80% of deprecations in console are due to react-scripts #9431

genefedorchenko · 2020-08-06T00:54:25Z

Describe the bug

npm i react-scripts@3.3.1
npm WARN deprecated fsevents@1.2.13: fsevents 1 will break on node v14+ and could be using insecure binaries. Upgrade to fsevents 2.
npm WARN deprecated left-pad@1.3.0: use String.prototype.padStart()
npm WARN deprecated request@2.88.2: request has been deprecated, see request/request#3142
npm WARN deprecated request-promise-native@1.0.9: request-promise-native has been deprecated because it extends the now deprecated request package, see request/request#3142
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated core-js@2.6.11: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.

Did you try recovering your dependencies?

Yes

Which terms did you search for in User Guide?

deprecated

Environment

$ npx create-react-app --info
npx: установлен 98 в 18.49s

Environment Info:

current version of create-react-app: 3.4.1
running from C:\Users\User\AppData\Roaming\npm-cache_npx\17536\node_modules\create-react-app

System:
OS: Windows 10 10.0.18363
CPU: (8) x64 Intel(R) Core(TM) i7-4700HQ CPU @ 2.40GHz
Binaries:
Node: 14.4.0 - C:\nodejs\node.EXE
Yarn: Not Found
npm: 6.14.5 - C:\nodejs\npm.CMD
Browsers:
Edge: 44.18362.449.0
Internet Explorer: 11.0.18362.1
npmPackages:
react: Not Found
react-dom: Not Found
react-scripts: ^3.3.1 => 3.3.1
npmGlobalPackages:
create-react-app: Not Found

Steps to reproduce

run npm i react-scripts@3.3.1
2.enjoy the deprecation messages
npm WARN deprecated fsevents@1.2.13: fsevents 1 will break on node v14+ and could be using insecure binaries. Upgrade to fsevents 2.
npm WARN deprecated left-pad@1.3.0: use String.prototype.padStart()
npm WARN deprecated request@2.88.2: request has been deprecated, see Request’s Past, Present and Future request/request#3142
npm WARN deprecated request-promise-native@1.0.9: request-promise-native has been deprecated because it extends the now deprecated request package, see Request’s Past, Present and Future request/request#3142
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated core-js@2.6.11: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.

Expected behavior

No deprecation messages

Actual behavior

npm WARN deprecated fsevents@1.2.13: fsevents 1 will break on node v14+ and could be using insecure binaries. Upgrade to fsevents 2.
npm WARN deprecated left-pad@1.3.0: use String.prototype.padStart()
npm WARN deprecated request@2.88.2: request has been deprecated, see request/request#3142
npm WARN deprecated request-promise-native@1.0.9: request-promise-native has been deprecated because it extends the now deprecated request package, see request/request#3142
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated core-js@2.6.11: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.

Reproducible demo

(Paste the link to an example project and exact instructions to reproduce the issue.)

eddiemonge · 2020-08-06T18:51:41Z

this will be fixed in the next release. To test it out https://gist.github.com/iansu/282dbe3d722bd7231fa3224c0f403fa1

doc-duncan · 2020-08-13T20:53:37Z

Hello! I have the same issue with deprecated dependencies and unfortunately switching to the new version did not correct the problem for me.

I changed my package.json reference "react-scripts": "next" and installed the new version.

I still received the following deprecation warnings:

npm WARN deprecated @hapi/joi@15.1.1: joi is leaving the @hapi organization and moving back to 'joi' (https://github.com/sideway/joi/issues/2411)
npm WARN deprecated rollup-plugin-babel@4.4.0: This package has been deprecated and is no longer maintained. Please use @rollup/plugin-babel.
npm WARN deprecated fsevents@1.2.13: fsevents 1 will break on node v14+ and could be using insecure binaries. Upgrade to fsevents 2.
npm WARN deprecated @hapi/address@2.1.4: This version has been deprecated and is no longer supported or maintained
npm WARN deprecated @hapi/topo@3.1.6: This version has been deprecated and is no longer supported or maintained
npm WARN deprecated @hapi/hoek@8.5.1: This version has been deprecated and is no longer supported or maintained
npm WARN deprecated @hapi/bourne@1.3.2: This version has been deprecated and is no longer supported or maintained
npm WARN deprecated request-promise-native@1.0.9: request-promise-native has been deprecated because it extends the now deprecated request package, see https://github.com/request/request/issues/3142
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated core-js@2.6.11: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported

I ran npm ls <dependency-name@ver> on each of these dependencies and each traced back to react-scripts:

-- react-scripts@4.0.0-next.77
  `-- workbox-webpack-plugin@5.1.3
    `-- workbox-build@5.1.3
      `-- strip-comments@1.0.2
        `-- babel-plugin-transform-object-rest-spread@6.26.0
          `-- babel-runtime@6.26.0
            `-- core-js@2.6.11`
 
