Skip to content

[DEP0040] DeprecationWarning: The punycode module is deprecated. Please use a userland alternative instead. #1283

New issue
New issue
Open
Open
[DEP0040] DeprecationWarning: The punycode module is deprecated. Please use a userland alternative instead.#1283
Labels
bugSomething isn't working

Description

@tlunsfordCXP
tlunsfordCXP
opened on Apr 15, 2024

Bug description

Running datadog-ci git-metadata upload returns the following error every time:

[DEP0040] DeprecationWarning: The punycode module is deprecated. Please use a userland alternative instead.

This sort of warning makes it very difficult to maintain clean CI/CD pipelines. These warnings build up and eventually hide items that are real issues. ...which make this sort of issue a real issue.

The history of this repo shows the warning as occurring in this code for well over a year.

Describe what you expected

No warning.

Steps to reproduce the issue

datadog-ci git-metadata upload

Additional context

Run in docker container datadog/ci.

Command

git-metadata

Activity

  1. tlunsfordCXP
    added
    bugSomething isn't working
    on Apr 15, 2024
  2. github-actions
    added
    source-code-integrationRelated to [git-metadata, gate]
    on Apr 15, 2024

  3. Drarig29 commented on Apr 15, 2024

    @Drarig29
    Drarig29
    on Apr 15, 2024
    Collaborator

    Hi @tlunsfordCXP! What version of the Docker image are you using?

  4. tlunsfordCXP commented on Apr 15, 2024

    @tlunsfordCXP
    tlunsfordCXP
    on Apr 15, 2024 via email
    Author

  5. Drarig29 commented on Apr 15, 2024

    @Drarig29
    Drarig29
    on Apr 15, 2024
    Collaborator

    Thanks for reporting!

    The issue started in datadog/ci:v2.25.0 because the Node.js version bundled in the Docker image went from v20.8.1 to v21.4.0:

    $ docker run --entrypoint node datadog/ci:v2.24.1 --version
v20.8.1

$ docker run --entrypoint node datadog/ci:v2.25.0 --version
v21.4.0

    To reproduce the issue:

    $ docker run -e NODE_OPTIONS=--trace-deprecation datadog/ci:v2.25.0 2>&1 | tail -n 14

You can also print more details about any of these commands by calling them with 
the `-h,--help` flag right after the command name.
(node:1) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
    at node:punycode:3:9
    at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:397:7)
    at BuiltinModule.compileForPublicLoader (node:internal/bootstrap/realm:333:10)
    at loadBuiltinModule (node:internal/modules/helpers:101:7)
    at Module._load (node:internal/modules/cjs/loader:1001:17)
    at Module.require (node:internal/modules/cjs/loader:1235:19)
    at require (node:internal/modules/helpers:176:18)
    at Object.<anonymous> (/usr/local/lib/node_modules/@datadog/datadog-ci/node_modules/ent/encode.js:1:16)
    at Module._compile (node:internal/modules/cjs/loader:1376:14)
    at Module._extensions..js (node:internal/modules/cjs/loader:1435:10)

    As you can see, the warning comes from ent, which is a 9-years-old package to decode HTML entities.

    It uses punycode, which used to be a native module in Node.js but which is deprecated starting from Node 21.

    This package is imported by @google-cloud/common:

    $ yarn why -R ent

└─ @datadog/datadog-ci@workspace:.
   └─ @google-cloud/logging@npm:11.0.0 (via npm:^11.0.0)
      └─ @google-cloud/common@npm:5.0.1 (via npm:^5.0.0)
         └─ ent@npm:2.2.0 (via npm:^2.2.0)

    Since ent isn't maintained anymore, and the corresponding repository was deleted, I'll make a PR on @google-cloud/common to use a different package.

  6. tlunsfordCXP commented on Apr 15, 2024

    @tlunsfordCXP
    tlunsfordCXP
    on Apr 15, 2024 via email
    Author

  7. Drarig29 commented on May 2, 2024

    @Drarig29
    Drarig29
    on May 2, 2024
    Collaborator

    Hi @tlunsfordCXP!

    googleapis/nodejs-common#812 was merged and released! 🎉

    But sadly, the warning still remains, and this time it's because of the node-fetch package, which is used by gaxios (used in multiple Google API packages).

    This was already reported in googleapis/gaxios#429 (comment), and is tracked in googleapis/gaxios#508.

