Consider removing or replacing `update-notifier`?

[jimmywarting]

I personally think that the drawbacks from keeping a update notifier outweigh the benefits:

• It currently requires 84 modules to keep that update-notifier around...
• The attack surface is increased, and having many dependencies makes it harder to vet the dependency tree.
• Dependency chain attacks are becoming more common.
• Currently, $ npm outdated reports that about 70 requirements are at least 1 major version behind. I'm sure that some of the updates are not currently necessary, but perhaps they may soon.
• In all the years since update-notifier was added, the ecosystem has improved visibility and handling of dependency updates. We have npm outdated and yarn upgrade-interactive, and npx without an explicit dependency will try to run the latest version by default.
• Every sub dependency that you have no control over is a potentially security risk
• Every time someone installs your package then it will already get the latest version

I suggest that you just use npm deprecate js-ipfs@x new version available, update to x.y.z

An alternative is a more minimal cross compatible Deno / Bun /Browser (\w CORS support) package called: update-notifier-go

[welcome[bot]]

Thank you for submitting your first issue to this repository! A maintainer will be here shortly to triage and review. In the meantime, please double-check that you have provided all the necessary information to make this process easy! Any information that can help save additional round trips is useful! We currently aim to give initial feedback within two business days. If this does not happen, feel free to leave a comment. Please keep an eye on how this issue will be labeled, as labels give an overview of priorities, assignments and additional actions requested by the maintainers:

• "Priority" labels will show how urgent this is for the team.
• "Status" labels will show if this is ready to be worked on, blocked, or in progress.
• "Need" labels will indicate if additional input or analysis is required.

Finally, remember to use https://discuss.ipfs.io if you just need general support.

[achingbrain]

Thanks for opening this - js-IPFS is in the process of being deprecated, the replacement is Helia which is a bit more minimal and doesn't have extra deps like this.

The intention behind including this sort of module is to prompt a user who has js-IPFS installed as a CLI tool to upgrade, they typically don't npm i it every day so they wouldn't see the notifications from npm deprecate.

Your replacement module looks interesting though thanks for the link!