`-- react-scripts@4.0.0-next.77
  `-- jest@26.1.0
    `-- @jest/core@26.4.0
      `-- jest-config@26.4.0
        `-- jest-environment-jsdom@26.3.0
          `-- jsdom@16.4.0
            `-- request@2.88.2`

`-- react-scripts@4.0.0-next.77
  `-- jest@26.1.0
    `-- @jest/core@26.4.0
      `-- jest-config@26.4.0
        `-- jest-environment-jsdom@26.3.0
          `-- jsdom@16.4.0
            `-- request-promise-native@1.0.9`

`-- react-scripts@4.0.0-next.77
  `-- workbox-webpack-plugin@5.1.3
    `-- workbox-build@5.1.3
      `-- @hapi/joi@15.1.1`

...

I'm sure I must be missing something on my end, I apologize for the trouble. Thanks so much!

ankon · 2020-08-21T13:43:00Z

Is there anything we can do to help? Having this many deprecation warnings scares me a bit to be honest.

stale · 2020-09-20T13:56:21Z

This issue has been automatically marked as stale because it has not had any recent activity. It will be closed in 5 days if no further activity occurs.

ankon · 2020-09-21T08:43:16Z

Indeed, there's not much activity -- but the issue still persists.

seamuslowry · 2020-09-26T03:19:14Z

Yeah, I'm seeing the same thing on 'next'

Pomax · 2020-10-12T14:45:52Z

@gaearon any idea who currently "owns" this repo? It'd be good to get the deps updated and pushed as patch release, even if no code changes get pushed.

gaearon · 2020-10-12T16:26:56Z

All of these would eventually resolve themselves as underlying packages are updated. I don't see an action item here. The messages showing up are unfortunate but there is no actual way it would impact your app or environment as far as I can tell.

Pomax · 2020-10-12T16:55:05Z

While true, create-react-app is so ubiquitous that someone like you asking the folks who run the projects that create-react-app depends on to bump their versions to no longer yield deprecation errors would absolutely have a stronger effect than anyone else asking them to update ever could. Not having new users to react get a full screen of deprecation warnings when they follow the official "let's set up your first react application" steps sounds pretty worth it =)

gaearon · 2020-10-12T17:18:31Z

I fully agree with you it's nice to have (and we actually worked with underlying packages in the past to get issues like this fixed) but I don't think this is a priority right now when there are bigger issues (such as to get 4.0 out).

doc-duncan · 2020-10-12T19:18:18Z

To provide some tracking of each warning for myself and others:

The request-promise-native and request warnings are coming from jsdom and the fix remains open: Replace request with something better jsdom/jsdom#2792
har-validator warning is coming from request and will remain an issue until jsdom replaces it
The @hapi/joi warnings are coming from workbox, which appears to be sticking with @hapi/joi to maintain support for node v10.x: Migrate from deprecated @hapi/joi to joi GoogleChrome/workbox#2609
All other warnings starting with @hapi are dependencies of @hapi/joi and will therefore remain until workbox upgrades to joi
One that may be in react-scripts control is the left-pad warning which was to be fixed in jest 25, which I believe was fixed in this pr: chore: bump most dated deps jestjs/jest#8850
core-js warning coming from babel-runtime because of strip-comments (referenced here as well) but this issue/pr should remediate that warning

ankon · 2020-10-12T22:28:28Z

Thanks -- the tracking/explanations definitely help.

However, I fear having these deprecations produce warnings that are now "ok" will lead to some form of "warning fatique", and so one might end up ignoring all of them because "probably that's just react-scripts anyways" (as unfair as that might sound, given above explanation that react-scripts isn't really the evil guy here).

I suspect there's not much that can be done here though, and the problem might be more in the way these deprecations get aggregated upwards by npm.

Maybe react-scripts could log something to point to a place that has these explanations?

genefedorchenko · 2020-10-13T21:43:24Z

Accuracy and elegance of React can be reduced to nothing with such littering tools like react-scripts. If perfectionists would leave React, where they would go?
Eject and Tree-shake on you!!! :)

stale · 2020-12-25T19:10:44Z

This issue has been automatically marked as stale because it has not had any recent activity. It will be closed in 5 days if no further activity occurs.

cseas · 2020-12-25T22:13:51Z

Not stale, I believe this is just not priority right now

digimbyte · 2020-12-29T00:40:35Z

following Ionic react with the gallery example leads to this, causes hang on core-js@2.6.12
https://ionicframework.com/docs/react/your-first-app

Pomax · 2020-12-29T16:34:49Z

Deprecation warnings don't cause things to hang, they are versioning notices during install. Please file a new issue instead if you're certainly it's caused by create-react-app, but it's almost certainly something you'll want to start on the ionic-framework repo for: https://github.com/ionic-team/ionic-framework/issues

Martinsos · 2021-02-09T21:22:10Z

In our case, we are using CRA underneath our language/framework, and these deprecation messages are prominent in the logs, some of them looking really scary, e.g.:

deprecated fsevents@1.2.13: fsevents 1 will break on node v14+ and could be using insecure binaries. Upgrade to fsevents 2.

npm WARN deprecated core-js@2.6.12: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.

