[DEP0040] DeprecationWarning: The `punycode` module is deprecated

[asarkar]

Description:
Emits the following warning during set-up and post set-up steps:

(node:2563) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

Task version:
5

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Repro steps:
N/A

Expected behavior:
No warnings.

Actual behavior:
Warning shown.

[aparnajyothi-y]

Hello @asarkar, Thank you for creating this issue and we will look into it :)

[aparnajyothi-y]

Hello @asarkar, thanks for reporting this!

We’ve investigated the issue and found the cause: we recently upgraded setup-java’s runtime from Node 20 → Node 24. As per this documentation from node js, starting with Node 24, any code that loads the built-in punycode
module triggers a [DEP0040] DeprecationWarning. One of our transitive dependencies, uri-js@4.4.1, imports punycode, which leads to this warning. Even though a userland version of punycode (2.3.1) is installed, Node resolves the core module name first, so the warning still appears.

Workaround:
You can suppress deprecation warnings in your workflow by setting:

env:
NODE_OPTIONS: --no-deprecation

We are also tracking options to remove or replace the uri-js dependency since it is no longer actively maintained. Until then, the warning can safely be ignored or suppressed as shown above.
please feel free to reach us if any further concerns or clarifications :)

[asarkar]

@aparnajyothi-y Suppressing a warning that comes from an unmaintained module is a potential security risk. Since setup-java is widely used, I’d recommend treating this issue as high priority. It would be much safer to remove the uri-js dependency altogether.

I’d appreciate if you could share a plan or timeline for replacing uri-js with an alternative.

[reneleonhardt]

If the abandoned uri-js still is so important, why not switch to a maintained fork?
https://github.com/andreinwald/uri-js-replace

• Solves "The punycode module is deprecated" warning in Node

[asarkar]

@aparnajyothi-y Let me know if you need any more information to classify this ticket as a security issue.

[aparnajyothi-y]

Hello @asarkar, Thanks everyone for the detailed investigation and inputs!

We’ve identified that the deprecation warning originates from the transitive dependency chain within @azure/ms-rest-js, specifically through its usage of node-fetch@2.x
→ whatwg-url@5.0.0 → punycode.

We’re currently working internally to fix the issue to remove the deprecated punycode reference. The fix is in progress, and we’ll update this issue once the change is integrated and released in a future version of setup-node.

Thank you for your patience and for bringing this up!

[aparnajyothi-y]

Hello Everyone, Thank you once again for reporting this issue. We are currently working with the actions-cache team internally to investigate and resolve the deprecation warnings related to Node 24. Once we have an update or a resolution, we will share it here.

If you have any additional insights or encounter related issues, please feel free to add them to this thread. We appreciate your patience and collaboration.

[aparnajyothi-y]

Hello Everyone, Thank you for reporting this. The issue has been resolved in PR #687 and has been released as part of setup-java@v5.2.0. We’ve confirmed that the deprecation warning no longer appears.
Since the issue is now addressed, we are closing this. Please don’t hesitate to reach out if you notice any further issues.