DeprecationWarning: punycode module due to tr46 in mongoose dependency chain

[elgwhoppo]

Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the issue has not already been raised

Issue

I am encountering a DeprecationWarning for the punycode module in my Node.js application. This warning is traced back to the tr46 package, which is a sub-dependency of the latest release of mongoose, which at the time of writing is 8.0.1. The dependency chain is as follows.

└─┬ mongoose@8.0.1
└─┬ mongodb@6.2.0
└─┬ mongodb-connection-string-url@2.6.0
└─┬ whatwg-url@11.0.0
└─┬ tr46@3.0.0
└── punycode@2.3.1

The error message I received today was:
2023-11-21 09:55:05 (node:1) [DEP0040] DeprecationWarning: The punycode module is deprecated. Please use a userland alternative instead.

While this is not a bug, it is a warning that I would like to bring to the attention of the team.

[vkarpov15]

This was fixed upstream with https://jira.mongodb.org/browse/NODE-5709, we will bump mongodb driver to 6.3.0 for the fix.

[merlinstardust]

What is the ETA for 8.1 to be released?

[vkarpov15]

@merlinstardust next week

[0inp]

Hi!

Despite this issue seems resolved since quite some time, I still have the issue today.

❯ node --version
v22.4.1

❯ npm --version
10.8.1

├─┬ mongoose@8.5.0
│ ├── bson@6.8.0
│ ├── kareem@2.6.3
│ ├─┬ mongodb@6.7.0
│ │ ├── UNMET OPTIONAL DEPENDENCY @aws-sdk/credential-providers@^3.188.0
│ │ ├─┬ @mongodb-js/saslprep@1.1.7
│ │ │ └─┬ sparse-bitfield@3.0.3
│ │ │   └── memory-pager@1.5.0
│ │ ├── UNMET OPTIONAL DEPENDENCY @mongodb-js/zstd@^1.1.0
│ │ ├── bson@6.8.0 deduped
│ │ ├─┬ gcp-metadata@5.3.0
│ │ │ ├─┬ gaxios@5.1.3
│ │ │ │ ├── extend@3.0.2 deduped
│ │ │ │ ├─┬ https-proxy-agent@5.0.1
│ │ │ │ │ ├─┬ agent-base@6.0.2
│ │ │ │ │ │ └── debug@4.3.5 deduped
│ │ │ │ │ └─┬ debug@4.3.5
│ │ │ │ │   └── ms@2.1.2
│ │ │ │ ├── is-stream@2.0.1 deduped
│ │ │ │ └── node-fetch@2.7.0 deduped
│ │ │ └── json-bigint@1.0.0 deduped
│ │ ├── UNMET OPTIONAL DEPENDENCY kerberos@^2.0.1
│ │ ├── UNMET OPTIONAL DEPENDENCY mongodb-client-encryption@>=6.0.0 <7
│ │ ├─┬ mongodb-connection-string-url@3.0.1
│ │ │ ├─┬ @types/whatwg-url@11.0.5
│ │ │ │ └── @types/webidl-conversions@7.0.3
│ │ │ └─┬ whatwg-url@13.0.0
│ │ │   ├─┬ tr46@4.1.1
│ │ │   │ └── punycode@2.3.1
│ │ │   └── webidl-conversions@7.0.0
│ │ ├── UNMET OPTIONAL DEPENDENCY snappy@^7.2.2
│ │ └── UNMET OPTIONAL DEPENDENCY socks@^2.7.1
│ ├── mpath@0.9.0
│ ├─┬ mquery@5.0.0
│ │ └─┬ debug@4.3.5
│ │   └── ms@2.1.2
│ ├── ms@2.1.3
│ └── sift@17.1.3

mongoose version : 8.5.0 (which is superior to the 8.1.0 version that should resolve the sous-jacent problem)
mongoDB driver version : 6.7.0 (which is superior to the 6.3.0 version that should resolve the sous-jacent problem)

What can I do about it ? Thanks a lot for your help.

[vkarpov15]

@0inp Do you have a package-lock.json? That is likely what is causing you to install an old version of punycode, even though your dependency tree relies on punycode@^2.3.1