Indirect Dependency on Deprecated sourcemap-codec@1.4.8 in nuxt-security

[nicokempe]

Hello,

I've identified an issue in the nuxt-security package (version 1.0.0) related to its dependencies, specifically concerning an indirect dependency on a deprecated package.

Environment

• Operating System: Windows_NT
• Node Version: v20.8.1
• Nuxt Version: 3.9.1
• CLI Version: 3.10.0
• Nitro Version: 2.8.1
• Package Manager: pnpm@8.14.1
• User Config: preset, experimental, devtools, modules, serverMiddleware, nitro, i18n, cloudflareAnalytics, turnstile, css, postcss, mongoose, app, runtimeConfig, routeRules, image, security, content, typescript
• Runtime Modules: @nuxt/image@1.2.0, @nuxt/devtools@1.0.8, @nuxt/content@2.10.0, @nuxtjs/i18n@8.0.0, @nuxtjs/turnstile@0.6.3, @nuxtjs/tailwindcss@6.10.4, nuxt-security@1.0.0, nuxt-headlessui@1.1.5, nuxt-cloudflare-analytics@1.0.8

Issue Description

nuxt-security indirectly depends on the deprecated package sourcemap-codec@1.4.8. This was uncovered using pnpm why sourcemap-codec, which traces the dependency through nuxt-security -> unplugin-remove -> magic-string -> sourcemap-codec.

The use of deprecated dependencies could potentially lead to compatibility or security issues in the future, which is a significant concern for the reliability and security of our project.

Expected Behavior

Dependencies within nuxt-security should be up-to-date to ensure compatibility and security.

Steps to Reproduce

1. Use nuxt-security version 1.0.0 in a Nuxt 3 project.
2. Run pnpm why sourcemap-codec to observe the dependency chain.

Could you please provide information on whether there is a plan to address this issue in a future update of nuxt-security?

Thank you for your assistance and the work you do maintaining this package. ❤️

[Baroshem]

Hey Buddy,

Thanks for doing a research about the packages.

I will take a look at it in the upcoming days :)

[Baroshem]

I have created an upstream issue in the unplugin-remove package as it should be fixed there.

I will provide the package author all the help needed to resolve it.

Will keep you posted :)

[nicokempe]

Thank you very much!