fix: bump archiver ^7 -> ^8 to drop deprecated glob@10

[AnujVishwakarma-src]

Problem

glob@10.5.0 is the last npm warn deprecated line on npm install -g @adobe/aio-cli (blocks the zero-deprecation goal, APPBLD-5004). It enters the tree via archiver@7 → archiver-utils@5.0.2 → glob@^10. archiver-utils@5.0.2 is the latest and hard-pins glob ^10; glob is non-deprecated only at 13+. A root npm override does not reach end users (verified: npm i -g treats aio-cli as a dependency, so its overrides are ignored, and npm strips the shipped lockfile). The fix has to be a real dependency change that propagates.

Change

Bump archiver ^7 → ^8. archiver@8 drops archiver-utils and glob entirely (uses readdir-glob/tar-stream/zip-stream), removing the deprecation at the source.

archiver@8 is ESM-only and exposes a class API instead of a factory. zip() now:

• loads it lazily via const { ZipArchive } = await import('archiver') (keeps this module CommonJS),
• constructs with new ZipArchive({ zlib: { level: 9 } }) instead of archiver('zip', { ... }).

The instance API (pipe/directory/file/on/finalize) is unchanged. The sole caller (build-actions.js) already awaits zip().

Tests: the archiver mock is converted to the class shape (ZipArchive) and registered via jest.unstable_mockModule; unit-tests runs with NODE_OPTIONS=--experimental-vm-modules (added cross-env for cross-platform).

Validation

• 462 tests pass, 100% coverage, eslint clean.
• Verified on Node 20.17, 22.9 (unit suite green on each).
• Real zip() round-trip with archiver@8 produces a valid archive (verified entries via unzip -l).
• npm ls glob no longer shows glob@10 from the archiver path.

---

Real-app linked E2E (2026-09-28)

Beyond unit tests, validated zip() through the actual CLI: packed this branch, installed it into a linked aio-cli-plugin-app (so @adobe/aio-lib-runtime@7.5.0 → archiver@8.0.0), linked into global aio, and ran against a real App Builder project (authenticated, Stage workspace):

• aio app build → runs zip() (archiver@8) to zip every action build dir → ✅ built all actions across 3 extensions.
• zip artifacts → valid archives (verified via unzip -l; e.g. worker.zip 2 files/~20MB, generic.zip, publish-events.zip).
• aio app deploy → deployed the archiver@8-built zips to the live Stage runtime → ✅ Successful deployment.

No ERR_REQUIRE_ESM / constructor errors anywhere.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!