Punycode Deprecated Error, a Future Major Version of Node.js the Module Will Be Removed

[mattjmoran]

Expected Behavior

Should not receive a punycode deprecation warning for running clasp push or other clasp commands that rely on punycode.

Actual Behavior

When running clasp push or other clasp commands that rely on punycode, the following deprecation error occurs:

(node:79914) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

This issue can be resolved by using the userland-provided Punycode.js instead, per the Node.js v22.9.0 documentation. Steps to resolve the issue are detailed in the provided documentation.

Steps to Reproduce the Problem

1. Run clasp push or other clasp commands that rely on punycode
2. Results in the following error:

(node:79914) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

Specifications

• Node version (node -v): 22.9.0
• Version (clasp -v): 2.4.2
• OS (Mac/Linux/Windows): Mac

[andyconlin]

As far as I can tell, this is due to gaxios, one of clasp's dependencies. Luckily, there's a pull request in the works and it looks like it could be merging soon! 🎉
googleapis/gaxios#617

[m3n94]

The pull request have been merged, but the deprecation error still persists. Am I missing something?

[andyconlin]

@m3n94 I'm not positive what all needs to happen, but afaik we have to wait for that version of gaxios to get released (it's currently v6.7.1, and this change is going to be included in the upcoming v7.0.0). Then that change has to trickle through the various packages that clasp is dependent on (directly or indirectly).

For those that understand npm and versioning better, please jump in and clarify where I may be off.

[mattjmoran]

@andyconlin I believe you are correct, PR #657 of gaxios does show that we are waiting for the v7.0.0 to release. I am not entirely aware of what is using gaxios in clasp. It could either be a clasp dependency or a nested dependency for something else in clasp's other dependencies. We would need those to also use v7.0.0 as well if it does include a fix for punycode's deprecation.

However, are we confident v7.0.0 includes the punycode fix as issue #640 says it is closed as a not planned issue. I did a quick scan of the v7.0.0 release notes and saw no relevant references to it. The package.json also has no inclusion of the punycode package that is required to resolve this issue. Am I missing something?

[andyconlin]

@mattjmoran It looks like clasp v2.4.2 doesn't have a direct dependency on gaxios, but the dependency is there via google-auth-library (possibly others). However, the current (unreleased/unversioned?) package.json for clasp does list gaxios as a dependency. Like you said, we might be waiting for gaxios v7.0.0 to trickle through updates on several other packages.

Iirc, gaxios v7.0.0 fixes the punycode error because of something to do with dropping support for older versions of node where punycode was. It doesn't directly address punycode, but the fix is a side effect of other changes they made. ...I think

This is all coming from my attempts to understand these systems, so I could be totally off 😆

[sqrrrl]

Still tracking this in gaxios, but in the mean time next release of 3.x alpha will suppress this warning