Please fix deprecated dependencies

[ilg-ul]

Installing a package which depends on pacote@11.3.1 triggers warnings:

ilg@wks ~ % npm install xpm@next
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142

These two deprecated dependencies are also used by tap:

ilg@wks ~ % npx npm-remote-ls pacote | grep har-validator
npx: installed 112 in 6.476s
   │  │     ├─ har-validator@5.1.5
ilg@wks ~ % npx npm-remote-ls pacote | grep request      
npx: installed 112 in 7.22s
   │  │  ├─ request@2.88.2
      │  ├─ request@2.88.2
ilg@wks ~ % 

Could you fix those dependencies?

BTW, I don't think that it is very useful for npm to complain about deprecated indirect dependencies, since there is not much the author of the top package can do to fix them.

[fgblomqvist]

See this issue: npm/run-script#25

[ilg-ul]

I see it, in the end it also depends on request, but apparently that is a different dependency path.

[ilg-ul]

And also:

ilg@wks ~ % npm install -g pacote
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142

added 157 packages, and audited 158 packages in 3s

4 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities
ilg@wks ~ % 

[bmarcotte]

Looks like a new major version of @npmcli/run-script, 2.0.0, was released today that updates their dependency on node-gyp to 8.x, which in turn, removes the dependency on request. I tried installing that into a clone of pacote, and it appears to work. After updating to it, the request, uuid, and har-validator packages only appear as children under tap, but since tap only appears as a devDependency here, picking up this new version of @npmcli/run-script should clean up the deprecation warnings for the downstream users of pacote.
Note: I did see 2 test failures in test/git.js (the git-clone tmp cache paths don't match the given regex), but those seem to be unrelated. I see the same failures even with the original version of @npmcli/run-script installed.

[ilg-ul]

BTW, the way I avoided the deprecation messages was to bundle the dependencies with my package, as npm does.