Suppress punycode warnings for both CLI and the app

[wojtekn]

Related issues

• Fixes STU-639

Proposed Changes

• I propose to suppress punycode warnings for both the CLI and the app. It doesn't cause any problems for the app, but it shows a confusing warning as part of the command output.

Before	After

Installing punycode as an explicit dependency didn't help - there is some dependency that loads deprecated punycode.

Testing Instructions

1. Rebuild command:

npm run cli:watch

3. Run command

node dist/cli/main.js

4. Confirm there is no punycode warning.

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

[gcsecsey]

Changes LGTM and I can confirm that the warnings are suppressed. 👍

trunk	this branch

[wojtekn]

@sejas thanks for confirming. I tried again, and reproduced.

[sejas]

yep, all good, I was able to reproduce it.

[sejas]

I confirm this PR hides the punycode warning with code DEP0040.
It would be interesting to track an issue if upgrading some dependencies can fix the issue in the future.

Before:

❯ node dist/cli/main.js  --help
(node:31152) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
WordPress Studio CLI

Commands:
  studio preview  Manage preview sites

Options:
  --help     Show help                                                 [boolean]
  --version  Show version number                                       [boolean]
  --path     Path to the WordPress files   [string] [default: Current directory]

You must provide a valid command

After

❯ node dist/cli/main.js --help
WordPress Studio CLI

Commands:
  studio preview  Manage preview sites

Options:
  --help     Show help                                                 [boolean]
  --version  Show version number                                       [boolean]
  --path     Path to the WordPress files   [string] [default: Current directory]
`

[sejas]

Here are the dependencies that use punycode.

❯ npm ls punycode
./studio
├─┬ @wp-playground/[email protected]
│ └─┬ [email protected]
│   └─┬ [email protected]
│     └── [email protected]
└─┬ [email protected]
  └─┬ [email protected]
    ├─┬ [email protected]
    │ └── [email protected] deduped
    └─┬ [email protected]
      └─┬ [email protected]
        └── [email protected] deduped

I suspect that I didn't see the error at first because I was experimenting with the latest playground dependencies. We can revisit if we can remove this custom code after we update to Blueprints 1.2.3+.

[wojtekn]

@sejas the trick is that the warning doesn't come from NPM dependencies you showed in the npm ls output. The Punycode 2.3.1 module installed as an NPM dependency is functioning correctly.

The warning thrown from punycode, which is part of Node, and used by one of our dependencies, possibly this one:

% npm ls tr46                                              
[email protected] /Users/cyphelf/Sites/studio
├─┬ [email protected]
│ └─┬ [email protected]
│   └─┬ [email protected]
│     └── [email protected]
└─┬ [email protected]
  └─┬ [email protected]
    └── [email protected]

We could pursue it further, but even if we fix it, it can resurface if any other dependency starts using Node's punycode.

[sejas]

Yeah, I think it makes sense to merge this PR. But I also think that from time to time, if we upgrade a dependency that includes punycode, we should check if this warning is gone. My feeling is that @wp-playground/blueprints is the one pulling that dependency and causing the warning, but you're right that it could be tr46 or another package.

[epeicher]

@sejas, @wojtekn, also there is the npm why command that can be used to identify the chain of dependencies causing a package to be installed: https://docs.npmjs.com/cli/commands/npm-explain.

For example, npm why punycode. The problem is that the output is a bit verbose.

Additionally, we can temporarily use yarn && yarn why punycode and the output is more concise:

Then delete the yarn.lock afterwards to clean leftovers.

[wojtekn]

@epeicher thanks for sharing those steps.

As I mentioned above, it's not really about an NPM dependency that uses punycode as NPM dependency. It's about some dependency that loads NPM's punycode module which is deprecated since Node 22 - as far as I see, at least tr46 package does that:

require("punycode")

See the StackOverflow thread.