Annoying Dependency Warnings

This dependency warning kept cluttering my console everytime I ran tests 🧐 So I found a way to get rid of it, without supressing warnings from Node. 🤓

The first thing with something like this, is to make sure you're standing on solid ground. I am alreadt on the LTS version of Node, v22, and I'm on the previous (and more stable) version of NextJS, v14. So I'm not going to be updating/downdating any of those.

❯ npm test

> finflow@0.1.0 test
> jest

(node:49713) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

You may have seen this warning if you use NextJS, Supabase, or Jest, among others. It's a warning that the punycode module is deprecated. The punycode module is a built-in Node.js module that provides a way of encoding and decoding Unicode strings.

The warning is harmless, but it can be annoying if you're trying to keep your console clean. The warning is triggered by a dependency that you're using, not by your code. So you can't just fix it by updating your code.

To fix the warning, you need to update the dependency that's causing it. To find the dependency, we can use npm:

❯ npm ls punycode
finflow@0.1.0 /Users/soulsurf/Desktop/finflow
├─┬ eslint@8.57.1
│ └─┬ ajv@6.12.6
│   └─┬ uri-js@4.4.1
│     └── punycode@2.3.1
└─┬ jest-environment-jsdom@29.7.0
  └─┬ jsdom@20.0.3
    ├─┬ data-urls@3.0.2
    │ └─┬ whatwg-url@11.0.0
    │   └─┬ tr46@3.0.0
    │     └── punycode@2.3.1 deduped
    ├─┬ tough-cookie@4.1.4
    │ └── punycode@2.3.1 deduped
    └─┬ whatwg-url@11.0.0
      └─┬ tr46@3.0.0
        └── punycode@2.3.1 deduped

Woah! Too many layers! 😅 But we can see that the punycode module is being used by eslint and jest-environment-jsdom.

I don't want to update my direct dependencies, so I'll go down the tree, and update the others.

If I browse the npm registry, I can see that the latest version of ajv is 8.17.1, whatwg-url is 14.0.0, and tough-cookie is 5.0.0. And looking at their dependencies, they have either removed the punycode module or updated it to a version that doesn't trigger the warning.

By overriding them in my package.json file:

// package.json

"overrides": {
  "ajv": "^8.17.1",
  "whatwg-url": "^14.0.0",
  "tough-cookie": "^5.0.0"
}

I am no longer getting the annoying warning everytime I run Jest!

Honestly, a completely unecessary fix. But I like my console like I like my code, clean. ✨

We still have punycode in there, but looking at the code on npm, I can see they imported it correctly.

❯ npm ls punycode
finflow@0.1.0 /Users/soulsurf/Desktop/finflow
└─┬ @supabase/supabase-js@2.46.1
  └─┬ @supabase/node-fetch@2.6.15
    └─┬ whatwg-url@14.0.0 overridden
      └─┬ tr46@5.0.0
        └── punycode@2.3.1

Still there, but it seems to be imported correctly according to the github page, and I don’t see any errors. A pointless endeavour, as this will no doubt be fixed in a future version of node or the packages will resolve it in time. But a thing to learn about dependencies.

Easier solution is to change your start or dev script in package.json to be prefixed with:

// package.json
NODE_NO_WARNINGS=1

But I do want warnings like this. I just don't want this one. 🤷‍♂️

I hope this helps you if you're seeing this warning too! 🚀

References

punycode