deprecated packages

[xander-haj]

npm warn deprecated whatwg-encoding@3.1.1: Use @exodus/bytes instead for a more spec-conformant and faster implementation

How to replicate

• have "@vscode/vsce": "^3.7.1",` inside your devDependencies in package.json
• run: npm install

[SchaefersKlaus]

Additional info (repro + possible fixes):

I can reproduce two npm deprecation warnings with @vscode/vsce@3.7.1 (which is currently latest):

$ npx -y @vscode/vsce@latest package --no-dependencies
npm WARN deprecated whatwg-encoding@3.1.1: Use @exodus/bytes instead...
npm WARN deprecated glob@11.1.0: Old versions of glob are not supported...

Notes:

• glob@11.1.0 is deprecated on npm, but glob@latest is 13.0.1 and is not deprecated. @vscode/vsce@3.7.1 declares glob: ^11.0.0, which currently resolves to the deprecated 11.1.0.

  • Proposed fix: bump glob dependency to ^13.0.0 (or at least a non-deprecated range).

• whatwg-encoding@3.1.1 is deprecated and appears via:

  • @vscode/vsce -> cheerio@1.2.0 -> encoding-sniffer@0.2.1 -> whatwg-encoding@3.1.1
  • encoding-sniffer@latest is 0.2.1 and still depends on whatwg-encoding, so updating it won’t help.
  • Interesting detail: cheerio@1.0.0-rc.12 has no encoding-sniffer dependency (see npm view cheerio@1.0.0-rc.12 dependencies). Because @vscode/vsce depends on cheerio: ^1.0.0-rc.9, npm currently resolves to stable 1.2.0 which introduces encoding-sniffer.
    • Possible mitigation: pin cheerio to 1.0.0-rc.12 (or otherwise restrict range to avoid pulling the stable 1.x line) until there is an alternative to encoding-sniffer/whatwg-encoding.
    • Longer-term: replace the HTML parsing/decoding path to avoid encoding-sniffer (or move to a decoder that uses @exodus/bytes, per the deprecation guidance).

These are “packaging-time noise” warnings (packaging still works), but they affect any extension project running VSIX packaging in CI or locally.

Happy to test a prerelease build if you want validation.

[ara303]

It seems encoding-sniffer plans to use @exdous/bytes upstream but intends to release with other changes. Last activity: Jan 27.

Issue open on cheerio. No activity yet. Likely they're waiting on encoding-sniffer and may bump after that lands?

As noted it's just noise but would be cool to resolve and I'd like to help if I can.

Update: encoding-sniffer's merged that PR. cheerio maintainers say in this comment it's being worked on. See also this PR to keep an eye on progress.

[hmeine]

That cheerio PR was closed a month ago; it's not obvious to me if the encoding-sniffer problem was solved.

Independent of that, couldn't the glob issue be tackled already?

In the meantime, I am also getting a deprecation warning from prebuild-install@7.1.3 ("No longer maintained. Please contact the author of the relevant native addon; alternatives are available.")