Deprecated inflight dependency

[MaxioTech]

Describe the bug

Today when I was setting up a new project, I got the following message when installing dependencies:

"npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful."

Reproduction

npm create vite@latest

Steps to reproduce

Run 'npm install'

System Info

System:
    OS: Windows 10 10.0.19045
    CPU: (4) x64 Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz
    Memory: 21.63 GB / 31.94 GB
Binaries:
   Node: 20.9.0 - C:\Program Files\nodejs\node.EXE
   npm: 10.5.1 - C:\Program Files\nodejs\npm.CMD
Browsers:
   Edge: Spartan (44.19041.3636.0), Chromium (123.0.2420.97)
   Internet Explorer: 11.0.19041.3636
npmPackages:
   @vitejs/plugin-react-swc: ^3.5.0 => 3.7.0
   vite: ^5.2.0 => 5.2.11

Used Package Manager

npm

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[exceedxo]

Same issue here

[bluwy]

In Vite's lockfile, inflight is used by glob v8 and v7, which both are used by various dependencies including:

• @rollup/plugin-commonjs v25.0.4
• npm-packlist v5.1.3
• rimraf v3.0.2
• rollup-plugin-license v3.4.0
• stylus v0.63.0
• sucrase v3.32.0

Some are probably dev deps, but just listing these from the lockfile, and we need to update them first before we can remove inflight from the dependencies.

[swasthik-007]

what do i do now???

[bluwy]

Ignore it? It isn't breaking anything. Or you could try to see if the packages I mentioned above have moved away from inflight and if so, try to update them in Vite?

[swasthik-007]

okay Thank You

[lorand-horvath]

@bluwy The issue is coming from eslint@8, dependency tree:

"eslint": "^8.57.0"
  "file-entry-cache": "^6.0.1"
    "flat-cache": "^3.0.4"
      "rimraf": "^3.0.2" - deprecated
        "glob": "^7.1.3" - deprecated
          "inflight": "^1.0.4" - deprecated, leaks memory

The only viable solution I see is vite updating to eslint@9. Or eslint@8 fixing their deps (bump to file-entry-cache@8).

Temporary workaround: add file-entry-cache override to package.json, delete package-lock.json and npm install

  "overrides": {
    "eslint": {
      "file-entry-cache": "^8.0.0"
    }
  }

[adewaleftk]

npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
. I just experienced this same issue few minutes ago on my Kali Linux OS

[lorand-horvath]

Just use the workaround I described above in #17306 (comment)
eslint is a mess right now. v9 is barely 3% of all weekly downloads, but for the rest of us 97% still using v8, they won't fix it just because: eslint/eslint#18528 (comment)

[Sophyane]

Could we avoid the issue if we simply update Eslint to V9 ?

[Srossiprieto]

So, by migrating to version 9, those warnings would disappear? If that's the case, we would only need to run the command globally?

[bluwy]

For eslint, which only comes from Vite's react templates, #12860 will migrate it to eslint v9, however there seems to be some blockers before we can do that.

[bluwy]

#17431 removes the inflight dependency that's bundled within Vite. However, I'll still keep this open for the eslint template case.

[Srossiprieto]

Any news on this?
If so, how should I go about removing these warnings?
I don't know much about this; I appreciate the work you're doing.
Thanks!
@bluwy

[lorand-horvath]

Any news on this? If so, how should I go about removing these warnings?

@Srossiprieto See the workaround I posted in #17306 (comment)

You could also override the @humanwhocodes deprecations, so if you don't want to see any eslint 8-related warnings anymore, add the following to package.json, delete node_modules and package-lock.json, then run npm install

  "overrides": {
    "eslint": {
      "@humanwhocodes/config-array": "npm:@eslint/config-array",
      "file-entry-cache": "^8.0.0"
    }
  }

[edinoteK]

я вот честно сюда когда захожу, вообще без плнятия , что где, мне б Русификатор...

[chiragjain307]

I am also getting the same warning
First i run the command: "npm create vite@latest" to create a new npm project, after that when i run command "npm i", with the installation of node module i get these 5 warnings:

npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated @humanwhocodes/config-array@0.11.14: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead

[bluwy]

#12860 has been merged and released in create-vite 5.5.0, which bumps the eslint templates to v9