fix: bump archiver ^6 -> ^7 to drop deprecated inflight (APPBLD-4614)

[AnujVishwakarma-src]

What & why

Fixes APPBLD-4614 — clean up npm warn deprecated from @adobe/aio-lib-runtime.

Bumps archiver ^6.0.1 → ^7.0.1. archiver@6 pulls archiver-utils@4 → glob@8 → inflight@1.0.6 (deprecated). archiver@7 (via archiver-utils@5) drops the inflight dependency entirely.

archiver's public API used by src/utils.js (archiver('zip', { zlib }), .directory, .file, .finalize) is unchanged between v6 and v7; v7's only breaking change is dropping Node < 18 (this package requires >=20).

Why not archiver@8?

archiver@8 is ESM-only ("type": "module", import { ZipArchive } from "archiver"). Adopting it in this CommonJS package would force a full ESM migration (out of scope here). archiver@7 is the CJS-safe ceiling.

Note on the remaining glob

archiver@7 still resolves a deprecated glob@10 transitively (archiver-utils@5 pins glob@^10; only glob 12/13 are non-deprecated). That is closed separately by a scoped overrides: { "archiver-utils": { "glob": "^13" } } at the aio-cli install root — npm overrides are only honored from the root project, so it cannot live in this library. Tracked as a follow-up.

Before / after (real npm install warnings, this package as a dependency)

Before (@adobe/aio-lib-runtime@7.4.0):

npm warn deprecated glob@8.1.0: Old versions of glob are not supported ...
npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory ...

After (this branch):

(no inflight warning)
npm warn deprecated glob@10.5.0: ...   # closed at aio-cli root via scoped override

→ inflight eliminated from the archiver path.

Validation

• ✅ npm test — 462 unit tests pass, lint clean
• ✅ Real-archiver@7 zip smoke test (directory + file entries) produces a valid archive
• ✅ Downstream consumer @adobe/aio-cli-plugin-runtime — 1002 tests pass with this build linked in (no regressions)
• ⚠️ e2e requires live OpenWhisk credentials (RuntimeAPI_API_KEY, RuntimeAPI_NAMESPACE) and was not run locally

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[AnujVishwakarma-src]

✅ E2E validation with archiver@7 (real zip path) — 11/11 passing

CI mocks archiver, so the real action-zipping path (buildActions → archiver) is only exercised by the e2e suite, which does not run in CI. I validated it manually against a live Adobe I/O Runtime stage namespace with archiver@7.0.1 installed.

Setup: clean 7.4.1 baseline + npm i archiver@^7.0.1 --no-save, then npm run e2e (real build → deploy → invoke → undeploy, real triggers).

Result: Test Suites: 1 passed · Tests: 11 passed (~101s)

build, deploy, invoke and undeploy of actions
  ✓ basic manifest (28.7s)              # real zip + deploy + invoke + undeploy
  ✓ manifest with includes (8.6s)
  ✓ manifest with default package (6.0s)
  ✓ basic manifest with filter (8.3s)
print logs
  ✓ basic (1.3s)
trigger
  ✓ delete non-existing / basic / feed alarm / feed once
filter manifest based on built actions
  ✓ it should build & deploy just one of two (20.8s)

The archiver ^6 → ^7 bump produces valid action .zips that deploy and invoke successfully end-to-end on real Runtime — no behavioral regression in the zip path.

Note: the archiver-utils/glob dedupe is intentionally not in this PR — npm overrides are root-only, so that closure belongs at the aio-cli root, not here.

[AnujVishwakarma-src]

Major bump (archiver ^6 → ^7) — API-stability + downstream validation

Thanks for flagging the major bump. Here's how we've ensured the change is safe for this library and every workflow that depends on it.

1. The API surface we use is unchanged in v7

aio-lib-runtime uses only the stable core archiver API (src/utils.js:466–476):

const archive = archiver('zip', { zlib: { level: 9 } })
archive.pipe(stream); archive.on('error', …)
archive.directory(filePath, pathInZip)   // or
archive.file(filePath, { name })
archive.finalize()

archiver@7's breaking changes are only: (i) a raised Node engine (we target Node 18+), and (ii) removal of the long-deprecated bulk() method — which we don't use. None of the methods above changed between v6 and v7.

2. Validated at the artifact level (not just mocked units)

• ✅ Unit tests + lint pass.
• ✅ e2e on a live stage namespace: 11/11 — real archiver@7 produces actual action .zips that deploy + invoke on Adobe I/O Runtime. A malformed archive would fail deploy/invoke.
• ✅ Round-trip: archiver@7 zip → unzip → byte-identical content.

3. Downstream consumers of aio-lib-runtime

Consumers and their status against the patched build (packed via npm pack, installed into each):

Consumer	Range	Result
aio-cli-plugin-app	^7	✅ validated (archiver@7 + unzipper@0.12) in adobe/aio-cli-plugin-app#932 — build/deploy smoke + suite
aio-cli-plugin-runtime	^7.4.0	✅ patched build installs with no dependency conflict; archiver resolves to 7.0.1 in its tree; real zip round-trip through the consumer-resolved archiver@7 passes
aio-cli-plugin-asset-compute	^5.0.0	⏭️ out of scope — pinned to aio-lib-runtime v5, so it does not receive this v7 change

4. Final gate

The release-train order (leaf → plugins → root) ends with an integration check (APPBLD-5004): npm install -g @adobe/aio-cli on Node 20/22/24 + a real aio app build && aio app deploy, which drives archiver@7 end-to-end through the CLI.

Net: the bump is API-compatible for our usage, proven at the artifact level, and verified across all in-scope consumers.