v5+: DeprecationWarning: The `punycode` module is deprecated

[silverwind]

Description:

Running v5 shows deprecation DEP0040 for node:punycode which is runtime-deprecated since Node v21. This refers to the node built-in punycode module, not the npm module of the same name.

Run actions/setup-node@v5
Attempting to download 24...
(node:2116) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

This issue was introduced by #1325.

Action version:
v5

Platform:
all

Runner type:
all

Tools version:
any

Repro steps:
Run the action

Expected behavior:
No deprecation warning

Actual behavior:
Deprecation warning

[v-priyagupta108]

Hello @silverwind 👋,
Thank you for your report. We'll investigate the issue and get back to you with the details!

[cclauss]

The same message also appears in

• Post actions/setup-python@v6
• Post actions/setup-node@v5

[trivikr]

Likely comes from @actions/cache dependency.

$ grep -rnI 'require("punycode")' node_modules
node_modules/whatwg-url/lib/url-state-machine.js:2:const punycode = require("punycode");
node_modules/tr46/index.js:3:var punycode = require("punycode");

$ npm list whatwg-url
setup-node@5.0.0 /Users/trivikram/workspace/setup-node
└─┬ @actions/cache@4.0.3
  └─┬ @azure/ms-rest-js@2.7.0
    └─┬ node-fetch@2.7.0
      └── whatwg-url@5.0.0

$ npm list tr46
setup-node@5.0.0 /Users/trivikram/workspace/setup-node
└─┬ @actions/cache@4.0.3
  └─┬ @azure/ms-rest-js@2.7.0
    └─┬ node-fetch@2.7.0
      └─┬ whatwg-url@5.0.0
        └── tr46@0.0.3

Looks like https://github.com/Azure/ms-rest-js will need to bump node-fetch dependency to 3.x
Details node-fetch/node-fetch#1826 (comment)

[aparnajyothi-y]

Hello Everyone Thanks everyone for the detailed investigation and inputs!

We’ve identified that the deprecation warning originates from the transitive dependency chain within @azure/ms-rest-js, specifically through its usage of node-fetch@2.x
→ whatwg-url@5.0.0 → punycode.

We’re currently working internally to fix the issue to remove the deprecated punycode reference. The fix is in progress, and we’ll update this issue once the change is integrated and released in a future version of setup-node.

Thank you for your patience and for bringing this up!

[MikeMcC399]

This also affects actions/setup-node@6.0.0.

[jsoref]

• Fwiw, node-fetch@2.x will not fix this Faulty NPM upload 2.7.0 node-fetch/node-fetch#1797 -> chore: avoid deprecation warning node-fetch/node-fetch#1793 (comment)
• Afaict, node-fetch@v3.x does not have this dependency.

[jsoref]

• A quick review of https://github.com/Azure/ms-rest-js/issues indicates that Azure/ms-rest-js has been abandoned...
• Meat should be meet Azure/ms-rest-js#487
• so the library probably should be replaced...
• technically this ticket will be resolved in actions/toolkit Azure/ms-rest-js -> node-fetch@v2 dependency triggers "DeprecationWarning: The punycode module is deprecated" toolkit#2173

[silverwind]

I can recommend the https://www.npmjs.com/package/punycode.js module as a replacement for the node builtin, it's the same code as the node builtin, and has an unambiguous module name.

[MikeMcC399]

@silverwind

I can recommend the https://www.npmjs.com/package/punycode.js module as a replacement for the node builtin, it's the same code as the node builtin, and has an unambiguous module name.

You've given the right recommendation, however as several previous posts describe, the issue is not caused directly in the actions/setup-node repo, but in the use of @actions/cache and so it needs to be fixed there. So hopefully issue actions/toolkit#2173 will get some attention from the GitHub team soon!

[jsoref]

The upstream repo has merged a fix for this:
https://github.com/actions/toolkit/pull/2110/files#r2482040347

So when this repository upgrades to actions/cache v5 the problem will be resolved.