From 7e4e3fc440e926c6e425a6b178793ce1e3e02d2b Mon Sep 17 00:00:00 2001 From: Anuj Vishwakarma <298213938+AnujVishwakarma-src@users.noreply.github.com> Date: Mon, 7 Sep 2026 16:31:57 +0530 Subject: [PATCH] fix: bump archiver ^5->^7 and unzipper ^0.10->^0.12 to drop deprecated transitive deps (APPBLD-4609) archiver@5 pulls archiver-utils@2/3 -> glob@7 -> inflight@1.0.6 (deprecated, leaks memory); archiver@7 drops that chain (archiver@8 is ESM-only, so 7 is the CJS ceiling). unzipper@0.10 pulls fstream@1.0.12 (unsupported) -> rimraf@2.7.1 (deprecated); unzipper@0.12 removes both. Clean npm install deprecation warnings: 18 -> 16 (fstream@1.0.12 and rimraf@2.7.1 eliminated). Residual glob/inflight warnings are co-driven by other chains (transitive archiver@6 from @adobe/aio-lib-runtime, yeoman-generator@5, jest) and are addressed by their own tickets. Validation: unit tests introduce no new failures; lint clean; un-mocked round-trip smoke of the real pack.js (archiver) and install.js (unzipper Parse + Open.file/extract) code paths passes. Co-Authored-By: Claude Opus 4.8 (1M context) --- package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index 899db08c..772ad863 100644 --- a/package.json +++ b/package.json @@ -25,7 +25,7 @@ "@parcel/reporter-cli": "^2.7.0", "ajv": "^8", "ajv-formats": "^2.1.1", - "archiver": "^5.3.1", + "archiver": "^7.0.1", "chalk": "^4", "chokidar": "^3.5.2", "execa": "^5.0.0", @@ -43,7 +43,7 @@ "pure-http": "^3", "serve-static": "^1.14.1", "term-size": "^2.2.1", - "unzipper": "^0.10.11", + "unzipper": "^0.12.5", "upath": "^2", "which": "^4.0.0", "yeoman-environment": "^4.4.3"