For an up-to-date overview on the TODOs see this wiki page on salsa: https://salsa.debian.org/js-team/node-yarnpkg/wikis/home
Thanks to the new embedding policy, I think it is feasible to complete the job for the buster release. I plan to resume working on it, any help welcome ! W.r.t. the previous time I looked (version 1.7.0) the dependencies have not changed much: - Upgraded and OK in Debian: - request, needs 2.87.0 while 2.88.0 is in Debian - Upgraded and must be upgraded in Debian: - inquirer: 3.3.0 -> 6.2.0 - tar-stream: 1.5.2 -> 1.6.0 - validate-npm-package-license: 3.0.1 -> 3.0.4 - New and not in Debian yet: - cli-table3 (Pretty unicode tables for the command line. Based on the original cli-table); we could use cli-table ... - hash-for-dep (generates a hash that represents a module and its depenencies uniqueness) - New and should be updated in Debian: - imports-loader: 0.7.1 -> 0.8.0 - ssri: 5.2.4 -> 5.3.0 While for the build dependencies: - Upgraded and must be upgraded in Debian: - execa: 0.10.0 -> 0.11.0 - fancy-log: 1.2.0 -> 1.3.2 - gulp: 3.9.1 -> 4.0.0 - Removed: - gulp-util - gulp-watch Paolo