I understand from above that these messages are coming from the packages CRA uses and therefore you can't fix them directly, but I am wondering what is the general strategy for avoiding getting into situations like this? Is it really applying pressure to the mentioned packages as somebody above mentioned? Or fixing problems ourselves? I would be happy to try and take on one or two of these problems if they are of reasonable scope, if some guidance would be provided -> maybe issue could be created for each problem and progress could be tracked there?

At the moment of writing, I found following packages that are used in CRA (at some level) to produce deprecation messages:

- rollup-plugin-backend
- fsevents
- request-promise-native
- request
- core-js
- har-validator
- sass-loader
- tsutils

dohnuts · 2021-05-06T13:08:55Z

this will be fixed in the next release. To test it out https://gist.github.com/iansu/282dbe3d722bd7231fa3224c0f403fa1

Using react "react-scripts": "4.0.3" , and still massive amount of deprecation warning.

arkapratimsarkar · 2021-05-06T13:46:27Z

this will be fixed in the next release. To test it out https://gist.github.com/iansu/282dbe3d722bd7231fa3224c0f403fa1

Using react "react-scripts": "4.0.3" , and still massive amount of deprecation warning.

same for me too. here - #10927

archit-p · 2021-05-18T16:49:42Z

I'm on "react-scripts": "latest", and getting the following deprecation warnings:

genefedorchenko · 2021-05-18T17:24:55Z

I'm on "react-scripts": "latest", and getting the following deprecation warnings:

There is nothing more stable than react-scripts deprecation...

arkapratimsarkar · 2021-05-26T16:58:35Z

I'm on "react-scripts": "latest", and getting the following deprecation warnings:

There is nothing more stable than react-scripts deprecation...

Amen to that 👍

arctic-apricity · 2021-05-28T02:01:54Z

no other package I'm using even has a single warning 🙄

iansu · 2021-06-02T17:30:20Z

These are not direct dependencies of Create React App so we don't have direct control over the versions. We always update all our dependencies with each new release so eventually these should go away.

snwfdhmp · 2021-08-30T15:31:39Z

I'm having two security vulnerabilities due to react-scripts not being updated for 6 months. What is going on ? Is this project dead ?

cseas · 2021-08-31T05:34:17Z

It's not dead but create-react-app has always been a community maintained initiative aimed at making it easy for beginners to get started. If security vulnerabilities or a robust production-ready setup are a concern then you might be better off setting up your own webpack config or using a framework that's built for production use like Next.js.

The React docs really don't do a great job at making it clear that create-react-app doesn't guarantee anything if you decide to use it in production. It's under the facebook org, but is completely maintained by community volunteers.

snwfdhmp · 2021-08-31T09:35:55Z

@cseas Thanks for the explanation.

How can I contribute to update these packages ? Besides contributing guidelines, how can I make sure that updating one dependency won't break anything for the thousands of users of create-react-app ?

cseas · 2021-08-31T09:49:04Z

I'm not sure.
~~gaearon~~, @iansu
How can the community help to clean up some of these deprecations?

astik · 2021-08-31T10:26:13Z

No need to call for Gaearon, he already made his point very clear on his blog: https://overreacted.io/npm-audit-broken-by-design/.
Still, if you find, and i quote, "a real vulnerability that can affect the project", feel free to open a new issue.

genefedorchenko added issue: bug report needs triage labels Aug 6, 2020

ankon mentioned this issue Sep 11, 2020

Deprecations during react-scripts install #9606

Closed

stale bot added the stale label Sep 20, 2020

stale bot removed the stale label Sep 21, 2020

This was referenced Oct 12, 2020

npm WARN deprecated core-js@2.6.11 #9270

Closed

react script deprecated dependencies #8914

Open

stale bot added the stale label Dec 25, 2020

stale bot removed the stale label Dec 25, 2020

Martinsos mentioned this issue Feb 9, 2021

Lot of deprecation warnings coming from generated web app code due to CRA wasp-lang/wasp#181

