@kya-os/create-mcpi-app 1.7.38-canary.0 → 1.7.38-canary.1

package/DEPRECATION_WARNINGS_ANALYSIS.md

@@ -0,0 +1,192 @@
+# Deprecation Warnings Analysis
+
+## Summary
+
+The deprecation warnings seen when running `npx @kya-os/create-mcpi-app` are **transitive dependencies** from upstream packages. They cannot be directly fixed in `create-mcpi-app` without fixing the root packages.
+
+## Warning Sources
+
+### 1. `inflight@1.0.6` (deprecated - leaks memory)
+
+**Source Chain:**
+
+```
+@kya-os/mcp-i
+  └─ clean-webpack-plugin@4.0.0
+      └─ del@4.1.1
+          └─ rimraf@2.7.1
+              └─ glob@7.2.3
+                  └─ inflight@1.0.6 ❌
+
+@kya-os/mcp-i
+  └─ del@7.1.0
+      └─ rimraf@3.0.2
+          └─ glob@7.2.3
+              └─ inflight@1.0.6 ❌
+```
+
+**Fix Required In:** `@kya-os/mcp-i` package
+
+- Update `clean-webpack-plugin` to latest version (may have fixed this)
+- Update `del` to latest version (may have fixed this)
+- Or replace `clean-webpack-plugin` with native Node.js alternatives
+
+### 2. `phin@2.9.3` and `phin@3.7.1` (deprecated - no longer supported)
+
+**Source Chain:**
+
+```
+@kya-os/cli
+  └─ terminal-image@3.1.1
+      └─ render-gif@2.0.4
+          └─ jimp@0.14.0
+              └─ @jimp/core@0.14.0
+                  └─ load-bmfont@1.4.2
+                      └─ phin@3.7.1 ❌
+```
+
+**Fix Required In:** `@kya-os/cli` package
+
+- Update `terminal-image` to latest version
+- Or replace `terminal-image` with alternative that doesn't use deprecated `jimp`
+- Or update `jimp` to latest version (if available)
+
+### 3. `rimraf@2.7.1` and `rimraf@3.0.2` (deprecated - use v4+)
+
+**Source Chain:**
+
+```
+@kya-os/mcp-i
+  └─ clean-webpack-plugin@4.0.0
+      └─ del@4.1.1
+          └─ rimraf@2.7.1 ❌
+
+@kya-os/mcp-i
+  └─ del@7.1.0
+      └─ rimraf@3.0.2 ❌
+```
+
+**Fix Required In:** `@kya-os/mcp-i` package
+
+- Update `clean-webpack-plugin` to latest (may use rimraf@4+)
+- Update `del` to latest version (may use rimraf@4+)
+- Or add `rimraf@^5.0.0` as direct dependency to force resolution
+
+### 4. `glob@7.2.3` (deprecated - use v9+)
+
+**Source Chain:**
+
+```
+@kya-os/mcp-i
+  └─ clean-webpack-plugin@4.0.0
+      └─ del@4.1.1
+          └─ rimraf@2.7.1
+              └─ glob@7.2.3 ❌
+
+@kya-os/mcp-i
+  └─ del@7.1.0
+      └─ rimraf@3.0.2
+          └─ glob@7.2.3 ❌
+```
+
+**Fix Required In:** `@kya-os/mcp-i` package
+
+- Same as rimraf - update `clean-webpack-plugin` and `del` to latest versions
+
+### 5. `node-domexception@1.0.0` (deprecated - use native DOMException)
+
+**Source Chain:**
+
+```
+@modelcontextprotocol/inspector (optional dependency)
+  └─ node-fetch@3.3.2
+      └─ fetch-blob@3.2.0
+          └─ node-domexception@1.0.0 ❌
+```
+
+**Fix Required In:** `@modelcontextprotocol/inspector` package
+
+- This is an external package we don't control
+- Node.js 20+ has native DOMException, so this could be updated upstream
+
+## Solutions
+
+### Option 1: Fix in Upstream Packages (Recommended)
+
+**For `@kya-os/mcp-i`:**
+
+1. Update `clean-webpack-plugin` to latest version
+2. Update `del` to latest version
+3. Consider replacing `clean-webpack-plugin` with native `fs.rmSync` (Node.js 14.14+)
+
+**For `@kya-os/cli`:**
+
+1. Update `terminal-image` to latest version
+2. Consider replacing with alternative image display library
+3. Or make `terminal-image` optional/feature-flag
+
+**For `@modelcontextprotocol/inspector`:**
+
+- This is external - file issue with upstream maintainers
+- Or consider making it truly optional (not installed unless needed)
+
+### Option 2: Use npm/pnpm Overrides (Quick Fix)
+
+Add to `package.json`:
+
+```json
+{
+  "pnpm": {
+    "overrides": {
+      "rimraf": "^5.0.0",
+      "glob": "^11.0.0"
+    }
+  }
+}
+```
+
+**Note:** This forces newer versions but may cause compatibility issues if upstream packages aren't compatible.
+
+### Option 3: Accept Warnings (Current State)
+
+These are **warnings, not errors**. The package works fine. The warnings are:
+
+- Informational only
+- Don't affect functionality
+- Will be resolved when upstream packages update
+
+## Impact Assessment
+
+**Risk Level:** ⚠️ **LOW**
+
+- Warnings don't affect functionality
+- All deprecated packages still work
+- No security vulnerabilities (just deprecation notices)
+
+**User Experience Impact:** ⚠️ **MINIMAL**
+
+- Users see warnings but package works
+- Warnings are common in npm ecosystem
+- Most users ignore deprecation warnings
+
+## Recommendation
+
+**Short-term:** Accept the warnings - they don't affect functionality.
+
+**Medium-term:** Fix in upstream packages (`@kya-os/mcp-i` and `@kya-os/cli`):
+
+1. Update `clean-webpack-plugin` and `del` in `@kya-os/mcp-i`
+2. Update `terminal-image` in `@kya-os/cli` or make it optional
+3. File issue with `@modelcontextprotocol/inspector` maintainers
+
+**Long-term:** Consider replacing deprecated dependencies:
+
+- Replace `clean-webpack-plugin` with native `fs.rmSync`
+- Replace `terminal-image` with modern alternative
+- Make `@modelcontextprotocol/inspector` truly optional
+
+## Quick Wins
+
+1. **Update `del` in `@kya-os/mcp-i`** - Latest version may use newer `rimraf`
+2. **Update `clean-webpack-plugin`** - Latest version may have fixed dependencies
+3. **Make `terminal-image` optional** - Only install if needed for avatar display

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/create-mcpi-app",
-  "version": "1.7.38-canary.0",
+  "version": "1.7.38-canary.1",
   "description": "Bootstrap MCP applications with identity features",
   "type": "module",
   "main": "dist/index.js",
@@ -35,9 +35,13 @@
     "commander": "^11.1.0",
     "fs-extra": "^11.2.0",
     "inquirer": "^12.9.4",
+    "node-fetch": "^3.3.2",
     "ora": "^8.0.1",
     "zod": "^3.25.76"
   },
+  "_comment": {
+    "node-fetch": "Required by @kya-os/cli-effects (transitive dependency). cli-effects imports node-fetch but doesn't declare it. TODO: Update cli-effects to declare node-fetch or use native fetch (Node 20+)."
+  },
   "devDependencies": {
     "@kya-os/contracts": "^1.5.1",
     "@kya-os/mcp-i": "^1.5.5",