fix npm warnings

[AritraDey-Dev]

Description

This PR resolves npm warnings caused by deprecated [email protected] and [email protected] by overriding them.
few observations:

Before

$ npm explain inflight glob
[email protected]
node_modules/inflight
  inflight@"^1.0.4" from [email protected]
  node_modules/glob
    glob@"^7.2.0" from @babel/[email protected]
    node_modules/@babel/cli
      @babel/cli@"^7.23.0" from the root project
    glob@"^7.2.0" from [email protected]
    node_modules/svgstore-cli
      svgstore-cli@"^2.0.1" from the root project

[email protected]
node_modules/glob
  glob@"^7.2.0" from @babel/[email protected]
  node_modules/@babel/cli
    @babel/cli@"^7.23.0" from the root project
  glob@"^7.2.0" from [email protected]
  node_modules/svgstore-cli
    svgstore-cli@"^2.0.1" from the root project

Now (After the fix)

$  npm explain inflight glob
[email protected]
node_modules/glob
 overridden glob@"^10.0.0" (was "^7.2.0") from @babel/[email protected]
 node_modules/@babel/cli
   @babel/cli@"^7.27.2" from the root project
 overridden glob@"^10.0.0" (was "^7.2.0") from [email protected]
 node_modules/svgstore-cli
   svgstore-cli@"^2.0.1" from the root project

Fixes #16573

Reviewers

• Ambient
• Docs
• Installation
• Networking
• Performance and Scalability
• Extensions and Telemetry
• Security
• Test and Release
• User Experience
• Developer Infrastructure
• Localization/Translation

[dhawton]

Why not place the override directly in packages.json? I don't like having things be different in tests vs deployment.. they should be the same.

[AritraDey-Dev]

Why not place the override directly in packages.json? I don't like having things be different in tests vs deployment.. they should be the same.

Yes, my first thought was to do that in package.json itself. But there is no package.json in the project — it is created by the Makefile.core.mk here

istio.io/Makefile.core.mk

Line 140 in 95c8d11

@npm init -y

So if we need to make changes to package.json, we first need to create it and then apply the override.

[dhawton]

Might be worth changing... I don't like the thought of having production be different from dev. I'll defer to @craigbox here though as there are a number of plans he has for docs that I am not in the loop on.

[AritraDey-Dev]

yes i agree it’s better to have a consistent package.json checked into the project so it don’t have differences between dev and prod.