outdated dependencies

[mahmoudimus]

When installing pi-cursor-sdk, I get these warnings:

npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated gauge@4.0.4: This package is no longer supported.
npm warn deprecated are-we-there-yet@3.0.1: This package is no longer supported.
npm warn deprecated @npmcli/move-file@1.1.2: This functionality has been moved to @npmcli/fs
npm warn deprecated npmlog@6.0.2: This package is no longer supported.
npm warn deprecated tar@6.2.1: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me

Would you like me to update the dependencies?

[fitchmultz]

Validated against the published pi-cursor-sdk@0.1.29 in a clean temp npm project.

Repro:

mkdir /tmp/pi-cursor-sdk-issue115 && cd /tmp/pi-cursor-sdk-issue115
npm init -y
npm install pi-cursor-sdk@0.1.29
npm ls sqlite3 node-gyp tar glob inflight rimraf gauge are-we-there-yet @npmcli/move-file npmlog --all

Result: the install warnings reproduce. The warning source is not this package's direct runtime deps; it is the Cursor SDK's sqlite dependency chain:

pi-cursor-sdk@0.1.29
└─ @cursor/sdk@1.0.17
   └─ sqlite3@5.1.7
      └─ node-gyp@8.4.1
         ├─ glob@7.2.3 -> inflight@1.0.6
         ├─ make-fetch-happen@9.1.0 -> cacache@15.3.0 -> @npmcli/move-file@1.1.2 / rimraf@3.0.2 / tar@6.2.1
         └─ npmlog@6.0.2 -> are-we-there-yet@3.0.1 / gauge@4.0.4

Also checked @cursor/sdk@latest; latest is still 1.0.17 and still declares sqlite3: ^5.1.7.

Repo-local note: this repo has a root overrides.sqlite3 = 6.0.1, so maintainer installs resolve to the newer sqlite3@6.0.1 / node-gyp@12 chain. That does not fix consumer installs because npm overrides are root-project-only and are not applied transitively from this published package.

Triage: confirmed, but blocked on upstream @cursor/sdk moving off sqlite3@^5.1.7 (or on users adding their own root override). npm outdated in this repo currently only reports minor dev updates (typebox, vitest), which do not address these install warnings.

[fitchmultz]

PR opened with the repo-owned mitigation/documentation: #116

What changed:

• The README now documents that these install warnings come from the closed-source @cursor/sdk@1.0.17 -> sqlite3@^5.1.7 -> node-gyp@8 dependency chain.
• It explains why pi-cursor-sdk cannot force npm overrides into consumer installs: overrides are root-project-only and are not applied transitively from this published package.
• It documents the practical workaround for users who install from a root package.json they control: add a root-level "overrides": { "sqlite3": "6.0.1" }, matching this repo's maintainer install mitigation.
• No vendoring/forking of the Cursor SDK and no hidden unsupported transitive override behavior was added.

Validation on the PR branch:

• npm run verify passed.
• npm pack --dry-run passed for pi-cursor-sdk@0.1.30.
• Crabbox macOS + Ubuntu platform suites passed from the full matrix run.
• Crabbox Windows native was rerun after cleaning an orphaned clone and passed platform-build, native visual matrix, bridge visual matrix, abort cleanup, and lease cleanup with ok=true summaries.

[fitchmultz]

Released the repo-owned mitigation in pi-cursor-sdk@0.1.30: https://github.com/fitchmultz/pi-cursor-sdk/releases/tag/v0.1.30

Post-release verification:

• npm view pi-cursor-sdk version dist-tags.latest --json reports 0.1.30.
• pi install -l npm:pi-cursor-sdk@0.1.30 works and pi --list-models cursor discovers the provider.
• pi install -l https://github.com/fitchmultz/pi-cursor-sdk works and reports package version 0.1.30.

This issue remains open/blocked because the deprecated install warnings still come from the closed-source @cursor/sdk -> sqlite3@5.1.x chain and cannot be eliminated from this package without unsafe vendoring/forking or relying on unsupported transitive npm overrides. The README now documents the boundary and the root-project override workaround for users who control their own root package.json.