Trace deprecated npm dependency warnings in Pi monorepo
Session from pi-mono-sessions on Hugging Face by thomasmustier · MIT · condensed by Coders Talk
Investigate npm install deprecation warnings for node-domexception and [email protected] in a fork of the pi-mono repo, tracing where they come from and assessing the blast radius of updating them.
- +0Prompt · +0Investigate deprecated npm install warnings for node-domexception and glob in pi-mono, see where they're used and assess update blast radius
- +0mAgent did · +0mSearched package-lock.json and source files to trace node-domexception's dependency chain through @google/genai → google-auth-library → gaxios → node-fetch → fetch-blob, and found [email protected] pulled in via rimraf. Summarized findings: node-domexception is only a deprecation/polyfill issue with no known security impact.
- +20mPrompt · +20mFocus the trace on [email protected] instead — seems more important and easier to fix
- +20mAgent did · +20mRan npm ls -g, inspected global install logs, npm view metadata for rimraf, gaxios and google-auth-library to pin down the exact chain: [email protected] → [email protected] → [email protected]. Discovered that pi-coding-agent publishes package overrides pinning rimraf to 6.1.2, but npm overrides aren't honored by downstream consumers doing a global install, so the vulnerable glob version still resolves.
- Break · 56m away, not counted
- +23mOutcome · +23mRoot cause identified: gaxios→[email protected]→[email protected] chain not fixed by existing overrides for global installs; developer paused to switch back to the security-patch branch to continue the fix.
I'd start by asking the agent to check npm install logs and overrides directly instead of grepping package-lock.json first — that's what actually found the root cause. Redirecting focus from node-domexception (a non-issue) to [email protected] was the right call and is what led to the real finding: our overrides don't apply to consumers doing a global install. Next time I'd frame the initial prompt around 'which of these warnings is a real security issue and traceable via npm's own install logs' to skip the long source-code detour.