Context

Downstream consumer here (wpapi@1.2.2, the current npm latest). Installing this package with npm 12 prints deprecation warnings for transitive dependencies that wpapi pins.

What npm prints

npm warn deprecated formidable@1.2.6: Please upgrade to latest, formidable@v2 or formidable@v3!
npm warn deprecated superagent@4.1.0: Please upgrade to superagent v10.2.2+, see release notes at https://github.com/forwardemail/superagent/releases/tag/v10.2.2

Tree:

wpapi@1.2.2
└── superagent@4.1.0
    └── formidable@1.2.6

package.json on 1.2.2 has "superagent": "^4.0.0". 2.0.0-alpha.1 still has "superagent": "^4.1.0" and "parse-link-header": "^1.0.1".

parse-link-header@^1 is also flagged by npm audit (uncontrolled resource consumption). That part is already tracked in #500.

Desired resolution

1. Bump superagent to ^10.2.2 (or at least the current maintained line). That drops formidable@1 in favor of v2/v3, which is what both deprecation notices ask for.
2. Bump parse-link-header to ^2.0.0 (see parse-link-header < 2.0.0 is vulnerable (CVE-2021-23490) #500) in the same release if the Link header parsing still matches.
3. Publish a stable release (1.2.3 or 2.0.0) so npm latest is no longer the 2022 1.2.2 tarball. The alpha still carries the same Superagent 4 pin, so it does not clear the warning for latest consumers.

Related: #500, #506.

Happy to test a pre-release against WordPress REST pagination and media upload if that helps.