Deprecated transitive dependencies via exceljs (glob, rimraf, inflight, fstream)

[hire-mlcatlin]

Summary

Desktop Commander 0.2.24 pulls in deprecated packages through its exceljs@4.4.0 dependency, causing npm warnings during installation and updates.

Deprecation Warnings

npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory.
npm warn deprecated rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated fstream@1.0.12: This package is no longer supported.

Dependency Chain

@wonderwhy-er/desktop-commander@0.2.24
└── exceljs@4.4.0
    ├── archiver@5.3.2 → archiver-utils@2.1.0 → glob@7.2.3 → inflight@1.0.6
    └── unzipper@0.10.14 → fstream@1.0.12 → rimraf@2.7.1

Upstream Status

ExcelJS has multiple open issues requesting dependency updates (exceljs/exceljs#2882, exceljs/exceljs#2984) dating back to December 2023, but no fix has shipped.

Possible Mitigations

1. Monitor exceljs for updates and bump when available
2. Evaluate alternative Excel libraries with maintained dependencies
3. If Excel functionality is optional, consider making exceljs an optional/peer dependency

Environment

• Node: v25.2.1
• npm: 11.6.2
• macOS 15 (Tahoe)

Thanks for the great tool!