Deprecated Punycode module generating deprecation warnings

[oscaralanpierce]

Basic info:

• Node.js version: 21.0.0
• jsdom version: 22.1.0

Minimal reproduction case

After updating to Node 21.0.0 from 19.8.1, I am seeing deprecation warnings when I run my headless Vitest tests:

The `punycode` module is deprecated. Please use a userland alternative instead.

You can see examples of this warning in the test step of this GitHub Actions build.

Running yarn why punycode on my project reveals that punycode is a transitive dependency of JSDOM that I cannot directly update or remove as a dependency. Looking through the issues and PRs on this repo, it seems no one has raised this before. I'm not sure of the scope of required changes to remove this module from JSDOM, but this is something I might be able to help out with if it isn't too onerous. In either case I thought the maintainers might like to know about this since it could be a compatibility issue with future Node versions.

Additional Information

Punycode is a transitive JSDOM dependency, through the tough-cookie package. Discussion on this issue report indicates that Punycode is removed as a dependency in v. 4.1.0.

[oscaralanpierce]

Update: This seems to be an issue with tough-cookie - they said updating tough-cookie to 4.1.3 should fix the warnings but it is already at 4.1.3 in my project. I'm following up with the maintainers to see what they say and will circle back here when I know more or an update is released.

[ddolcimascolo]

It's psl, actually. See lupomontero/psl#296

[oidualc]

So, from tough-cookie they say they don't intend to support Node 21, so the issue is not even considered. Would it mean that jsdom will print the warning for all the lifetime of Node 21, or is it possible to evaluate an alternative solution (e.g. use dependencies that do support non LTS Node versions)?
salesforce/tough-cookie#324

[oscaralanpierce]

Thanks for the added info, folks. I'd also be interested in JSDOM's intended path forward on Node 21 support since, as the thread @oidualc linked notes, Node 22 won't be out for a while. The offer to help out with this stands.

[wirdehall]

Thanks for the added info, folks. I'd also be interested in JSDOM's intended path forward on Node 21 support since, as the thread @oidualc linked notes, Node 22 won't be out for a while. The offer to help out with this stands.

Me too. Any update on this? Will JSOM not support Node 21?

[domenic]

jsdom works fine on Node 21.

[oidualc]

jsdom works fine on Node 21.

We know, the question is if jsdom supports Node 21, not if it just works on it. Those are two different things.

[domenic]

jsdom supports Node 21.

[luckydonald]

psl has been updated to use the userland one (lupomontero/psl@3ddec00).

Alternatively, tough-cookie has swiched to tldts: salesforce/tough-cookie#346,
as there's no movement in lupomontero/psl#296 (they finally fixed it almost two months ago, but still no release)

[skagedal]

Hello and thank you for maintaining this package! It appears that a new release of tough-cookie was released a few days ago that includes the updated dependencies. Would it be possible for you to upgrade the dependency of tough-cookie to 4.1.4?

EDIT: my bad, it seems this change was not included in 4.1.4, but after...

[domenic]

jsdom already uses ^ in its dependency specifier so there is no action necessary from our side as long as tough-cookie incorporates the improvement in a minor or patch version.

[eyelidlessness]

Would it be reasonable to load tough-cookie on demand (e.g. on access to cookie-specific DOM APIs)? I'd be happy to look into contributing this if it's welcome.