Angular-cli: core-js 2 deprecated

[sam-s4s]

🐞 bug report

Is this a regression?

Yes and no - it's the underlying npm dependencies that have changed to cause this problem, not angular itself.

(problem was not present on the 20th of December, for example)

Description

When creating a new angular package, or doing an npm install, we now receive a warning that core-js 2 is deprecated and we should be using 3.

🔬 Minimal Reproduction

ng new
(create a new angular 8 project)

🔥 Exception or Error

npm WARN deprecated [email protected]: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.

🌍 Your Environment

Angular Version:

Angular CLI: 8.3.21
Node: 10.15.1
OS: win32 x64
Angular: 8.2.14
... animations, common, compiler, compiler-cli, core, forms
... language-service, platform-browser, platform-browser-dynamic
... router

Package                           Version
-----------------------------------------------------------
@angular-devkit/architect         0.803.21
@angular-devkit/build-angular     0.803.21
@angular-devkit/build-optimizer   0.803.21
@angular-devkit/build-webpack     0.803.21
@angular-devkit/core              8.3.21
@angular-devkit/schematics        8.3.21
@angular/cli                      8.3.21
@ngtools/webpack                  8.3.21
@schematics/angular               8.3.21
@schematics/update                0.803.21
rxjs                              6.4.0
typescript                        3.5.3
webpack                           4.39.2

Additional comments:

We might need a new version of angular 8 to fix this problem (8.2.15)

[alfaproject]

Angular 8 doesn't require core-js. If you do then you can update it yourself, if you don't then you can remove it.

[internalsystemerror]

Yarn gives a bit more info

warning @angular-devkit/build-angular > istanbul-instrumenter-loader > istanbul-lib-instrument > babel-generator > babel-runtime > [email protected]: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.

[sam-s4s]

@alfaproject yes, this is from a project that does not have core-js as a dependency. As @internalsystemerror points out, it's part of angular.

Though possible this is more of a cli issue, given the @angular-devkit/build-angular package...

[bmarcotte]

After looking into this a bit, it seems like the underlying issue is that @angular-devkit/build-angular should probably find a way to avoid using istanbul-instrumenter-loader if possible. That package has not seen a release for 2 years, and has a dependency on a version of istanbul-lib-instrument that dates back to June 2017 (v1.7.3 vs v4.0.0 released just a few days ago). The loader package is just a very thin wrapper around createInstrumenter:
https://github.com/webpack-contrib/istanbul-instrumenter-loader/blob/master/src/index.js
If we could find a way to do the equivalent of that directly within @angular-devkit/build-angular without pulling in istanbul-instrumenter-loader, we would avoid the core-js@2 issue, and likely many other outdated dependency issues, entirely.

[angular-automatic-lock-bot[bot]]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{_This action has been performed automatically by a bot._}