upgrade dependencies to reduce deprecation warnings #5043

ETLaurent · 2025-08-26T13:44:28Z

⚠️ Must merge these 2 PRs and release them first:

Summary

Following deprecation warnings fixed ✅ :

eslint (via eslint-config-apostrophe)
@humanwhocodes/object-schema
google-p12-pem (via uploadfs)

Couldn't fix these ❌ :

inflight: brought by glob via nyc at its most up to date version:

Note that upgrading mocha did reduce the usage of inflight because latest version is using glob 10.

─┬ nyc@17.1.0
  ├─┬ glob@7.2.3
  │ └── inflight@1.0.6
  ├─┬ rimraf@3.0.2
  │ └─┬ glob@7.2.3
  │   └── inflight@1.0.6 deduped
  └─┬ test-exclude@6.0.0
    └─┬ glob@7.2.3
      └── inflight@1.0.6 deduped

glob 7: still too widely used by other dependencies
rimraf 3: still used by nyc at its latest version
querystring: brought by aws-sdk at its most up to date version:

uploadfs@1.25.0
  └─┬ aws-sdk@2.1692.0
    ├── querystring@0.2.0
    └─┬ url@0.10.3
      └── querystring@0.2.0

before

npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated google-p12-pem@4.0.1: Package is no longer maintained
npm warn deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.
npm warn deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.

after

npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.

What are the specific steps to test this change?

For example:

Run the website and log in as an admin

Open a piece manager modal and select several pieces

Click the "Archive" button on the top left of the manager and confirm that it should proceed

Check that all pieces have been archived properly

What kind of change does this PR introduce?

(Check at least one)

Make sure the PR fulfills these requirements:

It includes a) the existing issue ID being resolved, b) a convincing reason for adding this feature, or c) a clear description of the bug it resolves
The changelog is updated
Related documentation has been updated
Related tests have been updated

If adding a new feature without an already open issue, it's best to open a feature request issue first and wait for approval before working on it.

Other information:

linear · 2025-08-26T13:44:32Z

PRO-8109 As a new A4 developer I should not see deprecation warnings when I install

ETLaurent · 2025-08-27T15:25:37Z

package.json

    "form-data": "^4.0.4",
-    "mocha": "^10.7.3",
-    "nyc": "^15.1.0",
-    "replace-in-file": "^6.1.0",


wasn't used

ETLaurent · 2025-08-27T15:26:03Z

package.json

@@ -132,15 +132,15 @@
    "xregexp": "^2.0.0"
  },
  "devDependencies": {
-    "eslint-config-apostrophe": "^5.0.0",
+    "eslint": "^9.34.0",
+    "eslint-config-apostrophe": "github:apostrophecms/eslint-config-apostrophe#pro-8109-upgrade-dependencies",


TODO: use version 6 when apostrophecms/eslint-config-apostrophe#22 is merged

This sounds accurate.

ETLaurent · 2025-08-27T16:11:32Z

package.json

@@ -121,7 +121,7 @@
    "tiny-emitter": "^2.1.0",
    "tough-cookie": "^4.0.0",
    "underscore.string": "^3.3.4",
-    "uploadfs": "^1.24.3",
+    "uploadfs": "github:apostrophecms/uploadfs#pro-8109-upgrade-dependencies",


TODO: use version 6 when apostrophecms/uploadfs#103 is merged

I think you meant to say we can go back to depending on npm after uploadfs is published. And that it will use gcs 7, not 6.

Flagging we have to do this before publishing.

exactly, sorry,

TODO: use version 1.25.1*

ETLaurent · 2025-08-27T16:30:10Z

scripts/great-renaming.js

Unused file that included replace-in-file dependency, which was not used either in this file

ETLaurent · 2025-08-27T16:38:32Z

eslint.config.js

+  globalIgnores([
+    '**/vendor/**/*.js',
+    '**/blueimp/**/*.js',
+    '**/node_modules',
+    'test/public',
+    'test/apos-build',
+    'coverage'
+  ]),


This is the way to ignore files now... https://eslint.org/docs/latest/use/configure/ignore

Ok, but why having it at project level and not in the global config?
My take is that we shouldn't introduce project level configuration. We already spent time refactoring this and it might make future migration to monorepos easier.

I only moved these from the deleted .gitignore file: https://github.com/apostrophecms/apostrophe/pull/5043/files#diff-a0fdacd2ade87c5238dde44378f574f7e123e669acdf8b740878b14b33b20275

I suggest we'll do this work in a separate PRs in order to scope that

and these are slightly different from the ones in tested

and starterkit

I have added data and apos-build to the globalIgnore in eslint-config-apostrophe

👉 https://github.com/apostrophecms/eslint-config-apostrophe/pull/22/files#diff-a32a0887ed9d1d707bbb3b845b7df7fd40e673c47e7b60a3ebd896b68d3b8839R7-R12

ValJed

Should not have removed rules like max-len.

ValJed · 2025-08-29T07:53:10Z

eslint.config.js

+  globalIgnores([
+    '**/vendor/**/*.js',
+    '**/blueimp/**/*.js',
+    '**/node_modules',
+    'test/public',
+    'test/apos-build',
+    'coverage'
+  ]),


Ok, but why having it at project level and not in the global config?
My take is that we shouldn't introduce project level configuration. We already spent time refactoring this and it might make future migration to monorepos easier.

ValJed

See comments above.

Missing rules
Specific config (everything should be in global).

…109-upgrade-dependencies

upgrade mocha

302bfe4

Etienne Laurent added 8 commits August 26, 2025 15:55

remove replace-in-file

cd60654

upgrade nyc

7942848

print coverage rather than outputting it to a file that we don't read

b2cbb5b

upgrade eslint-config-apostrophe

c29c6d2

use new eslint config file format

674ac7b

fix eslint-config-apostrophe extend

23d30c4

fix eslint in config file

a9711a3

adapt

b8108b9

ETLaurent mentioned this pull request Aug 27, 2025

migrate to eslint 9 and neostandard apostrophecms/eslint-config-apostrophe#22

Open

10 tasks

remove eslint

aa3e091