@actions/artifact: [DEP0005] DeprecationWarning caused when used in @actions/download-artifact

[MikeMcC399]

Describe the bug

@actions/artifact causes a Node.js DEP0005 deprecation warning in @actions/download-artifact

(node:2042) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Use node --trace-deprecation ... to show where the warning was created)

To Reproduce

View logs of https://github.com/actions/download-artifact/actions/workflows/test.yml?query=branch%3Amain

Select the most recent run

• Build (ubuntu-latest)
  • Job Download artifact A
    Scroll down to DEP0005

Note DEP0005 deprecation warning.

To Debug

Add the following to https://github.com/actions/download-artifact/actions/workflows/test.yml and run:

env:
  NODE_OPTIONS: --trace-deprecation

(node:2063) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
    at showFlaggedDeprecation (node:buffer:191:11)
    at new Buffer (node:buffer:269:3)
    at new UnzipStream (/home/runner/work/download-artifact/download-artifact/dist/index.js:110127:17)
    at new Extract (/home/runner/work/download-artifact/download-artifact/dist/index.js:109833:24)
    at Object.Extract (/home/runner/work/download-artifact/download-artifact/dist/index.js:109828:12)
    at /home/runner/work/download-artifact/download-artifact/dist/index.js:2240:46
    at new Promise (<anonymous>)
    at /home/runner/work/download-artifact/download-artifact/dist/index.js:2221:16
    at Generator.next (<anonymous>)
    at fulfilled (/home/runner/work/download-artifact/download-artifact/dist/index.js:2150:58)

Add the following to https://github.com/actions/toolkit/blob/main/.github/workflows/artifact-tests.yml and run:

env:
  NODE_OPTIONS: "--pending-deprecation --trace-deprecation"

(node:2215) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
    at showFlaggedDeprecation (node:buffer:191:11)
    at new Buffer (node:buffer:269:3)
    at new UnzipStream (/home/runner/work/toolkit/toolkit/packages/artifact/node_modules/unzip-stream/lib/unzip-stream.js:47:17)
    at new Extract (/home/runner/work/toolkit/toolkit/packages/artifact/node_modules/unzip-stream/lib/extract.js:15:24)
    at Object.Extract (/home/runner/work/toolkit/toolkit/packages/artifact/node_modules/unzip-stream/lib/extract.js:10:12)
    at /home/runner/work/toolkit/toolkit/packages/artifact/lib/internal/download/download-artifact.js:118:46
    at new Promise (<anonymous>)
    at /home/runner/work/toolkit/toolkit/packages/artifact/lib/internal/download/download-artifact.js:99:16
    at Generator.next (<anonymous>)
    at fulfilled (/home/runner/work/toolkit/toolkit/packages/artifact/lib/internal/download/download-artifact.js:28:58)

Expected behavior

Using @actions/artifact should not cause a Node.js DEP0005 deprecation warning to be displayed when used in a GitHub JavaScript Action such as @actions/download-artifact

Additional context

• This is related to issue [bug] node DeprecationWarning: Buffer() is deprecated due to security and usability issues.... download-artifact#381

This repo uses

toolkit/packages/artifact/package.json

Line 54 in 930c890

"unzip-stream": "^0.3.1"

$ npm ls unzip-stream
@actions/artifact@2.3.3
└── unzip-stream@0.3.4

https://www.npmjs.com/package/unzip-stream

[MikeMcC399]

• A new issue has also been logged in [Severe] node DeprecationWarning: Buffer() is deprecated due to security and usability issues mhr3/unzip-stream#55

[fengmk2]

fix pull request mhr3/unzip-stream#51

[MikeMcC399]

@fengmk2

• fix pull request Replaced Buffer constructor with Buffer.from and Buffer.alloc mhr3/unzip-stream#51

The PR you quote is from last year.

• Issue [Severe] node DeprecationWarning: Buffer() is deprecated due to security and usability issues mhr3/unzip-stream#55 hasn't got any response

So, unfortunately there is no real movement in that repo.