No deprecated dependencies

Deprecated packages signal that the maintainer has abandoned the library and will not ship security patches. OWASP A06 (Vulnerable and Outdated Components) identifies unmaintained dependencies as a primary attack vector — CWE-1104 and CWE-1357 classify this as a supply-chain defect. A package like request (deprecated 2020) or moment (maintenance-mode, bloated, no new security releases) is a liability: any vulnerability discovered in it will not receive a fix, leaving the codebase permanently exposed.

Replace deprecated packages with their maintained alternatives. Common migrations:

# Remove deprecated request package (use native fetch, Node.js 18+)
npm uninstall request

# Migrate from moment to date-fns
npm uninstall moment
npm install date-fns

# Migrate from babel-eslint to @typescript-eslint/parser
npm uninstall babel-eslint
npm install -D @typescript-eslint/parser @typescript-eslint/eslint-plugin

# Migrate from node-uuid to uuid
npm uninstall node-uuid
npm install uuid

Run npm outdated to surface packages that haven't received a release in an extended period.