Closed

This was referenced Mar 30, 2021

[Snyk] Fix for 1 vulnerabilities drich7449/create-react-app#27

Open

[Snyk] Fix for 1 vulnerabilities math4youbyusgroupillinois/create-react-app#32

Open

snyk-bot mentioned this issue Mar 31, 2021

[Snyk] Fix for 1 vulnerabilities sirinartk/create-react-app#22

Closed

iansu closed this as completed Jun 2, 2021

chaoming mentioned this issue Jun 22, 2021

core-js@<3.3 is no longer maintained and not recommended for usage fireactjs/saas#20

Closed

mbarton mentioned this issue Sep 22, 2021

Frontend library bumps christchurchlondon/foodbank-southlondon#95

Merged

will-molloy mentioned this issue Apr 21, 2024

Update all dependencies will-molloy/react-template#248

Open

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

80% of deprecations in console are due to react-scripts #9431

80% of deprecations in console are due to react-scripts #9431

genefedorchenko commented Aug 6, 2020

eddiemonge commented Aug 6, 2020

doc-duncan commented Aug 13, 2020 •

edited

Loading

ankon commented Aug 21, 2020

stale bot commented Sep 20, 2020

ankon commented Sep 21, 2020

seamuslowry commented Sep 26, 2020

Pomax commented Oct 12, 2020 •

edited

Loading

gaearon commented Oct 12, 2020

Pomax commented Oct 12, 2020 •

edited

Loading

gaearon commented Oct 12, 2020

doc-duncan commented Oct 12, 2020 •

edited

Loading

ankon commented Oct 12, 2020

genefedorchenko commented Oct 13, 2020

stale bot commented Dec 25, 2020

cseas commented Dec 25, 2020

digimbyte commented Dec 29, 2020

Pomax commented Dec 29, 2020 •

edited

Loading

Martinsos commented Feb 9, 2021 •

edited

Loading

dohnuts commented May 6, 2021

arkapratimsarkar commented May 6, 2021 •

edited

Loading

archit-p commented May 18, 2021

genefedorchenko commented May 18, 2021

arkapratimsarkar commented May 26, 2021

arctic-apricity commented May 28, 2021 •

edited

Loading

iansu commented Jun 2, 2021

snwfdhmp commented Aug 30, 2021

cseas commented Aug 31, 2021 •

edited

Loading

snwfdhmp commented Aug 31, 2021

cseas commented Aug 31, 2021 •

edited

Loading

astik commented Aug 31, 2021

80% of deprecations in console are due to react-scripts #9431

80% of deprecations in console are due to react-scripts #9431

Comments

genefedorchenko commented Aug 6, 2020

Describe the bug

Did you try recovering your dependencies?

Which terms did you search for in User Guide?

Environment

Steps to reproduce

Expected behavior

Actual behavior

Reproducible demo

eddiemonge commented Aug 6, 2020

doc-duncan commented Aug 13, 2020 • edited Loading

ankon commented Aug 21, 2020

stale bot commented Sep 20, 2020

ankon commented Sep 21, 2020

seamuslowry commented Sep 26, 2020

Pomax commented Oct 12, 2020 • edited Loading

gaearon commented Oct 12, 2020

Pomax commented Oct 12, 2020 • edited Loading

gaearon commented Oct 12, 2020

doc-duncan commented Oct 12, 2020 • edited Loading

ankon commented Oct 12, 2020

genefedorchenko commented Oct 13, 2020

stale bot commented Dec 25, 2020

cseas commented Dec 25, 2020

digimbyte commented Dec 29, 2020

Pomax commented Dec 29, 2020 • edited Loading

Martinsos commented Feb 9, 2021 • edited Loading

dohnuts commented May 6, 2021

arkapratimsarkar commented May 6, 2021 • edited Loading

archit-p commented May 18, 2021

genefedorchenko commented May 18, 2021

arkapratimsarkar commented May 26, 2021

arctic-apricity commented May 28, 2021 • edited Loading

iansu commented Jun 2, 2021

snwfdhmp commented Aug 30, 2021

cseas commented Aug 31, 2021 • edited Loading

snwfdhmp commented Aug 31, 2021

cseas commented Aug 31, 2021 • edited Loading

astik commented Aug 31, 2021

doc-duncan commented Aug 13, 2020 •

edited

Loading

Pomax commented Oct 12, 2020 •

edited

Loading

Pomax commented Oct 12, 2020 •

edited

Loading

doc-duncan commented Oct 12, 2020 •

edited

Loading

Pomax commented Dec 29, 2020 •

edited

Loading

Martinsos commented Feb 9, 2021 •

edited

Loading

arkapratimsarkar commented May 6, 2021 •

edited

Loading

arctic-apricity commented May 28, 2021 •

edited

Loading

cseas commented Aug 31, 2021 •

edited

Loading

cseas commented Aug 31, 2021 •

edited

Loading