Replace psl dependency with tldts

[isaacl]

The psl project seems to be dead.

It's generating a punycode deprecation warning despite an 18mo old open pull request fixing this issue. tough-cookie incurs a serious performance bottleneck due to its use of psl.

tldts is active, and much, much more performant.

Can you fix this, please?

[colincasey]

Thanks for opening this issue @isaacl. We have discussed a replacement for psl and tldts look decent.

[obecker]

@colincasey I think you should consider also removing "@types/psl": "^1.1.3" from the devDependencies.

[colincasey]

Thanks for calling that out @obecker. It will be removed with #406.

[skagedal]

Thank you for this fix! It seems it didn't make it into the 4.1.4 release. Will there be a new release soon?

[colincasey]

@skagedal this won't be backported to 4.1.4. It's only available in our v5 release candidate for now (5.0.0-rc.1).

The upcoming v5 release is primarily an internal uplift that includes TypeScript support and improved documentation so it should be a seamless upgrade but feel free to try out the release candidate ahead of time and report any issues 😄

[skagedal]

Ah, thanks, I had missed that release candidate! I tested it out in our project and indeed, PSL is now gone along with those particular punycode warnings. Good work.

[iambumblehead]

the punycode warning for the last year or so is very annoying

[JessicaSachs]

Hey, I wrote a bit of a book here for others to find. Please feel free to reference it as people complain about trying to suppress the warning from punycode.

@skagedal this won't be backported to 4.1.4. It's only available in our v5 release candidate for now (5.0.0-rc.1).

The upcoming v5 release is primarily an internal uplift that includes TypeScript support and improved documentation so it should be a seamless upgrade but feel free to try out the release candidate ahead of time and report any issues 😄

The 5.0.0-rc.1 release doesn't seem to remove the dependency on punycode BUT THE 5.0.0-rc.4 version does.

Steps to override transitive tough-cookie deps to use 5.0.0-rc.4

If you have a dependency on tough-cookie from a test-only package like jsdom or msw, here's how you override the dependency to fall through to tough-cookie's pre-release version. I suggest doing a fine-grained control to scope overrides to the build-only or test-only packages where your changes are more-or-less guaranteed to be harmless.

1. Find the deps (npm ls punycode)

Detect where the transitive dep is from using npm ls punycode. If you're using msw (v2.3.5 at time of writing), it depends on tough-cookie. You'll see something like this output when running npm ls punycode.

2. Trash your lockfiles and node_modules

3. Setup overrides in package.json

Start forcing resolutions using npm overrides. I suggest doing this in a way that you're sure is safe for your codebase. You can just say "tough-cookie": "5.0.0-rc.4" but I wouldn't risk using an rc version in production without significant testing.

Example fixed package.json:

{
  "dependencies": {
    "msw": "latest"
  },
  "overrides": {
    "msw": {
      "tough-cookie": "5.0.0-rc.4"
    }
  }
}

4. npm install

If you do it right:

• npm ls punycode should come up empty

• looking in your node_modules for tough-cookie should show the proper version number.

Other package managers:

• pnpm overrides
• bun overrides
• deno overrides (not implemented?)
• yarn resolutions (good luck)

[MikeMcC399]

@JessicaSachs

I'm seeing tough-cookie@5.0.0 now released.