Buffer() is deprecated due to security and usability issues (v2.0.0)

[marcofranssen]

In my workflows I'm using Node 16 (LTS)

When running this action it shows following logs.

(node:3250) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

Can this piece of code be updated to resolve this deprecation warning?

[jpogran]

This was raised in hashicorp/js-releases#42 and we have a potential fix for this in hashicorp/js-releases#43.

This will be in the js-releases 1.6 release, and I'll update this action when that is released.

[magnetikonline]

Thanks for circling this out @jpogran and @marcofranssen for logging the issue (something I forgot to do).

PR hashicorp/js-releases#43 has now been merged - pending next release.

[jpogran]

hashicorp/js-releases 1.6.0 has been released. This repo can now be updated to use that version to have this message removed.

[magnetikonline]

FYI (to circle around) this is the auto-cut Dependabot PR #214

Thanks @jpogran

[tobiasehlert]

Is there an estimate when this might be merged and released? 😄

[chrisk-tbot]

hey all, thanks for raising this and identifying root cause. Also just seconding that I would love to see a merge/release here as well. Doing some version updates and this error is hanging up our workflow. Thanks so much!

[cdaly1]

This warning is causing inconsistent failures in our workflows. Please merge and release ASAP.

[ianhundere]

@jpogran

any idea when this will be merged and 2.1.0 released ?

[jpogran]

All, apologies for the delay. I'll be reviewing the current state next week and getting a point release out

[ianhundere]

All, apologies for the delay. I'll be reviewing the current state next week and getting a point release out

@jpogran Any update on getting a point release out? Thanks 🙇🏼

[magnetikonline]

My changes in @hashicorp/js-releases to fix this issue dropped in the just released https://github.com/hashicorp/setup-terraform/releases/tag/v2.0.1.

Thus this issue should now be resolved. 👍

[jpogran]

Apologies on the delay, again. HashiConf kinda pushed things around in my schedule and I didn't get to this in the time I expected to.

I made a mistake in 2.0.1 in the release metadata, which I fixed in 2.0.2. I'll be updated the v2 tag later on today to finish out the release.

[magnetikonline]

Thx @jpogran 👍

I'll reconfirm with some workflows tomorrow on the v2 tag.

Update: still no update to the v2 tag (yet), receiving the message.

[mforutan]

@jpogran Can you please update the v2 tag?

[magnetikonline]

This can be closed out as fixed (just confirmed via a hashicorp/setup-terraform@v2 workflow run).

No longer seeing this DeprecationWarning message - the result of hashicorp/js-releases#43 in @hashicorp/js-releases: 1.6.0 now included. 👍

Thanks @jpogran for helping getting this one through / providing reviews to PRs. 👍

[bflad]

Closing per above. 😄

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.