Skip to content

chore: avoid deprecation warning#1793

Closed
homura wants to merge 1 commit intonode-fetch:2.xfrom
homura:2.7
Closed

chore: avoid deprecation warning#1793
homura wants to merge 1 commit intonode-fetch:2.xfrom
homura:2.7

Conversation

@homura
Copy link
Copy Markdown

@homura homura commented Dec 4, 2023

Purpose

NodeJS 21 warns that the punycode is deprecated. The [email protected] dependent by node-fetch depends on the deprecated punycode, therefore, it is better to upgrade the whatwg-url to the latest one

jsdom/whatwg-url#261

To reproduce it, try the below piece example

const fetch = require('node-fetch') // 2.7.0

fetch('https://jsonplaceholder.typicode.com/todos/1')
      .then(response => response.json())
      .then(json => console.log(json))
➜  node-fetch git:(2.7) ✗ node x.js
(node:4461) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
{ userId: 1, id: 1, title: 'delectus aut autem', completed: false }

Changes

Upgrade whatwg-url to the latest

@jimmywarting
Copy link
Copy Markdown
Collaborator

Uhm, sry... we can't
whatwg-url@14 requires NodeJS v18

where as [email protected] still has backwards compatible all the way back to NodeJS v4

[email protected] is currently locked to only receiving bug/security fixes.


Your option is either to update to node-fetch@3 or using the new built-in fetch from NodeJS themself now that it's shipped with NodeJS v18+

@rlindner81
Copy link
Copy Markdown

Uhm, sry... we can't whatwg-url@14 requires NodeJS v18

where as [email protected] still has backwards compatible all the way back to NodeJS v4

[email protected] is currently locked to only receiving bug/security fixes.

Your option is either to update to node-fetch@3 or using the new built-in fetch from NodeJS themself now that it's shipped with NodeJS v18+

@jimmywarting I don't follow this logic. nodejs below v18 is out of maintenance.
https://nodejs.org/en/about/previous-releases

So, it clearly falls under "security fixes" to update [email protected] to at least nodejs v18... Our project, and I would expect the majority of others, uses commonjs and are locked into [email protected]. Unfortunately, the native fetch in nodejs v18 (or v20) is not really usable enough, when it comes to streaming to replace node-fetch.

@radist2s
Copy link
Copy Markdown

radist2s commented Aug 6, 2024

@rlindner81, I agree.

I guess I'm not the only one who's intimidated by the Node.js 22 warning:

(node:90843) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.

cjihrig added a commit to cjihrig/javascript that referenced this pull request Oct 18, 2024
The generated client on the release-1.x branch relies on the
[email protected] module, which depends on [email protected], which
uses the Node core punycode module. Node's punycode module was
runtime deprecated v21, which causes this module to print a
deprecation warning when used on newer versions of Node.

[email protected] stopped using punycode directly, but continued
to use it indirectly via its own tr46 dependency. The problematic
use of punycode was finally removed in [email protected].

node-fetch will not update its 2.x release line to incorporate the
fix due to backwards compatibility.

[email protected] claims backwards compatibility to Node v4, but the
fixed version of whatwg-url only claims compatibility back to
Node 12. For this reason, the node-fetch project has stated that
they will not address this issue. For reference, Node v4 went
EOL in 2018, and Node v12 when EOL in early 2022. Node 18 is
currently the oldest supported version, and Node v23 was released
this week.

Ideally, the generator will move to a newer version of node-fetch,
native fetch, or even the undici module that implements fetch in
core. Until that happens, this module can override whatwg-url
and silence the deprecation warning.

It's also worth noting that this punycode deprecation is not the
same one as the punycode deprecation on the master branch.

This change has been tested locally on v18.0.0.

Refs: nodejs/node#47202
Refs: node-fetch/node-fetch#1793
cjihrig added a commit to cjihrig/javascript that referenced this pull request Oct 18, 2024
The generated client on the release-1.x branch relies on the
[email protected] module, which depends on [email protected], which
uses the Node core punycode module. Node's punycode module was
runtime deprecated in v21, which causes this module to print a
deprecation warning when used on newer versions of Node.

[email protected] stopped using punycode directly, but continued
to use it indirectly via its own tr46 dependency. The problematic
use of punycode was finally removed in [email protected].

[email protected] claims backwards compatibility to Node v4, but the
fixed version of whatwg-url only claims compatibility back to
Node 12. For this reason, the node-fetch project has stated that
they will not address this issue. For reference, Node v4 went
EOL in 2018, and Node v12 when EOL in early 2022. Node 18 is
currently the oldest supported version, and Node v23 was released
this week.

Ideally, the generator will move to a newer version of node-fetch,
native fetch, or even the undici module that implements fetch in
core. Until that happens, this module can override whatwg-url
and silence the deprecation warning.

It's also worth noting that this punycode deprecation is not the
same one as the punycode deprecation on the master branch.

This change has been tested locally on v18.0.0.

Refs: nodejs/node#47202
Refs: node-fetch/node-fetch#1793
@tbroyer
Copy link
Copy Markdown

tbroyer commented Feb 10, 2025

punycode was removed from whatwg-url in v9, which is the version that dropped support for Node.js 10: https://github.com/jsdom/whatwg-url/releases/tag/v9.0.0

This means that node-fetch v2 could safely be updated to some version of whatwg-url between v9 and v12 (v13 being the one removing support for Node.js 14)

In the mean time, adding an override in my package.json (as many others have done already) does the job.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants