@mapbox/node-pre-gyp@1.0.11 causes lots of deprecated warnings.

[JimmyBjorklund]

npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated npmlog@5.0.1: This package is no longer supported.
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated are-we-there-yet@2.0.0: This package is no longer supported.
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated gauge@3.0.2: This package is no longer supported.

[nassero]

bumping this. @mapbox/node-pre-gyp < 2.0 now has the following three CVEs due to its usage of an older version of node-tar:

CVE-2026-23950
CVE-2026-24842
CVE-2026-23745

any chance this can get updated?

[andyedwardsibm]

Add CVE-2026-26960 to the ever-expanding list of node-tar vulnerabilities. Looks like #462 has fixed it, so is there a timeframe for publishing version 1.17.0?