Skip to content

Upgrade node-pre-gyp to 2.0.3#462

Merged
shibd merged 1 commit intomasterfrom
fix_cve
Mar 4, 2026
Merged

Upgrade node-pre-gyp to 2.0.3#462
shibd merged 1 commit intomasterfrom
fix_cve

Conversation

@shibd
Copy link
Member

@shibd shibd commented Mar 4, 2026

Master Issue: #431

Motivation

The @mapbox/node-pre-gyp@1.0.11 dependency has several deprecated packages that generate warnings during npm install, including:

  • inflight@1.0.6
  • npmlog@5.0.1
  • rimraf@3.0.2
  • are-we-there-yet@2.0.0
  • glob@7.2.3
  • gauge@3.0.2

These deprecation warnings clutter the installation output and may indicate security or maintenance issues. Additionally, there were linker warnings during build on macOS due to a version mismatch between the deployment target (11.0) and the pre-compiled C++ client library (macOS 13.0).

Modifications

  1. Upgraded @mapbox/node-pre-gyp from 1.0.11 to 2.0.3 in package.json: This version (released Nov 26, 2025) removes all deprecated dependencies
  2. Changed MACOSX_DEPLOYMENT_TARGET from 11.0 to 13.0
This matches the pre-compiled C++ client library version and eliminates linker warnings
The warnings appeared as: ld: warning: object file was built for newer 'macOS' version (13.0) than being linked (11.0)

Verifying this change

  1. Verified that npm install no longer shows deprecation warnings from @mapbox/node-pre-gyp dependencies
  2. Verified that npx node-pre-gyp build completes successfully
  3. Verified that the binary lib/binding/pulsar.node is generated correctly (12M, Mach-O 64-bit bundle arm64)
  4. Verified that linker warnings about macOS version mismatch no longer appear during build
  5. Make sure that this change passes CI checks.
  6. This change is already covered by existing tests, such as the existing build and integration tests in the repository that verify the native addon compiles and runs correctly.

Documentation

  • doc-required
    (Your PR needs to update docs and you will update later)

  • doc-not-needed
    (Please explain why)

  • doc
    (Your PR contains doc changes)

  • doc-complete
    (Docs have been already added)

@shibd shibd merged commit 11afc3a into master Mar 4, 2026
11 of 12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant