{"action":"created","issue":{"url":"https://api.github.com/repos/npm/npm/issues/11628","repository_url":"https://api.github.com/repos/npm/npm","labels_url":"https://api.github.com/repos/npm/npm/issues/11628/labels{/name}","comments_url":"https://api.github.com/repos/npm/npm/issues/11628/comments","events_url":"https://api.github.com/repos/npm/npm/issues/11628/events","html_url":"https://github.com/npm/npm/issues/11628","id":135248969,"number":11628,"title":"Stop showing deprecation warnings of sub-dependencies to end users","user":{"login":"leo","id":6170607,"avatar_url":"https://avatars.githubusercontent.com/u/6170607?v=3","gravatar_id":"","url":"https://api.github.com/users/leo","html_url":"https://github.com/leo","followers_url":"https://api.github.com/users/leo/followers","following_url":"https://api.github.com/users/leo/following{/other_user}","gists_url":"https://api.github.com/users/leo/gists{/gist_id}","starred_url":"https://api.github.com/users/leo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leo/subscriptions","organizations_url":"https://api.github.com/users/leo/orgs","repos_url":"https://api.github.com/users/leo/repos","events_url":"https://api.github.com/users/leo/events{/privacy}","received_events_url":"https://api.github.com/users/leo/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/npm/npm/labels/bug","name":"bug","color":"A328B3"},{"url":"https://api.github.com/repos/npm/npm/labels/patch-welcome","name":"patch-welcome","color":"BEEB71"},{"url":"https://api.github.com/repos/npm/npm/labels/ux","name":"ux","color":"9BA0EF"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2016-02-21T19:48:48Z","updated_at":"2016-03-08T00:08:22Z","closed_at":null,"body":"Every time I'm installing a certain package for one of my projects, I get a lot of those:\r\n\r\n<img width=\"143\" alt=\"screen shot 2016-02-21 at 20 33 07\" src=\"https://cloud.githubusercontent.com/assets/6170607/13204852/5bfdcdac-d8da-11e5-8714-d859838facff.png\">\r\n\r\nI understand that they're important: Because if they wouldn't exist, developers wouldn't be able to keep track of deprecated versions of their project's dependencies.\r\n\r\nHowever I don't understand why I as an **end user** am seeing those. I mean: I'm not the person who's responsible for replacing/updating those deprecated dependencies. Only the maintainer of the dependency/package I'm installing is.\r\n\r\nHere's an example:\r\n\r\n> I've installed a package called \"whatever\" and even added it to my `package.json`'s dependencies. While it was installing, my terminal shouted a lot of those deprecation warnings at me. Okay, fine. But what should I do with those? I'm not the maintainer of the package that depends on those deprecated packages. Why am I seeing those errors?\r\n\r\nWouldn't it be better to only show those errors when running `npm install` within the package that depends on those deprecated packages? This way, we could make sure that only the **maintainers** and NOT the actual **users** of the package will see those errors.\r\n"},"comment":{"url":"https://api.github.com/repos/npm/npm/issues/comments/193517663","html_url":"https://github.com/npm/npm/issues/11628#issuecomment-193517663","issue_url":"https://api.github.com/repos/npm/npm/issues/11628","id":193517663,"user":{"login":"othiym23","id":418097,"avatar_url":"https://avatars.githubusercontent.com/u/418097?v=3","gravatar_id":"","url":"https://api.github.com/users/othiym23","html_url":"https://github.com/othiym23","followers_url":"https://api.github.com/users/othiym23/followers","following_url":"https://api.github.com/users/othiym23/following{/other_user}","gists_url":"https://api.github.com/users/othiym23/gists{/gist_id}","starred_url":"https://api.github.com/users/othiym23/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/othiym23/subscriptions","organizations_url":"https://api.github.com/users/othiym23/orgs","repos_url":"https://api.github.com/users/othiym23/repos","events_url":"https://api.github.com/users/othiym23/events{/privacy}","received_events_url":"https://api.github.com/users/othiym23/received_events","type":"User","site_admin":false},"created_at":"2016-03-08T00:08:22Z","updated_at":"2016-03-08T00:08:22Z","body":"> I do believe that any dependency reported to contain a security vulnerability should be flagged by npm. That should be made as visible as possible to end consumers of node modules.\r\n\r\nThat sounds like something that is best handled right now by nsp, snyk.io, or bithound.io's scanners, because it would require a parallel infrastructure for checking and reporting packages with vulnerabilities that doesn't currently exist. Were we to integrate this into the CLI, it would need to be done so as to not have too significant an impact on performance. Also, that's something probably better tracked as a separate feature request or (preferably) PR, because it's more or less unrelated to the original issue."}}