🐛 BUG: deprecated dependencies

[benmccann]

Which Cloudflare product(s) does this pertain to?

Wrangler core

What version(s) of the tool(s) are you using?

3.62.0

What version of Node are you using?

No response

What operating system and version are you using?

any

Describe the Bug

Wrangler has deprecated packages in its dependency tree, which causes deprecation warnings for us when doing pnpm install

https://npmgraph.js.org/?q=wrangler

It looks like you need to switch from @esbuild-plugins/node-modules-polyfill to esbuild-plugin-polyfill-node

Please provide a link to a minimal reproduction

pnpm install wrangler

Please provide any relevant error logs

 WARN  2 deprecated subdependencies found: rollup-plugin-inject@3.0.2, sourcemap-codec@1.4.8

[petebacondarwin]

This was discussed at some length in #1232.
The current plan is to move to a completely new approach to node-compat that uses unenv and built-in run time modules.
We don't plan to update these plugins.

[benmccann]

Can we update the plugins in the meantime instead of serving deprecated versions to all of our users?

What's the release timeline for wrangler 4?

[benmccann]

I found this fixed as the last commit in the v4 branch four months ago: #5209. But there have been no further updates to the branch since then

[petebacondarwin]

These are just warnings. Do you actually have a bug in the node_compat feature that would be resolved by changing these dependencies?

[benmccann]

There's no bug and I get that they're just warnings, but I don't want to teach our users to ignore warnings nor do we want to ignore them in our own projects. Users file bugs against us everytime we have deprecation warnings, it causes our audit checks to fail, and it's just not consistent with the quality of our offering to generate warnings for years while telling users to ignore them.

[RamIdeas]

To provide an update here we have a new node compat feature about to launch soon which will become our primary recommendation for node polyfills but we cannot remove the old node compat feature without a breaking change.

Since this issue pertains to warnings caused by deprecated dependencies needed for the old node compat feature, I've applied a breaking change label.

Although, if we wanted to fix this without a breaking change, we could consider vendoring the deprecated packages into our repo.

[benmccann]

Another idea might be to make the implementation pluggable so that users can choose which implementation to use without pulling in dependencies for the implementation(s) they're not using. That would still be a breaking change, but a pretty small one that would be easy enough to handle while upgrading.

[irvinebroque]

Vendoring makes sense to me