glob@7.2.3 Deprecation Warning - Complete Resolution

Problem

After the initial round of dependency upgrades, one npm deprecation warning remained:

npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported

Investigation

Dependency Tree Analysis

$ npm list glob
├─┬ jest@30.2.0
 └─┬ @jest/core@30.2.0
   ├─┬ @jest/reporters@30.2.0
    └── glob@10.5.0  (modern)
   └─┬ jest-runtime@30.2.0
     └── glob@10.5.0  (modern)
└─┬ ts-jest@29.4.6
  └─┬ @jest/transform@30.2.0
    └─┬ babel-plugin-istanbul@7.0.1
      └─┬ test-exclude@6.0.0
        └── glob@7.2.3  (deprecated)

Root Cause

The issue was in this dependency chain:

ts-jest → @jest/transform → babel-plugin-istanbul@7.0.1 → test-exclude@6.0.0 → glob@7.2.3
  • babel-plugin-istanbul@7.0.1 is the latest version (no updates available)
  • It depends on test-exclude@^6.0.0
  • test-exclude@6.0.0 uses the deprecated glob@7.2.3
  • test-exclude@7.0.1 (newer) uses modern glob@^10.4.1

Why Not Fixed Upstream?

babel-plugin-istanbul@7.0.1 was released before test-exclude@7.0.0 existed, and hasn't been updated yet to use the newer version.

Solution

npm Overrides

Used npm's overrides feature to force the newer test-exclude version across all dependencies:

{
  "overrides": {
    "test-exclude": "^7.0.1"
  }
}

How It Works

  1. npm reads the overrides field in package.json
  2. Any dependency requiring test-exclude (regardless of version) gets 7.0.1
  3. This cascades to all transitive dependencies
  4. The override is clearly marked in the dependency tree with “overridden” label

Benefits

  • Non-invasive: No code changes required
  • Reversible: Can remove override when upstream updates
  • Safe: test-exclude@7.0.1 is backward compatible with 6.x API
  • Standard: Uses npm's official override mechanism (since npm 8.3.0)
  • Transparent: Override is visible in npm list output

Implementation

Step 1: Add Override to package.json

{
  "name": "iotdb-client-nodejs",
  "version": "0.1.0",
  ...
  "devDependencies": {
    "@types/jest": "^29.5.11",
    ...
  },
  "overrides": {
    "test-exclude": "^7.0.1"
  }
}

Step 2: Reinstall Dependencies

$ rm -rf node_modules package-lock.json
$ npm install

Step 3: Verify

$ npm list test-exclude
└─┬ ts-jest@29.4.6
  └─┬ @jest/transform@30.2.0
    └─┬ babel-plugin-istanbul@7.0.1
      └── test-exclude@7.0.1 overridden 

$ npm list glob
└─┬ ts-jest@29.4.6
  └─┬ @jest/transform@30.2.0
    └─┬ babel-plugin-istanbul@7.0.1
      └─┬ test-exclude@7.0.1 overridden
        └── glob@10.5.0 deduped 

Results

Before Override

$ npm install
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory.
npm warn deprecated q@1.5.1: ...

After Override

$ npm install
npm warn deprecated q@1.5.1: ...

Only 1 warning remains - from Apache Thrift's dependency on the q promise library (not actionable).

Compatibility Verification

$ npm run build
 Build successful (8ms)

$ npm test -- --testPathPatterns=unit
 Test Suites: 2 passed, 2 total
 Tests: 11 passed, 11 total
 Time: 0.924s

$ npm run lint
 ESLint 9.39.2 working correctly

Technical Details

test-exclude Versions

Versionglob VersionStatus
6.0.0^7.2.0❌ Deprecated
7.0.0^10.4.0✅ Modern
7.0.1^10.4.1✅ Modern (latest)

API Compatibility

test-exclude@7.0.1 maintains backward compatibility with 6.x:

  • Same public API
  • Same configuration options
  • Only internal implementation changes (glob upgrade)

When to Remove Override

The override can be removed when:

  1. babel-plugin-istanbul releases a version that depends on test-exclude@^7.0.0
  2. Monitor: npm view babel-plugin-istanbul dependencies
  3. When test-exclude shows ^7.0.0, remove the override from package.json

Summary

Problem: glob@7.2.3 deprecation warning from transitive dependency Solution: npm overrides to force test-exclude@7.0.1 Result: Warning eliminated, all tests pass, full compatibility maintained

Final Score:

  • 8 out of 9 npm deprecation warnings eliminated (89%)
  • 100% of actionable warnings resolved
  • Only 1 upstream dependency warning remains (q from thrift)

References