[email protected] dependency issues deprecation warning

[MikeMcC399]

Summary

When @cypress/[email protected] is installed with Yarn Classic, then the following deprecation notice is output:

warning @cypress/request > [email protected]: when using stringify with arrayFormat comma, [] is appended on single-item arrays. Upgrade to v6.11.0 or downgrade to v6.10.4 to fix.

The deprecation notice is not displayed if npm or pnpm is used to install @cypress/[email protected]. This is because these other package managers prefer non-deprecated versions to deprecated versions and therefore they select the alternative, non-deprecated, [email protected] version instead of selecting the deprecated [email protected] version.

Simplest Example to Reproduce

yarn add @cypress/request

Expected behavior

When @cypress/request is installed using Yarn, then no deprecation notice should be displayed.

Possible solution

The warning suggests:

Upgrade to v6.11.0 or downgrade to v6.10.4 to fix.

see qs CHANGELOG

Context

• This issue has been reported in warning cypress > @cypress/request > [email protected]: when using stringify with arrayFormat comma, [] is appended on single-item arrays. Upgrade to v6.11.0 or downgrade to v6.10.4 to fix. cypress#27644 as a concern.

Your Environment

software	version
@cypress/request	3.0.0
node	v18.16.1
npm	n/a
Yarn	1.22.19
Operating System	Ubuntu 22.04.3 LTS

Logs

$ yarn add @cypress/request
yarn add v1.22.19
info No lockfile found.
[1/4] Resolving packages...
warning @cypress/request > [email protected]: when using stringify with arrayFormat comma, `[]` is appended on single-item arrays. Upgrade to v6.11.0 or downgrade to v6.10.4 to fix.
[2/4] Fetching packages...
[3/4] Linking dependencies...
[4/4] Building fresh packages...
success Saved lockfile.
success Saved 47 new dependencies.
info Direct dependencies
└─ @cypress/[email protected]
info All dependencies
├─ @cypress/[email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
├─ [email protected]
└─ [email protected]
Done in 1.60s.

Notes

cypress-io/request is configured with
"qs": "~6.10.3"

request/package.json

Line 43 in 99338c8

"qs": "~6.10.3",

npm view [email protected] shows the deprecation notice

$ npm view [email protected]

[email protected] | BSD-3-Clause | deps: 1 | versions: 108
A querystring parser that supports nesting and arrays, with a depth limit
https://github.com/ljharb/qs

DEPRECATED ⚠️  - when using stringify with arrayFormat comma, `[]` is appended on single-item arrays. Upgrade to v6.11.0 or downgrade to v6.10.4 to fix.

This is a deprecation notice, not a vulnerability warning. There are currently no vulnerabilities detected in @cypress/request:

$ yarn audit
yarn audit v1.22.19
0 vulnerabilities found - Packages audited: 52
Done in 0.36s.

[nagash77]

Hi @MikeMcC399 ! Do you know if there are breaking changes in qs going from 6.10.3 -> 6.11.2? I'm also confused why this warning is showing since we are not above 6.10.4 which it suggests to downgrade to in order to avoid the problem.

[MikeMcC399]

Hi Ben @nagash77

Do you know if there are breaking changes in qs going from 6.10.3 -> 6.11.2?

I could not see any sign of breaking changes and the tests still pass. However I can't swear that nothing will break! I'm not familiar with the actual contents of qs. I just wanted to offer this PR in case it is helpful.

I'm also confused why this warning is showing since we are not above 6.10.4 which it suggests to downgrade to in order to avoid the problem.

Since package.json specifies a semver of "qs": "~6.10.3" it will pull the highest version which matches 6.10.x which is the deprecated 6.10.5.

If you are concerned about the risks of moving to 6.11.2, you could peg to 6.10.4 instead. I can submit that as an alternate PR so you can take your choice.

[MikeMcC399]

@nagash77

As I was reviewing this, I noticed that @cypress/request already pulls in the [email protected] version through browserify:

@cypress/[email protected] /home/mike/github/cypress-io/request
├─┬ [email protected]
│ └─┬ [email protected]
│   └── [email protected]
├─┬ [email protected]
│ └─┬ [email protected]
│   └── [email protected]
├─┬ [email protected]
│ └─┬ [email protected]
│   └── [email protected]
└── [email protected]

Edit: Except that may not be relevant if they are only devDependencies!

Maybe you can get a second opinion about the pros and cons of updating to 6.11.2?

Also it seems that npm doesn't try to install the deprecated version, whereas Yarn does, and then complains about it!

yarn why v1.22.19
[1/4] Why do we have the module "qs"...?
[2/4] Initialising dependency graph...
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "[email protected]"
info Has been hoisted to "qs"
info This module exists because it's specified in "dependencies".
info Disk size without dependencies: "284KB"
info Disk size with unique dependencies: "336KB"
info Disk size with transitive dependencies: "872KB"
info Number of shared dependencies: 7
=> Found "body-parser#[email protected]"
info This module exists because "karma#body-parser" depends on it.
info Disk size without dependencies: "284KB"
info Disk size with unique dependencies: "336KB"
info Disk size with transitive dependencies: "872KB"
info Number of shared dependencies: 7
=> Found "url#[email protected]"
info This module exists because "browserify#url" depends on it.
info Disk size without dependencies: "300KB"
info Disk size with unique dependencies: "352KB"
info Disk size with transitive dependencies: "888KB"
info Number of shared dependencies: 7
=> Found "request#[email protected]"
info This module exists because "phantomjs-prebuilt#request" depends on it.
info Disk size without dependencies: "196KB"
info Disk size with unique dependencies: "196KB"
info Disk size with transitive dependencies: "196KB"
info Number of shared dependencies: 0
Done in 1.41s.

[MikeMcC399]

@nagash77

• I'm now suggesting to pin to [email protected] through PR fix(deps): lock qs to 6.10.4 #44 to supersede the previous PR fix(deps): update qs to 6.11.2 #43

• This is a very minimal change which fixes the issue for Yarn. npm and pnpm don't need a fix and the PR does not affect the version chosen by these other two package managers. I consider it low risk.

[cypress-app-bot]

🎉 This issue has been resolved in version 3.0.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