DeprecationWarning for punycode module

[tleonhardt]

What happened?

Upon running the gemini CLI, the following warning appears in red text:

(node:99526) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

To reproduce:

gemini --version

What did you expect to happen?

At least for the current stable release of gemini, I do not expect to see any warnings upon launch.

Client information

Client Information

Run gemini to enter the interactive CLI, then run the /about command.

> /about
│ About Gemini CLI                                                                  │
│                                                                                   │
│ CLI Version                 0.4.1                                                 │
│ Git Commit                  70ff7a36                                              │
│ Model                       gemini-2.5-pro                                        │
│ Sandbox                     no sandbox                                            │
│ OS                          darwin                                                │
│ Auth Method                 OAuth

Login information

Google Account

Anything else we need to know?

• Gemini CLI version: 0.4.1
• OS: macOS Sequoia 15.7
• Architecture: Apple M3 Max (ARM64)
• npm version: 11.6.0
• node version: 22.9.0

[gemini-cli[bot]]

The user is reporting a DeprecationWarning when running the CLI. This is an unexpected output, making it a 'kind/bug'. The issue is caused by the punycode module being deprecated in the user's version of Node.js, which falls under 'area/platform' (OS/runtime compatibility) and is directly related to 'dependencies'.

[lifefloating]

The punycode deprecation warning appears starting from Node.js 21.0.0.

Timeline:

• Node.js 7.0.0 - Only documented as deprecated, no runtime warning
• Node.js 21.0.0 - Started showing runtime deprecation warnings
• Node.js 22.x - Continues to show warnings

The warnings mainly come from indirect dependencies of third-party packages:

• jsdom → whatwg-url → tr46 → punycode
• eslint → ajv → uri-js → punycode
• msw → tough-cookie → punycode
• @google-cloud/storage -> [email protected] -> [email protected] -> punycode

[lifefloating]

maybe we should consider update these

[lifefloating]

/assign

[gemini-cli[bot]]

👋 @lifefloating! You currently have 3 issues assigned to you. We have a 3 max issues assigned at once policy. Once you close out an existing issue it will open up space to take another. You can also unassign yourself from an existing issue but please work on a hand-off if someone is expecting work on that issue.

[lifefloating]

@google-cloud/[email protected] ├── [email protected] │ └── [email protected] │ ├── [email protected] │ │ └── [email protected] │ │ └── [email protected]

this is outdate for this

other issues can be resolved by upgrading, but this one — @google-cloud/storage — is still not working even after upgrading to the latest version, because it has a dependency issue with the latest version of gaxios. @tleonhardt

[tleonhardt]

gaxios 7.x does not have a dependency on punycode anymore.

google-cloud/storage latest version is pinned to gaxios 6.x

I opened an issue with google-cloud/storage about this: https://github.com/googleapis/nodejs-storage/issues/2649, but their bot auto-closed it. Oh the customer obsession ;-)

[agmsb]

@tleonhardt thanks for opening the issue, apologies for that experience. i have tried to reopen the same and received the same results. i've flagged this internally and will report back.

[prochac]

There is no way to override the dependency? Some kind of replace directive? What if it hypothetically contains vulnerability, it would also take ~~two~~ three months to upgrade?

The deprecation note makes the CLI quite hard to use, as it creates noise. My "workaround" is to redirect stderr to /dev/null. Yet it's a quite suboptimal practice. As then, I must hope for a happy case scenario.

[vyrx-dev]

[caluckenbach]

I am having the same issue using bun v1.3.2 and Gemini CLI v0.16.0

[hashmil]

Still experiencing this issue on the latest version with Node v22.12.0 on macOS Sequoia.

The warning originates from [email protected] in the dependency tree:

at Object.<anonymous> (/Users/.../.nvm/versions/node/v22.12.0/lib/node_modules/@google/gemini-cli/node_modules/whatwg-url/lib/url-state-machine.js:2:18)

PR #3332 was closed claiming the issue was resolved, but it clearly persists. The fix would be to update whatwg-url to v14+ or add npm overrides in package.json.

[gemini-cli[bot]]

Hello! As part of our effort to keep our backlog manageable and focus on the most active issues, we are tidying up older reports.

It looks like this issue hasn't been active for a while, so we are closing it for now. However, if you are still experiencing this bug on the latest stable build, please feel free to comment on this issue or create a new one with updated details.

Thank you for your contribution!