feat: exit on outdated create-react-app version

[mrmckeb]

Unfortunately this is a tricky problem. As @Timer pointed out, a global install catch would be triggered on npx and yarn create runs.

I couldn't find a way to determine if the user had initialised create-react-app with npx or yarn create specifically (although I was able to find out if they used yarn or npm) - but there may be a method I missed.

An alternative option is to use the command npm view create-react-app version - which returns the latest version as a string. This solution, however, is slow.

---

This PR:

• Resolves Add deprecation for global installs #7422
• Closes Add global deprecate warning on create-react-app package #7452

[mrmckeb]

Another alternative would be something like this, but it's still very slow.

let update = null;
https
  .get(
    'https://registry.npmjs.org/-/package/create-react-app/dist-tags',
    res => {
      if (res.statusCode === 200) {
        let body = '';
        res.on('data', data => (body += data));
        res.on('end', () => {
          const { latest } = JSON.parse(body);

          if (latest !== packageJson.version) {
            update = {
              current: packageJson.version,
              latest,
            };
          }

          createApp(
            projectName,
            program.verbose,
            program.scriptsVersion,
            program.template,
            program.useNpm,
            program.usePnp
          );
        });
      }
    }
  )
  .on('error', e => {
    // Handle error
  });

[ianschmitz]

An alternative option is to use the command npm view create-react-app version - which returns the latest version as a string. This solution, however, is slow.

This hasn't been my experience?

$ time npm view create-react-app version
3.4.1
npm view create-react-app version  0.45s user 0.08s system 89% cpu 0.590 total

[mrmckeb]

@ianschmitz That was the measurement I experienced.

Over a few checks, I found it was generally between 0.3-0.5s (from my location). I feel like that's a fairly large delay to introduce into CRA. It would mean the script would be idle for that amount of time.

If we hit NPM directly (via the API) as it eliminates the need to execute npm - which should mean it's a lot faster. In this case, I measure the operation consistently at around 0.2s.

Let's go with that approach?

Let me know and I can make the changes :)

[eddiemonge]

whats this one for? An extra new line?

[mrmckeb]

It's convention we use a lot in the CRA scripts - I don't love it, but I think it's always good to follow convention.

[iansu]

@mrmckeb I think checking npm directly is a better approach. The problem with update-notifier is that create-react-app isn't a command that gets run very often (in some cases anyway) so seeing the message the next time you run it isn't that helpful.

[ianschmitz]

We have to be careful of hitting npm directly IMO. Some folks may be required to use an in house registry proxy for example (npm could be firewall blocked), and we'd be bypassing that if we hardcore the registry URL here.

[mrmckeb]

OK, those changes have been made - thanks for the feedback!

[mrmckeb]

Merging in after discussion with @iansu.