Update @whatwg-node/fetch to avoid punycode deprecation warning in Node

[daniel-nagy]

Is your feature request related to a problem? Please describe.

It looks like this package is using an old version of @whatwg-node/fetch. After upgrading to Node v22.0.0, I see warnings about punycode being deprecated. The source is graphql-codegen.

Describe the solution you'd like

Upgrade @whatwg-node/fetch to the latest version.

Describe alternatives you've considered

No response

Is your feature request related to a problem? Please describe.

punycode is deprecated but used by old versions of @whatwg-node/fetch.

[ardatan]

Have you tried to update your lockfile?

[gblues]

This issue doesn't have anything to do with the lockfile.

Very simple reproduction steps:

1. Make an empty directory
2. run node --version and confirm node is version 22.0.0 or newer
3. run npm init -y to create package.json
4. run npm install -D @graphql-codegen/cli @graphql-codegen/typescript @graphql-codegen/typescript-resolvers
5. run npx graphql-code-generator init

The punycode warning appears immediately:

npx graphql-code-generator init
(node:2916) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

This same warning appears when running graphql-codegen

[furai]

I think this actually breaks on node 22.4.x the watch mode when running codegen.

[formatlos]

Seeing the same issue

[deggertsen]

It looks like there is a dependency for @whatwg-node/fetch that is out of date which is depending on punycode. Perhaps all that is needed is to update that dependency?

[franck-lynn]

same am I , npm ls punycode

+-- @graphql-codegen/[email protected] | -- @whatwg-node/[email protected] | -- @whatwg-node/[email protected] | -- [email protected] | -- [email protected]

it looks like cause by the dependency of [email protected]

[deggertsen]

Here's the related fast-url-parser issue: https://github.com/petkaantonov/urlparser/issues/20

[deggertsen]

Ah, looking at the dependencies, it seems like @whatwg-node/fetch is using a different url parser (https://github.com/kamilkisiela/fast-url-parser) with its most recent version 0.9.20 but we're currently depending on 0.8.0. So, I think upgrading @whatwg-node/fetch is the right move here.

[avinashj-aa]

is there any update? is the codegen team going to release a new version with support for node 22 packages?

[avinashj-aa]

Is your feature request related to a problem? Please describe. It looks like this package is using an old version of @whatwg-node/fetch. After upgrading to Node v22.0.0, I see warnings about punycode being deprecated. The source is graphql-codegen.

Describe the solution you'd like Upgrade @whatwg-node/fetch to the latest version.

Describe alternatives you've considered No response

Is your feature request related to a problem? Please describe. punycode is deprecated but used by old versions of @whatwg-node/fetch.

[deggertsen]

Looks like this has been fixed in this commit https://github.com/dotansimha/graphql-code-generator/commit/e0092b548f51c95be19c232515cf9a72873e7b83 So now we're just waiting for a release!

[eddeee888]

Hi all, https://github.com/dotansimha/graphql-code-generator/pull/10076 has been merged so could you please check if the released versions work as expected?

[furai]

For me it still errors out. I've upgraded CLI package, I see that whatwg-node/fetch got updated in package lock but still same error about punycode persist. Maybe I have done something wrong in the upgrade process.

Though it seems like issue is in another package, namely whatwg-url, log from trace deprecation:

(node:85348) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
    at node:punycode:3:9
    at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:399:7)
    at BuiltinModule.compileForPublicLoader (node:internal/bootstrap/realm:338:10)
    at loadBuiltinModule (node:internal/modules/helpers:108:7)
    at Module._load (node:internal/modules/cjs/loader:1099:17)
    at TracingChannel.traceSync (node:diagnostics_channel:315:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:217:24)
    at Module.require (node:internal/modules/cjs/loader:1339:12)
    at require (node:internal/modules/helpers:135:16)
    at Object.<anonymous> (node_modules/whatwg-url/lib/url-state-machine.js:2:18)

Dependency tree for relevant package.

├─┬ @graphql-codegen/[email protected]
│ ├─┬ @graphql-tools/[email protected]
│ │ ├─┬ @ardatan/[email protected]
│ │ │ └─┬ [email protected]
│ │ │   ├── [email protected] deduped
│ │ │   └─┬ [email protected]
│ │ │     ├── [email protected]
│ │ │     └── [email protected]

[jay-l-e-e]

Any updates on this?

The only workaround available at the moment, unfortunately, is as follows:

  "overrides": {
    "@graphql-codegen/cli": {
      "node-fetch": "^3.3.2"
    }
  },

[keerthana-tw]

Bumping up discussion again. Is there any update on the issue? I still see errors and this is the dependency list I can see:

[eddeee888]

Hello! We are making a few changes to dependencies, will update here soon.

[dagadbm]

thank you! This comes just in time!

[eddeee888]

We found an old dependency in @graphql-codegen/cli that brings in node-fetch@^2.6.11 which causes this issue. Most likely noone is using the old dependency, but we cannot deprecate it without release of a major version. I'm working towards releasing major version for some other packages at the moment, I may just group this one as well.

As far as I understand, this is only a warning - so it's not impacting the functionality of the program. Please let me know if that's not the case.

[furai]

For me it was segfaulting.

[eddeee888]

Are you able to share a reproducible repo @furai ? I'm happy to take a look to see what's causing the segfaulting.

[furai]

Unfortunately it's part of our live services and not something I can easily extract. It was segfaulting for me the first time I've encountered this issue long time ago. Currently I'm not sure and I have to recheck how it behaves. I'll try to get back to you on it if I'll find time.