search

qubyte / fetch-ponyfill

WHATWG fetch ponyfill
MIT License
235 stars 37 forks source link

Transitive dependency on deprecated `punycode` Node module #264

Closed akrawitz closed 11 months ago

akrawitz commented 11 months ago

fetch-ponyfill has a direct dependency on an old version of "node-fetch": "~2.6.1", which in turn depends on an old version of "whatwg-url": "^5.0.0", which uses Node's long deprecated punycode module (https://nodejs.org/api/punycode.html). As of Node 21, this is now causing Node to generate warning messages every time it is run:

(node:12764) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.

This could be fixed, I think, by bumping your node-fetch dependency to the current v3 (https://github.com/node-fetch/node-fetch/), which no longer depends on whatwg-url. (Although I will also note that the latest version of whatwg-url is free of punycode as well).

qubyte commented 11 months ago

node-fetch 3+ is not compatible with the way the build for this one works. See #259.

Since Node 18 (which happens to be the lowest version still in maintenance) Node itself has included an unflagged fetch implementation, and the need for this ponyfill in Node has steadily decreased with time. It's similarly rare to need it in browser contexts. I will likely deprecate this package soon.

akrawitz commented 11 months ago

Got it. Thanks for the super-quick response and the explanation. Sounds like the best path forward is to move away from dependence on this polyfill.