Is this still maintained?

[tomodachi94]

Hi, is this still maintained? I noticed that there are open PRs for a potentially vulnerable dependency, (see first comment, this is a non-issue) as well as no commits in 10 months.

[vweevers]

Is this still maintained?

Very lightly. It's stable and does not need new features. Several of the contributors prefer prebuildify & node-gyp-build.

IMO it's time to deprecate prebuild and prebuild-install. We can't guarantee that these tools will continue to work across node and npm releases (and in fact there will be breakage in npm 12). In addition, these older tools don't fit well in the new world of trusted publishing and attestation.

@prebuild/builders Anyone opposed to deprecating the npm packages?

I noticed that there are open PRs for a potentially vulnerable dependency

If they mattered we would have likely given them attention. The range ^2.0.0 already includes the fixed version. So the action item is for people to update their package lockfile.

[lovell]

I am in support of deprecating prebuild and prebuild-install. These tools served their purpose brilliantly for many years, however package managers have recently improved support for installation of platform-specific packages. I'd personally like to thank everyone involved in the prebuild org for all their time spent helping to maintain it.

[lovell]

In terms of possible impact of deprecation, the top 10 most downloaded packages with a dependency on prebuild-install are currently:

$ npx github:Fuzzyma/e18e-tools prebuild-install -n 10 -U https://npm.devminer.xyz/registry
Package Info:
Name: prebuild-install (7.1.3)
Homepage: https://github.com/prebuild/prebuild-install
Unpacked Size: 11.28 KB
✔ Fetched 565 dependents.

Dependents sorted by downloads:
 #1   16.12M ⬇️ , 181.79 GB - canvas           ^7.1.3 https://npmjs.com/canvas
 #2    7.14M ⬇️ ,  80.50 GB - better-sqlite3   ^7.1.1 https://npmjs.com/better-sqlite3
 #3    6.77M ⬇️ ,  76.31 GB - sqlite3          ^7.1.1 https://npmjs.com/sqlite3
 #4    3.71M ⬇️ ,  41.87 GB - keytar           ^7.0.1 https://npmjs.com/keytar
 #5    1.25M ⬇️ ,  14.12 GB - isolated-vm      ^7.1.3 https://npmjs.com/isolated-vm
 #6    1.00M ⬇️ ,  11.31 GB - pkg              7.1.1  https://npmjs.com/pkg
 #7  942.48k ⬇️ ,  10.63 GB - @mongodb-js/zstd ^7.1.3 https://npmjs.com/@mongodb-js/zstd
 #8  822.01k ⬇️ ,   9.27 GB - gl               ^7.1.2 https://npmjs.com/gl
 #9  749.06k ⬇️ ,   8.45 GB - kerberos         ^7.1.2 https://npmjs.com/kerberos
 #10 741.49k ⬇️ ,   8.36 GB - libxmljs2        ^7.1.3 https://npmjs.com/libxmljs2

[vweevers]

We could start with deprecating only prebuild as a signal to package authors, who then get a chance to object and take over maintenance if they want.

[mmomtchev]

Just a heads up that I maintain an up-to-date @mmomtchev/prebuild-install as part of the hadron build system for C++ npm packages. I have added almost no new features besides the double environment support - it can download two modules - native and WASM. I intend to keep maintaining it since the hadron projects have huge binaries, including many platforms and WASM, and are ill-suited for the newer generation of tools which bundle all the prebuilt binaries in the npm package itself.