    We'll have to wait for gaxios to get rid of this warning. 🙇

  8. tlunsfordCXP commented on May 3, 2024

    @tlunsfordCXP
    tlunsfordCXP
    on May 3, 2024 via email
    Author

  9. fishpen0 commented on Dec 27, 2024

    @fishpen0
    fishpen0
    on Dec 27, 2024

    It looks like this package still needs punycode via ajv

    ├─┬ @datadog/[email protected]
│ └─┬ [email protected]
│   └─┬ [email protected]
│     └── [email protected]

    ajv 8.17.1 has removed punycode and datadog can now use it

  10. Drarig29 commented on Jan 6, 2025

    @Drarig29
    Drarig29
    on Jan 6, 2025
    Collaborator

    Hi @fishpen0! The ajv package is only used by dev dependencies in datadog-ci, so it's not the culprit:

    yarn why -R punycode
└─ @datadog/datadog-ci@workspace:.
   ├─ @microsoft/eslint-formatter-sarif@npm:3.1.0 (via npm:^3.0.0)
   │  └─ eslint@npm:8.57.0 (via npm:^8.9.0)
   │     ├─ @eslint/eslintrc@npm:2.1.4 (via npm:^2.1.4)
   │     │  └─ ajv@npm:6.12.6 (via npm:^6.12.4)
   │     │     └─ uri-js@npm:4.4.1 (via npm:^4.2.2)
   │     │        └─ punycode@npm:2.3.1 (via npm:^2.1.0)
   │     └─ ajv@npm:6.12.6 (via npm:^6.12.4)
   └─ eslint@npm:7.32.0 (via npm:^7.32.0)
      ├─ @eslint/eslintrc@npm:0.4.3 (via npm:^0.4.3)
      │  └─ ajv@npm:6.12.6 (via npm:^6.12.4)
      └─ ajv@npm:6.12.6 (via npm:^6.10.0)

    We can still see the deprecation message in the latest version of datadog-ci:

    $ docker run -e NODE_OPTIONS=--trace-deprecation datadog/ci:v2.46.2

(node:1) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
    at node:punycode:3:9
    at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:399:7)
    at BuiltinModule.compileForPublicLoader (node:internal/bootstrap/realm:338:10)
    at loadBuiltinModule (node:internal/modules/helpers:114:7)
    at Function._load (node:internal/modules/cjs/loader:1100:17)
    at TracingChannel.traceSync (node:diagnostics_channel:315:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:218:24)
    at Module.require (node:internal/modules/cjs/loader:1340:12)
    at require (node:internal/modules/helpers:141:16)
    at Object.<anonymous> (/usr/local/lib/node_modules/@datadog/datadog-ci/node_modules/whatwg-url/lib/url-state-machine.js:2:18)

    And as I said above, this is caused by whatwg-url, which is a dependency of node-fetch:

    yarn why -R whatwg-url
└─ @datadog/datadog-ci@workspace:.
   ├─ @google-cloud/logging@npm:11.1.0 (via npm:^11.1.0)
   │  ├─ @google-cloud/common@npm:5.0.2 (via npm:^5.0.0)
   │  │  ├─ google-auth-library@npm:9.7.0 (via npm:^9.0.0)
   │  │  │  ├─ gaxios@npm:6.7.0 (via npm:^6.1.1)
   │  │  │  │  └─ node-fetch@npm:2.7.0 [22a35] (via npm:^2.6.9 [22a35])
   │  │  │  │     └─ whatwg-url@npm:5.0.0 (via npm:^5.0.0)
   │  │  │  ├─ gcp-metadata@npm:6.1.0 (via npm:^6.1.0)
   │  │  │  │  └─ gaxios@npm:6.7.0 (via npm:^6.0.0)
   │  │  │  └─ gtoken@npm:7.1.0 (via npm:^7.0.0)
   │  │  │     └─ gaxios@npm:6.7.0 (via npm:^6.0.0)
   │  │  ├─ retry-request@npm:7.0.2 (via npm:^7.0.0)
   │  │  │  └─ teeny-request@npm:9.0.0 (via npm:^9.0.0)
   │  │  │     └─ node-fetch@npm:2.7.0 [22a35] (via npm:^2.6.9 [22a35])
   │  │  └─ teeny-request@npm:9.0.0 (via npm:^9.0.0)
   │  ├─ gcp-metadata@npm:6.1.0 (via npm:^6.0.0)
   │  ├─ google-auth-library@npm:9.7.0 (via npm:^9.0.0)
   │  └─ google-gax@npm:4.3.8 (via npm:^4.0.3)
   │     ├─ google-auth-library@npm:9.7.0 (via npm:^9.3.0)
   │     ├─ retry-request@npm:7.0.2 (via npm:^7.0.0)
   │     └─ node-fetch@npm:2.7.0 [22a35] (via npm:^2.6.9 [22a35])
   ├─ @google-cloud/run@npm:1.4.0 (via npm:^1.4.0)
   │  └─ google-gax@npm:4.3.8 (via npm:^4.0.3)
   ├─ google-auth-library@npm:9.12.0 (via npm:^9.12.0)
   │  ├─ gaxios@npm:6.7.0 (via npm:^6.1.1)
   │  ├─ gcp-metadata@npm:6.1.0 (via npm:^6.1.0)
   │  └─ gtoken@npm:7.1.0 (via npm:^7.0.0)
   └─ pkg@npm:5.8.1 [77038] (via npm:5.8.1 [77038])
      └─ pkg-fetch@npm:3.4.2 (via npm:3.4.2)
         └─ node-fetch@npm:2.7.0 [22a35] (via npm:^2.6.9 [22a35])

