Node.js 21+: DeprecationWarning: The punycode module is deprecated from @stoplight/spectral-runtime

[silverwind]

@stoplight/spectral-runtime and @stoplight/json-ref-readers indirectly depend on node-fetch@2 and tr46@0.0.3 which triggers a runtime deprecation warning in Node.js 21 and above. As per node-fetch/node-fetch#1793 (comment), the likely only option is to upgrade to node-fetch@3:

Warning:

(node:77383) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.

Occurence:

$ rg require.+punycode node_modules/tr46/index.js
3:var punycode = require("punycode");

Dependency tree:

└─┬ @stoplight/spectral-cli@6.11.1
  └─┬ @stoplight/spectral-runtime@1.1.2
    └─┬ node-fetch@2.7.0
      └─┬ whatwg-url@5.0.0
        └── tr46@0.0.3

[karolvaclavik]

Please, any update on this?

[Diana-Potlog]

When will this issue be solved?

[dret]

It doesn't seem to happen all the time, just with certain rulesets? What exactly is triggering this error?

[silverwind]

Here is my ruleset in case it matters. It happens while linting a OpenAPI 3.0 file.

extends: [[spectral:oas, all]]

rules:
  contact-properties: off
  info-license: off
  license-url: off
  oas3-api-servers: off
  oas3-parameter-description: off
  openapi-tags: off
  operation-description: off
  operation-tag-defined: off

[dret]

Here is my ruleset in case it matters. It happens while linting a OpenAPI 3.0 file.

That's interesting because it doesn't even define rules, it just switches some off. For me, running Spectral with the built-in ruleset works, but using a --ruleset seems to trigger the error. I haven't experimented with it, though.

[silverwind]

It is a runtime deprecation in Node.js, these only log when actual code is being ran. The dependency trace above shows it's coming from node-fetch, so I guess in your case, it does not fetch anything so never hits the deprecation.

Why this validator needs to fetch in first place, is another question. Imho such a validator should work offline too.

[dret]

I assume reading any ruleset will be done through node-fetch, which apparently in newer versions of node could be replaced with a native fetch.

What I am wondering: If this happens whenever a ruleset is accessed this error should happen a lot, but it doesn't seem to affect many. Is it just that most are using older versions of node? From what I understand punycode was removed in node 11+, so this problem only happens with those versions. But node 11 was released in October 2018, so I would assume many should have newer versions and run into the same error?

[silverwind]

See https://nodejs.org/api/deprecations.html#dep0040-nodepunycode-module:

v21.0.0 Runtime deprecation.
v16.6.0 Added support for --pending-deprecation.
v7.0.0 Documentation-only deprecation.