Unable to upgrade + Incorrect delegation of responsibility - "Browserslist: caniuse-lite is outdated. Please run: npx browserslist@latest --update-db"

Browserslist is not my own dependency. In fact:

> yarn why browserslist
yarn why v1.22.4
[1/4] Why do we have the module "browserslist"...?
[2/4] Initialising dependency graph...
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "browserslist@4.16.6"
info Reasons this module exists
   - "_project_#webpack" depends on it
   - Hoisted from "_project_#webpack#browserslist"
   - Hoisted from "_project_#@babel#core#@babel#helper-compilation-targets#browserslist"
   - Hoisted from "_project_#@babel#preset-env#core-js-compat#browserslist"

When trying to update, as expected, I am told that I don’t have it:

> npx browserslist@latest --update-db
Need to install the following packages:
  browserslist@latest
Ok to proceed? (y)

If I confirm, it still does nothing (probably because I don’t have a direct dependency on caniuse-lite either):

Browserslist: caniuse-lite is outdated. Please run:
npx browserslist@latest --update-db

Why you should do it regularly:
https://github.com/browserslist/browserslist#browsers-data-updating
Latest version:     1.0.30001286
Installed version:  none
Removing old caniuse-lite from lock file
Installing new caniuse-lite version
$ yarn add -W caniuse-lite
(other dependency's warnings omitted here)
Cleaning package.json dependencies from caniuse-lite
$ yarn remove -W caniuse-lite
(other dependency's warnings omitted here)
caniuse-lite has been successfully updated
Browserslist: caniuse-lite is outdated. Please run:
npx browserslist@latest --update-db

Why you should do it regularly:
https://github.com/browserslist/browserslist#browsers-data-updating

No target browser changes

Not sure if you can fix this?

(It does not seem ideal to have unfixable warnings and no-op recommendations thrown around by third-party dependencies)

[Domiii]

@ai It is not possible to upgrade indirect dependencies, as explained here.

There are two really bad alternative solutions here:

• Either manually modify yarn.lock. This comment explains why that is a terrible idea.
• Install it as a direct dependency. But that significantly increases the potential for diamond dependency conflicts.

Can you PLEASE add a way to just update the database file without having to mess with dependencies?

FYI: You might wonder why is this so important to us – Having to sift through literally dozens of these pointless warning messages when working in certain CLI environments is really quite troublesome. It is causing quite the headache.

[BillyWM]

The developer’s attitude here is very disappointing; it’s patronizingly paternalistic to tell people that they can’t be trusted to build software in a certain manner and you need to save them from themselves and in the process heroically save the web itself.

…and weirder still he himself added a silence option back in 2019. I tracked it down manually and I’m just sharing it here. In the node.js file:

  oldDataWarning: function oldDataWarning (agentsObj) {
    if (dataTimeChecked) return
    dataTimeChecked = true
    if (process.env.BROWSERSLIST_IGNORE_OLD_DATA) return

    var latest = latestReleaseTime(agentsObj)
    var halfYearAgo = Date.now() - TIME_TO_UPDATE_CANIUSE

    if (latest !== 0 && latest < halfYearAgo) {
      console.warn(
        'Browserslist: caniuse-lite is outdated. Please run:\n' +
        'npx browserslist@latest --update-db\n' +
        '\n' +
        'Why you should do it regularly:\n' +
        'https://github.com/browserslist/browserslist#browsers-data-updating'
      )
    }

Therefore you can set a property in your environment variables (process.env) which will silence the warning:

process.env['BROWSERSLIST_IGNORE_OLD_DATA'] = true;

(or whichever method is relevant to your project, e.g. the dotenv pattern etc)

At the very least this warning should provide some guidance on how to perform the upgrade when this is a nested dependency, as it will be probably most of the time, since it’s used by Babel (and thereby most React devs)