I installed bcrypt in my node application and after the installation, I received several warnings about deprecated packages, including one mentioning a memory leak:
$ npm install bcrypt
npm WARN deprecated [email protected]: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated [email protected]: This package is no longer supported.
npm WARN deprecated [email protected]: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated [email protected]: Glob versions prior to v9 are no longer supported
npm WARN deprecated [email protected]: This package is no longer supported.
npm WARN deprecated [email protected]: This package is no longer supported.
I understand that these warnings relate to some dependencies used by bcrypt. To confirm this, I ran npm ls inflight and saw the following dependency structure:
└─┬ [email protected]
└─┬ @mapbox/[email protected]
└─┬ [email protected]
└─┬ [email protected]
└── [email protected]
As a beginner, I’m concerned about whether using bcrypt is safe for long-running applications, especially since memory leaks were mentioned.
The warning suggests using a package called lru-cache but I don’t think I should change a transitive dependency of a widely used package like bcrypt.
Here are my specific questions:
- Are these deprecated dependencies a significant concern for using
bcryptin production? - Should I
lru-cacheas suggested by the warning message? (If yes, how, since it is a transitive dependency?) - Should I worry about these other deprecate warnings?
Any guidance would be greatly appreciated!
Additional Context:
- Node.js version: v20.13.0
- npm version: 10.5.2
- Operating System: Windows 10 Pro (64-bit)