    This may have been fixed since my last message though, so I'll look into a possible update.

  11. jakub-g commented on Jan 27, 2025

    @jakub-g
    jakub-g
    on Jan 27, 2025
    Member

    I did some digging:

    FWIW:

    • Current version of whatwg-url is 14.x
    • The punycode dep was removed in [email protected] (release logs)
    • From reading whatwg-url release notes, pretty much every breaking release is mostly about raising minimum supported nodejs version

    In theory, this dep from node-fetch to whatwg-url is a de facto noop since nodejs 7.x because node 7.x shipped the URL module, and node-fetch@2 uses whatwg-url as follows: const URL = Url.URL || whatwgUrl.URL;

    Although, I just tried forcing whatwg-url@14 through yarn resolution in my userland repo, and I get ReferenceError: TextEncoder is not defined here which makes no sense with node22 🤔

  12. jakub-g commented on Feb 12, 2025

    @jakub-g
    jakub-g
    on Feb 12, 2025
    Member

    FWIW, until this is fixed, it's possible to suppress this warning by running datadog-ci as follows:

    NODE_OPTIONS='--disable-warning=DEP0040' yarn datadog-ci ...

    (as long as you use it as a yarn dependency, without bundled node binary)

  13. Drarig29 commented on Feb 12, 2025

    @Drarig29
    Drarig29
    on Feb 12, 2025
    Collaborator

    Note that there is some update on google-auth-library's side: googleapis/google-auth-library-nodejs#1938 was created, and updates gaxios to 7.0.0-rc.1, which includes googleapis/gaxios#617.

  14. Drarig29 commented on Jun 11, 2025

    @Drarig29
    Drarig29
    on Jun 11, 2025
    Collaborator

    Update: [email protected] was released so we now need to wait for:

    And that should be it!

  15. jakub-g commented on Aug 20, 2025

    @jakub-g
    jakub-g
    on Aug 20, 2025
    Member

    But maybe we can try to bump the deps and see if the issue is still there? Maybe the remaining non-migrated usages are not called from our code paths.

  16. Drarig29 commented on Aug 20, 2025

    @Drarig29
    Drarig29
    on Aug 20, 2025
    Collaborator

    Maybe the remaining non-migrated usages are not called from our code paths.

    @jakub-g the issue is that we currently import all commands at startup, which import all the dependencies. And the punycode deprecation warning happens at import time.

    I'll try with some await import() at the right places.

  17. Drarig29 commented on Aug 21, 2025

    @Drarig29
    Drarig29
    on Aug 21, 2025
    Collaborator

    Thanks for the suggestion @jakub-g!

    The DeprecationWarning should disappear in @datadog/[email protected], except using datadog-ci cloud-run flare with the --with-logs option in Node.js 21+.

    I'll keep the issue open until googleapis/google-cloud-node#7565 is closed and we can finally get rid of the deprecation warning altogether.

  18. Drarig29
    removed
    source-code-integrationRelated to [git-metadata, gate]
    on Sep 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions