search

FHIR / GoFSH

GoFSH is a FHIR Shorthand (FSH) decompiler, able to convert formal FHIR definitions from JSON/XML to FSH.
Apache License 2.0
35 stars 6 forks source link

Resolve deprecation warnings #175

Open jafeltra opened 2 years ago

jafeltra commented 2 years ago

When you install GoFSH v1.5.0, there are warnings reported about deprecated packages. We should update the dependencies to resolve any reported issues.

See: https://chat.fhir.org/#narrow/stream/215610-shorthand/topic/GoFSH.201.2E5.2E0/near/273491509

julianxcarter commented 2 years ago

This warning is logged due to mkdirp a third-order dependency in use during the fishing-trip routine (the FSHing Trip algorithm renders the final html using the diff2html package, which names the hogan.js package as a dependency, which utilizes a long outdated version of the mkdirp package). There are two open pull requests on the hogan.js GitHub page to update this deprecated dependency, however the hogan.js project has not received any merges to the main branch since 2019 and has not received a npm release since 2014.

There are several options to force hogan.js to utilize the most recent version of mkdirp, which namely does not adversely affect fshing trip functionality at all:

  1. Use of the npm-force-resolutions package, which will force a specific version of mkdirp to be installed for all dependencies.
  2. Use of the "overrides" flag that is native to npm versions 8.3.x and above, which will allow for us to specify a version number for mkdirp to be loaded for hogan.js specifically. This will have no affect on other dependencies, which seems preferable.

The "overrides" flag is native to npm, however I could not get it to work and it will necessitate GoFSH relying on Node 14 and npm 8.3. There is an open issue on the npm gitHub page, and a maintainer has said that a fix is forthcoming, so I think if we decide to override the dependency then this should be our preferred option. Node 12 will be reaching EOL this year, so moving to Node 14 ahead of that and using the native option seems preferable.

There are two things to note when forcing the mkdirp dependency update. firstly, fshing trips still work fine even with the latest version of mkdirp being used by hogan.js. Secondly, the deprecation warning is still present when installing GoFSH. From what I can tell, that warning comes from the npm registry and there's nothing we can do to prevent that.