Deprecation Warning: inflight package referenced by outdated glob dependency

[luc-debug]

Deprecation Warnings Observed

npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. 
Do not use it. Check out lru-cache if you want a good and tested way to coalesce 
async requests by a key value, which is much more comprehensive and powerful.

npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported.

Description

I’m getting a warning about the inflight package being deprecated. It’s being referenced by the glob package, which is outdated. Updating glob should resolve this issue.

[erickzhao]

Are you installing asar instead of @electron/asar? We namespaced this package a while ago for consistency with other Electron packages. The current lockfile only references glob 10 and 11.

asar/yarn.lock

Lines 1243 to 1273 in 843156e

	"glob@npm:^10.2.2":
	version: 10.4.5
	resolution: "glob@npm:10.4.5"
	dependencies:
	foreground-child: "npm:^3.1.0"
	jackspeak: "npm:^3.1.2"
	minimatch: "npm:^9.0.4"
	minipass: "npm:^7.1.2"
	package-json-from-dist: "npm:^1.0.0"
	path-scurry: "npm:^1.11.1"
	bin:
	glob: dist/esm/bin.mjs
	checksum: 10c0/19a9759ea77b8e3ca0a43c2f07ecddc2ad46216b786bb8f993c445aee80d345925a21e5280c7b7c6c59e860a0154b84e4b2b60321fea92cd3c56b4a7489f160e
	languageName: node
	linkType: hard
	"glob@npm:^11.0.1":
	version: 11.0.1
	resolution: "glob@npm:11.0.1"
	dependencies:
	foreground-child: "npm:^3.1.0"
	jackspeak: "npm:^4.0.1"
	minimatch: "npm:^10.0.0"
	minipass: "npm:^7.1.2"
	package-json-from-dist: "npm:^1.0.0"
	path-scurry: "npm:^2.0.0"
	bin:
	glob: dist/esm/bin.mjs
	checksum: 10c0/2b32588be52e9e90f914c7d8dec32f3144b81b84054b0f70e9adfebf37cd7014570489f2a79d21f7801b9a4bd4cca94f426966bfd00fb64a5b705cfe10da3a03
	languageName: node
	linkType: hard

[luc-debug]

I installed @electron/asar via electron v38.4.0. Do you have a tip why the old glob is installed?

[erickzhao]

Ah, I think deps are stale on the electron package. @electron/asar 4 should already have this fixed, but v3 is still in Electron core's lockfile.

[mmaietta]

electron-builder hasn't upgraded yet due to the node 22 upgrade requirement. Might need to just pull the trigger and major semver bump electron-builder's engine to 22