punycode deprecation warning in node 21

[twelvelabs]

Describe the bug

I'm getting a node depreciation warning whenever I run redocly on node v21. Looks like it's coming from whatwg-url. They appear to have fixed it in v13.0.0.

To Reproduce

$ node --version
v21.1.0

$ redocly --version
1.4.1

$ NODE_OPTIONS='--trace-deprecation' redocly lint
(node:48436) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
    at node:punycode:3:9
    at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:392:7)
    at BuiltinModule.compileForPublicLoader (node:internal/bootstrap/realm:328:10)
    at loadBuiltinModule (node:internal/modules/helpers:101:7)
    at Module._load (node:internal/modules/cjs/loader:1001:17)
    at Module.require (node:internal/modules/cjs/loader:1235:19)
    at require (node:internal/modules/helpers:176:18)
    at Object.<anonymous> (/opt/homebrew/lib/node_modules/@redocly/cli/node_modules/whatwg-url/lib/url-state-machine.js:2:18)
    at Module._compile (node:internal/modules/cjs/loader:1376:14)
    at Module._extensions..js (node:internal/modules/cjs/loader:1435:10)
validating /src/schemas/default/openapi.yaml...
/src/schemas/default/openapi.yaml: validated in 3ms

Woohoo! Your API description is valid. 🎉

Expected behavior

No depreciation warning 😄.

Redocly Version(s)

1.4.1

Node.js Version(s)

v21.1.0

[tatomyr]

Thanks for reporting! We'll take a look at this.

[bentcoder]

Same here.

node: v21.2.0
npm: 10.2.4
yarn: 1.22.19

To reproduce.

FROM node:alpine3.18
ENV REDOCLY_TELEMETRY off
ENV NODE_OPTIONS --trace-deprecation
RUN npm install -g [email protected]
RUN npm install -g @redocly/cli
WORKDIR /api
COPY spec.yaml /api
RUN redocly lint spec.yaml

[tatomyr]

The issue comes from AJV:

┬ @redocly/[email protected] -> ./packages/core
└─┬ @redocly/[email protected]
  └─┬ [email protected]
    └── [email protected]

[RomanHotsiy]

We need to update our fork to the upstream version I think.

[domdomegg]

See garycourt/uri-js#95

[drwpow]

Update: problem also exists in Node 22 (current version)

[piotr-cz]

The issue also comes up from outdated tr46 package.

My workaround in package.json

{
  "overrides": {
    "@redocly/cli": {
      "uri-js": "npm:uri-js-replace",
      "whatwg-url": "^14.0.0"
    }
  }
}

It seems that updating project dependencies (ajv, node-fetch) should fix the problem

[DmitryAnansky]

@tatomyr / @lornajane
This issue should be fixed in @redocly/ajv "version": "8.11.2",
But it will take effect with the next version of CLI release.

[piotr-cz]

The native punycode is still required inside the outdated version [email protected]:

https://github.com/jsdom/tr46/blob/0.0.3/index.js#L3

npm ls tr46

@project/[email protected]
`-- @redocly/[email protected]
  `-- [email protected]
    `-- [email protected]
      `-- [email protected]

[tatomyr]

It's still reproducible. Reopening the issue.

[piotr-cz]

The uri-js package has been replaced by uri-js-replace in recent versions of @redocly/cli dependencies, but the issue persist due to [email protected]

[adamaltman]

Can we increase the priority of this (not because it causes any functional issue but because of pure aesthetics)?

DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

[tatomyr]

@adamaltman sure. @DmitryAnansky was about to pick it up the next week.

[piotr-cz]

Given that node-fetch (that requires outdated whatwg-url package) is a polyfill for native fetch which is available in newer node versions,
I'd use it only when native fetch is not available.