Transitive deprecated dependencies

[Yurickh]

http-server currently depends on http-encoding-sniffer@3.

http-encoding-sniffer@3 in turn, adds a deprecated dependency to the dependency chain, whatwg-encoding.

This dependency has been removed from http-encoding-sniffer since http-encoding-sniffer@5.

According to http-encoding-sniffer's changelogs, the only breaking change is dropping the support for node between 16-20.

Currently http-server supports node 16 though, so in order to bump http-encoding-sniffer, we'd have to release a major dropping that support as well.

[MikeMcC399]

I'm also seeing

(node:24489) [DEP0066] DeprecationWarning: OutgoingMessage.prototype._headers is deprecated

in Node.js 24.18.0.

However it looks like the npm package https://www.npmjs.com/package/http-server is no longer maintained, as the last release was 4 years ago, even though there continue to be PRs merged into the master branch.

[maw629]

Hi @MikeMcC399, I created a forked package from http-server and intend to keep it maintained.
If you have time, please check it out: https://www.npmjs.com/package/@pkg-nec/http-server
Latest version 14.3.1 is now free of package vulnerabilities and has the same logic as latest version of http-server

[MikeMcC399]

Thanks @maw629

Perhaps @KernelDeimos can give us some insight on the plans for this repo? There have been recent commits to the default branch, but no releases. Are there any plans for a new release, and if so, who has privileges for release?

$ npm owner ls http-server
indexzero <charlie.robbins@gmail.com>
bigbluehat <byoung@bigbluehat.com>
thornjad <jade@jmthornton.net>

@indexzero / @BigBlueHat / @thornjad may be able to say more.