High number of deprecations / vulnerabilities for devDependencies

[MikeMcC399]

Issue

Cloning and installing dependencies results in a high number of deprecation warnings and vulnerability warnings

146 vulnerabilities (5 low, 34 moderate, 81 high, 26 critical)

These deprecation warnings do not affect the regular use of the published npm package start-server-and-test as an npm package. (For instance npm install start-server-and-test currently results in no deprecation warnings.) They are only relevant for development and CI testing.

Steps to reproduce

Ubuntu 24.04.1 LTS, Node.js 22.11.0 LTS

git clone https://github.com/bahmutov/start-server-and-test
cd start-server-and-test
npm ci

Logs

$ npm ci
npm warn deprecated [email protected]: Critical bug fixed in v3.0.1, please upgrade to the latest version.
npm warn deprecated [email protected]: Critical bug fixed in v2.0.1, please upgrade to the latest version.
npm warn deprecated [email protected]: Please update to ini >=1.3.6 to avoid a prototype pollution issue
npm warn deprecated [email protected]: Critical bug fixed in v3.0.1, please upgrade to the latest version.
npm warn deprecated [email protected]: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm warn deprecated [email protected]: Please see https://github.com/lydell/urix#deprecated
npm warn deprecated [email protected]: This module moved to @hapi/sntp. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues.
npm warn deprecated [email protected]: Please update to the latest object-keys
npm warn deprecated [email protected]: this library is no longer supported
npm warn deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm warn deprecated [email protected]: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm warn deprecated [email protected]: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm warn deprecated [email protected]: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm warn deprecated [email protected]: Fixed a prototype pollution security issue in 4.1.0, please upgrade to ^4.1.1 or ^5.0.1.
npm warn deprecated [email protected]: https://github.com/lydell/resolve-url#deprecated
npm warn deprecated [email protected]: This is probably built in to whatever tool you're using. If you still need it... idk
npm warn deprecated [email protected]: please upgrade to graceful-fs 4 for compatibility with current and future versions of Node.js
npm warn deprecated [email protected]: Check out CommitLint which provides the same functionality with a more user-focused experience.
npm warn deprecated [email protected]: See https://github.com/lydell/source-map-url#deprecated
npm warn deprecated [email protected]: CircularJSON is in maintenance only, flatted is its successor.
npm warn deprecated [email protected]: Thank you for using prettier-standard, you are awesome :-) A new version is available with features like built-in linting, formatting staged files, changed files, changed lines and more, please upgrade! You might also like https://github.com/sheerun/modern-node for all-in-one development toolkit that incorporates prettier-standard and Jest. Please tweet if you like it :-)
npm warn deprecated [email protected]: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797)
npm warn deprecated [email protected]: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797)
npm warn deprecated [email protected]: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797)
npm warn deprecated [email protected]: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797)
npm warn deprecated [email protected]: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797)
npm warn deprecated [email protected]: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797)
npm warn deprecated [email protected]: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797)
npm warn deprecated [email protected]: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797)
npm warn deprecated [email protected]: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797)
npm warn deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm warn deprecated [email protected]: This module moved to @hapi/hawk. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues.
npm warn deprecated [email protected]: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm warn deprecated [email protected]: babel-eslint is now @babel/eslint-parser. This package will no longer receive updates.
npm warn deprecated [email protected]: See https://github.com/lydell/source-map-resolve#deprecated
npm warn deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm warn deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm warn deprecated [email protected]: request has been deprecated, see https://github.com/request/request/issues/3142
npm warn deprecated [email protected]: This functionality has been moved to @npmcli/fs
npm warn deprecated [email protected]: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm warn deprecated [email protected]: core-js-pure@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js-pure.

added 1667 packages, and audited 2102 packages in 1m

81 packages are looking for funding
  run `npm fund` for details

146 vulnerabilities (5 low, 34 moderate, 81 high, 26 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.

[BePo65]

They are only relevant for development and CI testing

The question is, if devDependencies can do any harm in "production" releases. Personally I follow the concept of avoiding everything that can be "easily" avoided, because someone out there is for sure clever enough to exploit such vulnerabilities. What could happen is for example written down in a StackExchange question. But this is only my personal position.

Of course vulnerability warnings are just 'hints' from npm audit and not the same as deprecation warnings, where the owner of a package send us a kind of "please migrate to another package" message.

[BePo65]

@MikeMcC399 I do not want to give the wrong impression: it is not my intention to criticize every argument that differs from my personal opinion 😄.

Even if it looks different, I like hearing arguments from other developers. I do know that others can be right too :-).

Of course I could also live with vulnerabilities in devDependencies.

[MikeMcC399]

@BePo65

I think there is some misunderstanding. My wish / request is that there are no deprecations or vulnerabilities reported when cloning the repository and installing dependencies. That was the intention of posting this issue.

I did not however look at the feasibility of achieving this goal.