@actions/artifact: [DEP0005] DeprecationWarning caused when used in @actions/download-artifact

[MikeMcC399]

Describe the bug

@actions/artifact causes a Node.js DEP0005 deprecation warning in @actions/download-artifact

(node:2042) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead. (Use node --trace-deprecation ... to show where the warning was created)

To Reproduce

View logs of https://github.com/actions/download-artifact/actions/workflows/test.yml?query=branch%3Amain

Select the most recent run

• Build (ubuntu-latest)
  • Job Download artifact A Scroll down to DEP0005

Note DEP0005 deprecation warning.

To Debug

Add the following to https://github.com/actions/download-artifact/actions/workflows/test.yml and run:

env:
  NODE_OPTIONS: --trace-deprecation

(node:2063) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
    at showFlaggedDeprecation (node:buffer:191:11)
    at new Buffer (node:buffer:269:3)
    at new UnzipStream (/home/runner/work/download-artifact/download-artifact/dist/index.js:110127:17)
    at new Extract (/home/runner/work/download-artifact/download-artifact/dist/index.js:109833:24)
    at Object.Extract (/home/runner/work/download-artifact/download-artifact/dist/index.js:109828:12)
    at /home/runner/work/download-artifact/download-artifact/dist/index.js:2240:46
    at new Promise (<anonymous>)
    at /home/runner/work/download-artifact/download-artifact/dist/index.js:2221:16
    at Generator.next (<anonymous>)
    at fulfilled (/home/runner/work/download-artifact/download-artifact/dist/index.js:2150:58)

Add the following to https://github.com/actions/toolkit/blob/main/.github/workflows/artifact-tests.yml and run:

env:
  NODE_OPTIONS: "--pending-deprecation --trace-deprecation"

(node:2215) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
    at showFlaggedDeprecation (node:buffer:191:11)
    at new Buffer (node:buffer:269:3)
    at new UnzipStream (/home/runner/work/toolkit/toolkit/packages/artifact/node_modules/unzip-stream/lib/unzip-stream.js:47:17)
    at new Extract (/home/runner/work/toolkit/toolkit/packages/artifact/node_modules/unzip-stream/lib/extract.js:15:24)
    at Object.Extract (/home/runner/work/toolkit/toolkit/packages/artifact/node_modules/unzip-stream/lib/extract.js:10:12)
    at /home/runner/work/toolkit/toolkit/packages/artifact/lib/internal/download/download-artifact.js:118:46
    at new Promise (<anonymous>)
    at /home/runner/work/toolkit/toolkit/packages/artifact/lib/internal/download/download-artifact.js:99:16
    at Generator.next (<anonymous>)
    at fulfilled (/home/runner/work/toolkit/toolkit/packages/artifact/lib/internal/download/download-artifact.js:28:58)

Expected behavior

Using @actions/artifact should not cause a Node.js DEP0005 deprecation warning to be displayed when used in a GitHub JavaScript Action such as @actions/download-artifact

Additional context

• This is related to issue https://github.com/actions/download-artifact/issues/381

This repo uses https://github.com/actions/toolkit/blob/930c89072712a3aac52d74b23338f00bb0cfcb24/packages/artifact/package.json#L54

https://www.npmjs.com/package/unzip-stream

[MikeMcC399]

• A new issue has also been logged in https://github.com/mhr3/unzip-stream/issues/55

[fengmk2]

fix pull request https://github.com/mhr3/unzip-stream/pull/51

[MikeMcC399]

@fengmk2

• fix pull request https://github.com/mhr3/unzip-stream/pull/51

The PR you quote is from last year.

• Issue https://github.com/mhr3/unzip-stream/issues/55 hasn't got any response

So, unfortunately there is no real movement in that repo.

[MikeMcC399]

Still occurring in https://github.com/actions/download-artifact/actions/runs/16761021072/job/47455987757 Aug 5, 2025