[Bug]: @storybook/react-docgen-typescript-plugin uses deprecated version of rimraf

[heath-freenome]

Describe the bug

I am trying to remove all deprecations from my npm installed libraries and the only one left is caused by @storybook/react-docgen-typescript-plugin.

Here are the deprecated modules:

npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported

An npm list @inflight@1.0.6 shows this hierarchy:

npm list inflight@1.0.6
MY REPO
└─┬ @storybook/nextjs@10.0.8
  └─┬ @storybook/preset-react-webpack@10.0.8
    └─┬ @storybook/react-docgen-typescript-plugin@1.0.6--canary.9.0c3f3b7.0
      └─┬ flat-cache@3.2.0
        └─┬ rimraf@3.0.2
          └─┬ glob@7.2.3
            └── inflight@1.0.6

Reproduction link

N/a

Reproduction steps

Even running npx storybook@latest info highlights the issue:

npx storybook@latest info
Need to install the following packages:
storybook@10.0.8
Ok to proceed? (y) y

npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated rimraf@2.6.3: Rimraf versions prior to v4 are no longer supported
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported

System

Storybook Environment Info:

  System:
    OS: macOS 26.1
    CPU: (12) arm64 Apple M2 Pro
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 22.21.0 - MY USER/.nvm/versions/node/v22.21.0/bin/node
    npm: 10.9.4 - MY USER/.nvm/versions/node/v22.21.0/bin/npm <----- active
    pnpm: 10.1.0 - /opt/homebrew/bin/pnpm
  Browsers:
    Chrome: 142.0.7444.60
    Safari: 26.1
  npmPackages:
    @storybook/addon-a11y: 10.0.8 => 10.0.7 
    @storybook/addon-docs: 10.0.8 => 10.0.7 
    @storybook/nextjs: 10.0.8 => 10.0.7 
    storybook: 10.0.8 => 10.0.7

Additional context

No response

[dosubot]

Hi @heath-freenome! I'm Dosu and I’m helping the storybook team.

The deprecated rimraf, inflight, and glob packages are present due to transitive dependencies in @storybook/react-docgen-typescript-plugin, specifically through flat-cache. These versions are still used in the latest Storybook 10.x releases, and there is currently no direct way to update or remove them from your project, as they are locked by upstream dependencies in the Storybook ecosystem. Recent updates and migration guides do not mention a fix for these deprecations yet, and upgrading to the latest Storybook version may not resolve the warnings at this time [source].

If you want to minimize these warnings, keep your Storybook packages up to date and monitor future releases for dependency refreshes. For now, these warnings are safe to ignore unless they block your workflow. If you need a minimal reproduction or want to track progress, you can follow the changelogs and migration notes for updates [source].

Let me know if you need help with a workaround or want to explore alternatives for your setup.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[heath-freenome]

@dosu The latest version of flat-cache is 6 and the storybook code is using v3. Can't they just upgrade?

[dosubot]

Upgrading flat-cache in @storybook/react-docgen-typescript-plugin from v3 to v4 (or higher) would remove the deprecated rimraf, glob, and inflight dependencies and resolve those warnings. However, the plugin currently pins flat-cache to ^3.0.4, and there’s no evidence that Storybook or the plugin maintainers have updated it to v6 yet. Any upgrade would need to happen in the plugin itself, not in Storybook’s main repo, and may require compatibility testing for breaking changes in flat-cache v4–v6 before it can be safely adopted.

As a temporary workaround, some users have used package manager overrides to force flat-cache to v4+, which removes the deprecation warnings, but this isn’t officially supported and could have side effects. For a permanent fix, the plugin would need to bump its flat-cache dependency and release a new version.

References:

• Dependency chain and current version
• Discussion and workaround

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}