Issue with dependency "node-fetch": "cjs"

[agracio]

Hi, There is a new deprecation warning that is coming from dependency "node-fetch": "cjs" . It has a dependency on old version of whatwg-url module that is now throwing deprecation error in Node.js.

(node:451448) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.

Nide.js 22.7.0

[agracio]

@leonelsanchesdasilva Only got around to testing now, unfortunately still the same problem with "node-fetch": "release-2.x", it references "whatwg-url": "^5.0.0" that has the issue and throws a red deprecation warning into the console every time 'xslt-processor' is invoked.

[leonelsanchesdasilva]

@agracio I released another version today, this time forcing whatwg-url to version 14. I believe this should resolve the issue now. https://github.com/DesignLiquido/xslt-processor/releases/tag/v3.2.3

[agracio]

Still same issue, maybe package.json overrides do not apply when xslt-processor is installed as dependency in another project. I will try to add similar overrides in my project maybe it will help.

EDIT: In order to resolve the issue with older version of "whatwg-url used this in package.json, you could do that as well its much easier than overrides

"peerDependencies": {
    "whatwg-url": "14.x"
  }

But the problem still persists - punycode was removed from whatwg-url instead they use a dependency on "tr46": "^5.0.0" that uses punycode.

Will open issue in whatwg-url repo. https://github.com/jsdom/whatwg-url/issues/279

From what I can see all projects are using correct 'userland' punycode yet I keep getting red deprecation message every time I use xslt-processor. Really at a loss right now, maybe will have to go and narrow it down project by project ie whatwg-url and then tr46.

Another edit: Finally got to the bottom of it using node --trace-deprecation myscript.js. warning originates here:

node_modules\node-fetch\node_modules\whatwg-url\lib\url-state-machine.js:2:18

Meaning node-fetch installs it own "whatwg-url": "^5.0.0" under its node_modules directory and does not use "whatwg-url": "14.0.0" that is located under project node_modules.

[agracio]

@leonelsanchesdasilva Any ideas how to tackle this problem?

[leonelsanchesdasilva]

@leonelsanchesdasilva Any ideas how to tackle this problem?

I'm considering replacing node-fetch by axios. The problem will be the package bloating.

Another alternative is to update node-fetch to the most recent version, but I think I had problems I tried to package it. I'll have to test it properly.

[agracio]

Thanks, let me know if I can be of any help. Started using it recently for a project but having a red deprecation message would be an issue for an end user. It is not published yet but is nearing initial release https://github.com/agracio/xml2mochawesome

[leonelsanchesdasilva]

@agracio From initial tests using the traditional fetch() from Node.js 18, I think I can simply get rid of node-fetch. I use node-fetch because of <xsl:include> and <xsl:import>, but if people use Node.js below version 17.5.0, I'll have to test the Node.js version to inform that <xsl:include> and <xsl:import> are not supported.

[leonelsanchesdasilva]

@agracio Please test version https://github.com/DesignLiquido/xslt-processor/releases/tag/v3.3.0. I removed node-fetch completely.

[agracio]

I think something went wrong with NPM publishing, 3.3.0 still shows dependency on 'node-fetch' in NPM although it is removed in GitHub repo. Generated JS code also requires 'node-fetch'.

[agracio]

@leonelsanchesdasilva could you publish package to NPM with correct dependencies and code.

[leonelsanchesdasilva]

@leonelsanchesdasilva could you publish package to NPM with correct dependencies and code.

This is done. https://github.com/DesignLiquido/xslt-processor/releases/tag/v3.3.1

I executed a clean rebuild. It should not have the dependency anymore.

[agracio]

Perfect works like a charm now. Tanks!