build: replace deprecated built-in punycode with userland package

[jacob314]

Summary

This PR replaces the deprecated built-in node:punycode module with the userland punycode npm package. This addresses the DeprecationWarning: The punycode module is deprecated warning that appears when bundling and running the CLI due to deep transitive dependencies (e.g., node-fetch, whatwg-url) relying on it.

Details

1. Added punycode@^2.3.1 as a root dependency.
2. Updated esbuild.config.js to alias punycode: 'punycode/' for both cliConfig and a2aServerConfig.
3. Updated packages/vscode-ide-companion/esbuild.js to include the same punycode: 'punycode/' alias.

These alias configurations instruct esbuild to bundle the userland package in place of the built-in node module whenever any transitive dependency requests punycode, silently fixing the deprecation without needing forks of upstream packages.

This is aligned with the instructions on https://www.npmjs.com/package/punycode

⚠️ Note that userland modules don't hide core modules. For example, require('punycode') still imports the deprecated core module even if you executed npm install punycode. Use require('punycode/') to import userland modules rather than core modules.

Related Issues

Fixes: #18342

[gemini-cli]

Hi there! Thank you for your contribution to Gemini CLI.

To improve our contribution process and better track changes, we now require all pull requests to be associated with an existing issue, as announced in our recent discussion and as detailed in our CONTRIBUTING.md.

This pull request is being closed because it is not currently linked to an issue. Once you have updated the description of this PR to link an issue (e.g., by adding Fixes #123 or Related to #123), it will be automatically reopened.

How to link an issue:
Add a keyword followed by the issue number (e.g., Fixes #123) in the description of your pull request. For more details on supported keywords and how linking works, please refer to the GitHub Documentation on linking pull requests to issues.

Thank you for your understanding and for being a part of our community!

[gemini-code-assist]

Summary of Changes

Hello @jacob314, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a DeprecationWarning related to the punycode module by transitioning from Node.js's deprecated built-in version to a userland npm package. The change ensures that applications relying on punycode through transitive dependencies will use the supported alternative, thereby cleaning up build and runtime warnings without requiring modifications to upstream packages.

Highlights

• Deprecated Punycode Module Replacement: The deprecated built-in node:punycode module has been replaced with the userland punycode npm package to resolve DeprecationWarning messages during bundling and CLI execution, which were caused by deep transitive dependencies.
• Dependency Update: The punycode@^2.3.1 package was added as a root dependency in package.json and package-lock.json.
• Esbuild Configuration Updates: Esbuild configurations in esbuild.config.js and packages/vscode-ide-companion/esbuild.js were updated to alias punycode to the newly added userland package, ensuring it's bundled correctly for CLI, A2A server, and VSCode companion builds.

Changelog

• esbuild.config.js
  • Added punycode: 'punycode/' alias to the cliConfig object.
  • Added punycode: 'punycode/' alias to the a2aServerConfig object.
• package-lock.json
  • Added a new entry for the punycode package version 2.3.1.
  • Removed the devOptional: true flag from the punycode package entry.
• package.json
  • Added "punycode": "^2.3.1" to the dependencies list.
• packages/vscode-ide-companion/esbuild.js
  • Added punycode: 'punycode/' alias to the esbuild configuration for the VSCode IDE companion.

Activity

• The author validated the changes on MacOS using npm run.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This PR correctly addresses the deprecation warning for the punycode module by replacing it with a userland package and using an esbuild alias. The changes are straightforward and effective. I've added one suggestion to refactor the esbuild configuration to reduce code duplication and improve long-term maintainability, in line with existing repository practices.

[gemini-cli]

Thank you for linking an issue! This pull request has been automatically reopened.

[github-actions]

Size Change: +7.62 kB (+0.03%)

Total Size: 24.5 MB

Filename	Size	Change
./bundle/gemini.js	24.5 MB	+7.62 kB (+0.03%)

ℹ️ View Unchanged

Filename	Size
./bundle/sandbox-macos-permissive-open.sb	890 B
./bundle/sandbox-macos-permissive-proxied.sb	1.31 kB
./bundle/sandbox-macos-restrictive-open.sb	3.36 kB
./bundle/sandbox-macos-restrictive-proxied.sb	3.56 kB
./bundle/sandbox-macos-strict-open.sb	4.82 kB
./bundle/sandbox-macos-strict-proxied.sb	5.02 kB

_{compressed-size-action}

[skeshive]

/patch

[github-actions]

✅ Patch workflow(s) dispatched successfully!

📋 Details:

• Channels: stable,preview
• Commit: c43500c50b3184802ac45135c8d0fd4cb665c9be
• Workflows Created: 2

🔗 Track Progress:

• View patch workflows
• This workflow run

[github-actions]

🚀 Patch PR Created!

📋 Patch Details:

• Environment: prod
• Channel: preview → will publish to npm tag preview
• Commit: c43500c50b3184802ac45135c8d0fd4cb665c9be
• Hotfix Branch: hotfix/v0.30.0-preview.1/0.30.0-preview.2/preview/cherry-pick-c43500c/pr-19502
• Hotfix PR: #19521

📝 Next Steps:

1. Review and approve the hotfix PR: #19521
2. Once merged, the patch release will automatically trigger
3. You'll receive updates here when the release completes

🔗 Track Progress:

• View hotfix PR #19521

[github-actions]

🚀 Patch PR Created!

📋 Patch Details:

• Environment: prod
• Channel: stable → will publish to npm tag latest
• Commit: c43500c50b3184802ac45135c8d0fd4cb665c9be
• Hotfix Branch: hotfix/v0.29.2/0.29.3/stable/cherry-pick-c43500c/pr-19502
• Hotfix PR: #19522

📝 Next Steps:

1. Review and approve the hotfix PR: #19522
2. Once merged, the patch release will automatically trigger
3. You'll receive updates here when the release completes

🔗 Track Progress:

• View hotfix PR #19522

[github-actions]

🚀 Patch Release Started!

📋 Release Details:

• Environment: prod
• Channel: stable → publishing to npm tag latest
• Version: v0.29.2
• Hotfix PR: Merged ✅
• Release Branch: release/v0.29.2-pr-19502

⏳ Status: The patch release is now running. You'll receive another update when it completes.

🔗 Track Progress:

• View release workflow

[github-actions]

🚀 Patch Release Started!

📋 Release Details:

• Environment: prod
• Channel: preview → publishing to npm tag preview
• Version: v0.30.0-preview.1
• Hotfix PR: Merged ✅
• Release Branch: release/v0.30.0-preview.1-pr-19502

⏳ Status: The patch release is now running. You'll receive another update when it completes.

🔗 Track Progress:

• View release workflow

[github-actions]

✅ Patch Release Complete!

📦 Release Details:

• Version: 0.30.0-preview.2
• NPM Tag: preview
• Channel: preview
• Dry Run: false

🎉 Status: Your patch has been successfully released and published to npm!

📝 What's Available:

• GitHub Release: View release v0.30.0-preview.2
• NPM Package: npm install @google/gemini-cli@preview

🔗 Links:

• GitHub Release
• Workflow Run

[github-actions]

✅ Patch Release Complete!

📦 Release Details:

• Version: 0.29.3
• NPM Tag: latest
• Channel: stable
• Dry Run: false

🎉 Status: Your patch has been successfully released and published to npm!

📝 What's Available:

• GitHub Release: View release v0.29.3
• NPM Package: npm install @google/gemini-cli@latest

🔗 Links:

• GitHub Release
• Workflow Run