node-fetch v2.7.0: punycode is deprecated in 'whatwg-url' and 'tr46'

[spetrac]

trafficstars

Currently there are several issues raised for node-fetch v2.x (#1793, #1794, #1797) regarding the deprecation of punycode in whatwg-url up until v12.x (#261). There are over 5000 dependents on this module and using any of those packages outputs a deprecation warning regarding punycode.

https://github.com/lquixada/cross-fetch/blob/1fb2350e9e26bdc1a7903b8d5d051828503fbff6/src/node-ponyfill.js#L1-L2

https://github.com/lquixada/cross-fetch/blob/1fb2350e9e26bdc1a7903b8d5d051828503fbff6/src/node-ponyfill.js#L17-L19

As a solution I would suggest requiring the node-fetch module only when there is not already a fetch in the global scope (which was already introduced in node v17.5.0 and is stable since v21.0.0).

const nodeFetch = global.fetch || require('node-fetch') 
const realFetch = nodeFetch.default || nodeFetch 

exports.Headers = nodeFetch.Headers || global.Headers
exports.Request = nodeFetch.Request || global.Request
exports.Response = nodeFetch.Response || global.Response

With this everything should be backwards compatible and also upwards compatible with newer node versions. The only thing that might not be included is the agent options for the fetch method to inject a node http agent, but this feature of node-fetch is not a fetch standard anyways.

[iegik]

This because whatwg-fetch replaces global.fetch!! https://github.com/lquixada/cross-fetch/issues/184

[pfoerdie]

I don't think this is relevant here, because the rollup.config.js script, which uses whatwg-fetch, is meant to generate the browser version of the polyfill/ponyfill and is only used in the build step.

https://github.com/lquixada/cross-fetch/blob/1fb2350e9e26bdc1a7903b8d5d051828503fbff6/rollup.config.js#L1

This issue is not about the browser version, but about warning showing in the nodejs environment. And I think the problem and its solution is already described pretty accurate. It seems that the author of this package does not maintain it any further, because the last update is 1 year old and none of the issues was addressed ever since. I would advice library authors to find alternatives to this package for that reason.

[pfoerdie]

BTW, a quickfix for this issue is to create an override in the package.json for whatwg-url:

  "overrides": {
    "[email protected]": {
      "whatwg-url": "14.x"
    }
  },