hermes - 💡(How to fix) Fix npm: deprecated dependency [email protected] (security vulnerabilities, used via @babel/cli)

Summary

npm install in ui-tui/ emits a deprecation warning for [email protected]:

npm warn deprecated [email protected]: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting [email protected]

Dependency Chain

ui-tui (devDependencies)
  └─ @babel/cli@^7.28.6
       └─ glob@^7.2.0  (resolved: 7.2.3)   ← deprecated, security vulns

The glob@7 series is end-of-life. glob@8 and @9 fix the security issues and additionally drop the inflight dependency.

Impact

• Build-time only (not in production runtime)
• [email protected] contains widely publicized security vulnerabilities
• This deprecation also pulls in [email protected] (filed separately) which is itself deprecated

Suggested Fix

1. Preferred: Update @babel/cli to a version using glob@^8 or later.
2. Workaround: Add an overrides entry in ui-tui/package.json to pin glob to ^8 or ^9:

// ui-tui/package.json
"overrides": {
  "glob": "^8"
}

This is a companion to the inflight deprecation issue — fixing glob eliminates both warnings.