fix: consume ESM generators + archiver@8 to clear npm install deprecations

[AnujVishwakarma-src]

Goal

Close out the npm install -g @adobe/aio-cli deprecation cleanup (APPBLD-5004 / APPBLD-4501) by consuming the released fixes across the plugin + generator tree, and verify zero npm warn deprecated on Node 20/22/24.

Change

Regenerates the committed package-lock.json (which npm i -g resolves from) to pick up:

• @adobe/aio-cli-plugin-app 14.10.0 — ESM generator loads, yeoman-environment 6, archiver 8
• @adobe/aio-lib-runtime 7.5.0 — archiver 8
• @adobe/generator-aio-app 10.1.0 + the ESM generator fleet (yeoman-generator 7)
• @adobe/aio-cli-plugin-console 5.4.4, @adobe/aio-cli-plugin-app-templates 2.1.4

Also:

• Removes now-redundant overrides (tar, @yeoman/conflicter) — bin/check-overrides.js reports them removable (the tree resolves patched tar and clean glob on its own); keeps @octokit/rest.
• Raises engines.node >=20 → >=20.17.0 to match the dependency tree (yeoman-environment 6).
• README version links refreshed (surgical: only the changed plugin versions).

Verification — real npm install -g (packed tarball, standalone Node)

Node	npm warn deprecated
22.9.0	0
24.10.0	0
20.17.0	0

• The whole generator/tar/glob cluster is gone: glob@7/8/10, npmlog, gauge, inflight, rimraf, are-we-there-yet, @npmcli/move-file, read-package-json, tar@6.2.1.
• Tree now resolves glob@13.0.6 only and tar@7.5.22 (patched). npm audit: 🔴 critical 0.
• In-repo: 53 tests pass, lint clean, prepack (check-overrides + oclif) clean.

---

Full validation report (pre-merge)

1. Static / in-repo (PR branch)

Check	Result
npm test	✅ 53 tests pass, 7 suites
npm run lint	✅ clean
npm run prepack (check-overrides + oclif)	✅ clean — only @octokit/rest kept, no removable overrides
npm run e2e (e2e.js)	✅ 2/2 pass — fixed a stale --no-extensions flag → --standalone-app (renamed in plugin-app 14.x, which this PR consumes)
CI (Node 20/22/24 × ubuntu/windows)	✅ all green

2. Before / after — deprecation & vulnerability diff (real npm install -g)

Severity legend: 🔴 critical · 🟠 high · 🟡 moderate · ⚪ low

Per-Node results (Before = old plugin-app 14.7.0 · After = plugin-app 14.10.0):

Node	npm warn deprecated	npm audit
20.17.0	❌ 40 → ✅ 0	🔴 1 crit · 🟠 16 high → ✅ 🔴 0 crit · 🟠 1 high
22.9.0	❌ 39 → ✅ 0	🔴 1 crit · 🟠 16 high → ✅ 🔴 0 crit · 🟠 1 high
24.10.0	❌ 39 → ✅ 0	🔴 1 crit · 🟠 16 high → ✅ 🔴 0 crit · 🟠 1 high

Package-level detail (consistent across all three Node versions):

	Before (old plugin tree, plugin-app 14.7.0)	After (current, plugin-app 14.10.0)
npm warn deprecated lines	❌ 40 (~15 pkgs)	✅ 0 (Node 20/22/24)
distinct deprecated pkgs	❌ glob, rimraf, npmlog, gauge, are-we-there-yet, @npmcli/move-file, tar, readdir-scoped-modules, read-package-json, inflight, fstream, debuglog, clone-buffer	✅ — (all cleared)
tar	🔴 6.2.1 — CRITICAL (GHSA-23hp)	✅ 7.5.22 (patched)
glob	⚠️ 7 / 8 / 10.5 (deprecated)	✅ 13.0.6 (clean)
npm audit	🔴 1 critical · 🟠 16 high	✅ 🔴 0 critical · 🟠 1 high

The entire generator/tar/glob deprecation cluster is gone.

🟠 The remaining 1 high is tmp@0.0.33 via @inquirer/prompts → @inquirer/editor → external-editor@3.1.0 (which hard-pins the old tmp). It is pre-existing and unrelated to this PR (present in the "before" tree too), and npm audit reports fixAvailable: false — there is no npm-installable fix; it requires an upstream bump of external-editor/tmp in the inquirer chain. The archiver/generator/ims work in this epic already cleared 15 of the original 16 highs.

Note: npm i -g floats the caret ranges (the published tarball ships no lockfile), so the deprecation fix already reaches users via the published plugin releases. This PR keeps the committed lockfile, overrides, and engines consistent with that fixed tree, and fixes the e2e flag.

2b. Named security advisories cleared (IOEXT-1848)

IOEXT-1848 tracked 8 named advisories on aio-cli. All are resolved in the consumed tree (tar@6.2.1 → tar@7.5.22, yeoman-environment@4 → 6):

GHSA	Advisory	Was (11.1.2)	Now
GHSA-3ppc-4f35-3m26	minimatch ReDoS	resolved	✅
GHSA-5j98-mcp5-4vw2	glob CLI command injection	resolved	✅
GHSA-r6q2-hw4h-h46w	node-tar race condition	🟠 present	✅ cleared
GHSA-34x7-hfp2-rc4v	node-tar hardlink path traversal	🟠 present	✅ cleared
GHSA-8qq5-rm4j-mr97	node-tar symlink poisoning	🟠 present	✅ cleared
GHSA-83g3-92jg-28cx	node-tar hardlink escape via symlink chain	🟠 present	✅ cleared
GHSA-qffp-2rhf-9h96	node-tar drive-relative linkpath traversal	🟠 present	✅ cleared
GHSA-9ppj-qmqm-q256	node-tar symlink drive-relative linkpath	🟠 present	✅ cleared

Verified via npm audit against the current @adobe/aio-cli-plugin-app@14.10.0 tree: tar@6.2.1 is gone (only tar@7.5.22), and none of the 8 advisory IDs appear.

3. Real-app command E2E (authenticated, deployed to Stage)

Linked the released plugins (aio plugins link): aio-cli-plugin-app@14.10.0 (archiver 8, aio-lib-runtime@7.5.0), aio-cli-plugin-app-templates@2.1.4.

New app (aio app init): build (2 actions) ✅ · pack → valid app.zip (35 files) ✅ · deploy → Successful deployment ✅ · add extension dx/excshell/1 → generator-app-excshell@3.1.0 (ESM) scaffolded ✅

Existing app (real Stage workspace): build ✅ · pack ✅ · deploy → Successful deployment ✅ · aio --version / app --help (plugin load) / app info ✅

No ERR_REQUIRE_ESM / constructor errors on any path. Both archiver@8 zip paths (plugin-app zipHelper, runtime zip) produce valid, deployable artifacts.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!