecated, use @segment/to-iso-string instead.
mocha > jade@0.26.3: Jade has been renamed to pug, please install the latest version of pug instead of jade

Event Timeline

Oh yes, they could use some maintenance! Note that maps/tilerator is just as bad. Also note that changes happen upstream on github (http://github.com/kartotherian/), it might make sense to open issues there.

We are actually looking into doing some minor cleanup (T177021) to dependencies.

Eventually I found a few other issues such as T176168 T177249

I am trying to get a Docker container that runs npm install && npm test, with mixed success so far :]

I am trying to get a Docker container that runs npm install && npm test, with mixed success so far :]

If this is still relevant to you, I got that working in this commit

I don't remember if we decided we should do this task or not.

@Mooeypoo started working on this at https://github.com/kartotherian/kartotherian/pull/57

Is this PR a good start to resolve the deprecation warnings from our direct dependencies (not transient ones) or not?

Hey @SBisson, are you thinking we should do this now or not?

Hey @SBisson, are you thinking we should do this now or not?

After much thoughts and 2 attempts, I don't think we should do it. The risk is high, the effort is high, and the value is low.

Most of those warnings can't be fixed since they are coming from external dependencies. Those that can, are extremely risky since they can bring different versions of components that are incompatible with our stack. It happened here. Every change requires thorough functional testing and complete analysis of the dependency tree.

The intent being this task was to raise awareness about the huge number of warnings. I guess as Kartotherian is polished/maintained the various dependencies will eventually be bumped and the warning will disappear by themselves.

Thank you for the investigation :]