Deprecated dependency on whatwg-url -> punycode triggers DeprecationWarning

[jk-sulis]

Bug report

• [x ] I confirm this is a bug with Supabase, not with my own application.
• [ x] I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Issue was already reported in the js-client repo as supabase/supabase-js#914 . Seems to me that here is the appropriate place.

In short: supabase/node-fetch is dependent on whatwg-url ^5.0.0 . This raises a deprecation warning for the punycode module. Do you plan on upgrading whatwg-url to a newer version, solving the deprecation?

Thanks for your awesome work!

To Reproduce

Copied from supabase/supabase-js#914:

1. npm install @supabase/supabase-js
2. node .
3. Error: DeprecationWarning: The punycode module is deprecated. Please use a userland alternative instead.
4. npm ls whatwg-url
5. Response: @supabase/supabase-js@2.38.4
   │ └─┬ @supabase/node-fetch@2.6.14
   │ └── whatwg-url@5.0.0

Expected behavior

No deprecation.

System information

Copied from supabase/supabase-js#914:

• OS: WSL2 on Windows 10
• Version of supabase-js: ^2.38.4
• Version of Node.js: v21.1.0

[Aron-Lomner]

Does Supabase plan on addressing this any time soon?

[lordsoffallen]

Can we get this solved/merged? It's been years and still waiting for a fix..

[dubiousdavid]

I'm seeing this as well. It feels unacceptable that this has been outstanding for so long.

[mandarini]

Hi everyone! Thank you very much for contributing to Supabase, and I 100% understand your frustration.

I have replied here: supabase/supabase-js#914 (comment)

but I can reiterate the rationale in this issue as well.

Once we officially drop support for Node 18, in October, then I will be merging this PR, or some version of it, removing the @supabase/node-fetch dependency and saving everyone from this warning.

I know that some of you may see a solution here, but that would require Node >= 18. As our new Support Policy, is, well, new, I don't want anyone using Node <18 (for whatever reason they may have to use such an old version) to run into any issues. This has indeed created some debt, but all debt will be resolved starting November 1st, I promise. Please bear with me.

Thank you very much for your understanding, and I appreciate you bearing with me in this issue, which I agree is annoying.

Once November comes, and we remove the node-fetch dependency, I will come to this repo and update the whatwg-url for anyone still using @supabase/node-fetch. Until then, however, I think it's best to hold off another 3 months.

I could probably suppress the warning, but I think I prefer to take the proper "road" and wait for our official support drop of Node 18.

Let me know if you think we should do otherwise, I am open to ideas that could keep everyone happy, and non-breaking!

Once again, thank you very much for being part of the Supabase community!

[dubiousdavid]

Thank you for the update! That makes a lot of sense. I ended up adding this to my package.json file:

{  "overrides": { "whatwg-url": "^14.2.0" } }